Remove entitlement from access profile via API

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hello,

I’d like to perform entitlement removal from access profile via API. I know, that I can perform it using “op”: “replace” but it is not perfect solution. I’d like to use “op”: "remove", but I am still getting this error

[
  {
    "op": "remove",
    "path": "/entitlements/-",
    "value": [
      {
        "id": "004bc4870173479bace1bb117a85b2b7",
        "type": "ENTITLEMENT",
        "name": "testEntitlement"
      }
    ]
  }
]

{
    "messages": [
        {
            "localeOrigin": "DEFAULT",
            "text": "The request was syntactically correct but its content is semantically invalid.",
            "locale": "en-US"
        },
        {
            "localeOrigin": "REQUEST",
            "text": "The request was syntactically correct but its content is semantically invalid.",
            "locale": "en-US"
        }
    ],
    "detailCode": "400.1 Bad request content",
    "trackingId": "332688e4336e460db33979ff876104c0"
}

What is the correct API call to remove entitlement from access profile?
The documentation unfortunately does not provide a clear answer on this topic. Thank you very much for your help.

2

It is working in my case-

image
image1264×745 57.8 KB

However, the issue is that it removes all entitlements, including the one that was requested.

2 Likes
3

Sometimes we encounter this issue in Postman. In such cases, try generating a new Client ID and Secret and update them in Postman. If the issue persists, try using VS Code instead.

2 Likes
4

I believe that you need to reference the entitlement by position, based on the documentation.

Screenshot 2025-07-16 at 8.54.36 AM
Screenshot 2025-07-16 at 8.54.36 AM757×722 31.5 KB

2 Likes
5

Hi Pawl,

“path”: “/entitlements/-” is invalid, because the remove operation requires an explicit index, such as:

{
“op”: “remove”,
“path”: “/entitlements/0” - it will remove first entitlement
}

6

Thank you for your response. However, I would like to clarify that I do not want to remove all entitlements - only a specific one.

7

Thank you for your response. While that is a valid solution, (in my case) managing around 4000 access profiles makes it very difficult to track the exact position of each entitlement. Ideally, there should be an API call that allows removing entitlements from access profiles based on the entitlement ID, rather than their position.

8

I agree there should be a way to remove the entitlement by ID.

Once option might be to get the list of the existing entitlements, remove the one you want from the list, then do the Replace Entitlements and pass the new list of entitlements in without the one you wanted to remove. It’s longer, but may be easier to manage than locating the index of the entitlement, then removing by index.