# Webservice - Provisioning must delete existing entitlement before adding (Only add API call available)) **URL:** \ **Category:** IIQ Discussion and Questions\ **Tags:** identityiq, provisioning, roles\ **Created:** [January 22, 2025, 12:06am UTC](https://developer.sailpoint.com/discuss/t/webservice-provisioning-must-delete-existing-entitlement-before-adding-only-add-api-call-available/98161 "2025-01-22T00:06:46Z")\ **Posts on this page:** 1\ **Showing post:** 6
**Author:** ![Arpitha1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/arpitha1/32/20512_2.png) [@Arpitha1](https://developer.sailpoint.com/discuss/u/Arpitha1)\ **Post date:** [January 23, 2025, 3:04am UTC](https://developer.sailpoint.com/discuss/t/webservice-provisioning-must-delete-existing-entitlement-before-adding-only-add-api-call-available/98161/6 "2025-01-23T03:04:40Z")
Yes, with SOD, we will enforce users to submit a role removal request. Whenever they submit a role removal, entitlement removal occurs, and it attempts to execute the ‘Remove Entitlement’ operation. For writing SOD, you can refer to this [link](https://developer.sailpoint.com/discuss/t/advanced-policy-violation-rule/69084/4). You may need to tweak it a bit to get the business role of your particular application. Also, I apologize for missing your point. If your requirement is to remove an IT role and not a business role, making the entitlement attribute single-valued or using a before provisioning rule to remove the entitlement would suffice. Once you remove the entitlement, the IT role will be removed automatically after refreshing the identity with the option below. ![image](https://global.discourse-cdn.com/sailpoint/original/3X/3/e/3eb3ea39a84ae54df2f346305e63650d0000b2b4.png) --- _[View the full topic](https://developer.sailpoint.com/discuss/t/webservice-provisioning-must-delete-existing-entitlement-before-adding-only-add-api-call-available/98161)._