Removes one organization-level role from the MongoDB Cloud user. You can remove a role from an active user or a user that has not yet accepted the invitation to join the organization. To replace a user's only role, add the new role before removing the old role. A user must have at least one role at all times. To use this resource, the requesting Service Account or API Key must have the Organization Owner role.
Note: This operation is atomic.
Note: This resource cannot be used to remove a role from users invited using the deprecated Invite One MongoDB Cloud User to Join One Project endpoint.
Unique 24-hexadecimal digit string that identifies the organization that contains your projects. Use the /orgs endpoint to retrieve all organizations to which the authenticated user has access.
Format should match the following pattern: ^([a-f0-9]{24})$.
Unique 24-hexadecimal digit string that identifies the pending or active user in the organization. If you need to lookup a user's userId or verify a user's status in the organization, use the Return All MongoDB Cloud Users in One Organization resource and filter by username.
Format should match the following pattern: ^([a-f0-9]{24})$.
Flag that indicates whether Application wraps the response in an envelope JSON object. Some API clients cannot access the HTTP response headers or status code. To remediate this, set envelope=true in the query. Endpoints that return a list of results use the results object as an envelope. Application adds the status parameter to the response body.
Default value is false.
Flag that indicates whether the response body should be in the prettyprint format.
Default value is false.
atlas api mongoDbCloudUsers removeOrgRole --helpimport (
"os"
"context"
"log"
sdk "go.mongodb.org/atlas-sdk/v20250312001/admin"
)
func main() {
ctx := context.Background()
clientID := os.Getenv("MONGODB_ATLAS_CLIENT_ID")
clientSecret := os.Getenv("MONGODB_ATLAS_CLIENT_SECRET")
// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth
client, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))
if err != nil {
log.Fatalf("Error: %v", err)
}
params = &sdk.RemoveOrgUserRoleApiParams{}
sdkResp, httpResp, err := client.MongoDBCloudUsersApi.
RemoveOrgUserRoleWithParams(ctx, params).
Execute()
}
curl --include --header "Authorization: Bearer ${ACCESS_TOKEN}" \
--header "Accept: application/vnd.atlas.2025-03-12+json" \
--header "Content-Type: application/json" \
-X POST "https://cloud.mongodb.com/api/atlas/v2/orgs/{orgId}/users/{userId}:removeRole" \
-d '{ <Payload> }'curl --user "${PUBLIC_KEY}:${PRIVATE_KEY}" \
--digest --include \
--header "Accept: application/vnd.atlas.2025-03-12+json" \
--header "Content-Type: application/json" \
-X POST "https://cloud.mongodb.com/api/atlas/v2/orgs/{orgId}/users/{userId}:removeRole" \
-d '{ <Payload> }'{
"orgRole": "ORG_OWNER"
}{
"id": "32b6e34b3d91647abb20e7b8",
"orgMembershipStatus": "PENDING",
"roles": {
"groupRoleAssignments": [
{
"groupId": "32b6e34b3d91647abb20e7b8",
"groupRoles": [
"string"
]
}
],
"orgRoles": [
"ORG_OWNER"
]
},
"teamIds": [
"32b6e34b3d91647abb20e7b8"
],
"username": "hello@example.com",
"invitationCreatedAt": "2026-05-04T09:42:00Z",
"invitationExpiresAt": "2026-05-04T09:42:00Z",
"inviterUsername": "hello@example.com"
}{
"id": "32b6e34b3d91647abb20e7b8",
"orgMembershipStatus": "ACTIVE",
"roles": {
"groupRoleAssignments": [
{
"groupId": "32b6e34b3d91647abb20e7b8",
"groupRoles": [
"string"
]
}
],
"orgRoles": [
"ORG_OWNER"
]
},
"teamIds": [
"32b6e34b3d91647abb20e7b8"
],
"username": "hello@example.com",
"country": "US",
"createdAt": "2026-05-04T09:42:00Z",
"firstName": "John",
"lastAuth": "2026-05-04T09:42:00Z",
"lastName": "Doe",
"mobileNumber": "string"
}{
"error": 400,
"detail": "(This is just an example, the exception may not be related to this endpoint) No provider AWS exists.",
"reason": "Bad Request",
"errorCode": "VALIDATION_ERROR"
}{
"error": 401,
"detail": "(This is just an example, the exception may not be related to this endpoint)",
"reason": "Unauthorized",
"errorCode": "NOT_ORG_GROUP_CREATOR"
}{
"error": 403,
"detail": "(This is just an example, the exception may not be related to this endpoint)",
"reason": "Forbidden",
"errorCode": "CANNOT_CHANGE_GROUP_NAME"
}{
"error": 404,
"detail": "(This is just an example, the exception may not be related to this endpoint) Cannot find resource AWS",
"reason": "Not Found",
"errorCode": "RESOURCE_NOT_FOUND"
}{
"error": 500,
"detail": "(This is just an example, the exception may not be related to this endpoint)",
"reason": "Internal Server Error",
"errorCode": "UNEXPECTED_ERROR"
}