> ## Documentation Index > Fetch the complete documentation index at: https://developers.portao3.com.br/llms.txt > Use this file to discover all available pages before exploring further. # Revoke a user from an organization > Removes a user from an organization and blocks their personal wallet in it. Repeating the request is safe. Realm administrators can't be removed through the API. Answers the user with the same fields as the organization's user list, and `userOrgLevel` `null`: they no longer belong to the organization. Their other organizations are never listed. ## OpenAPI ````yaml /api-reference/identity.openapi.json post /realms/{realmId}/users/{userId}/organizations/{organizationId}/revoke openapi: 3.0.3 info: title: Identity version: 1.0.0 description: >- Portão 3 identity API. Every endpoint requires a bearer token in the Authorization header (Authorization: Bearer ) unless its page states otherwise; see the Authentication guide. That requirement is not repeated per endpoint. Generated by tools/openapi from code (routes + security) and the hand-written spec (request/response bodies). 4 app groups run without the identity authorizer; publicPatterns enumerates every route they expose, except POST /auth/sign-in, documented with HTTP Basic for the API-client credentials flow. Confidence tiers: generated:typed=45 copied:manual=0 unknown=0. servers: - url: https://api.identity.v2.portao3.com.br/ description: production - url: https://api.identity.dev.3pers.com.br/ description: development security: [] tags: - name: Authentication - name: Current User - name: Custom Fields - name: API Clients - name: Users - name: Organizations - name: Groups - name: Realms paths: /realms/{realmId}/users/{userId}/organizations/{organizationId}/revoke: post: tags: - Users summary: Revoke a user from an organization description: >- Removes a user from an organization and blocks their personal wallet in it. operationId: postRealmsByRealmIdUsersByUserIdOrganizationsByOrganizationIdRevoke parameters: - name: realmId in: path required: true description: |- ID of your realm. Format: `UUID` schema: type: string format: uuid example: f495ff0c-ab54-4f99-8e92-ca8682e4de9b - name: userId in: path required: true description: |- ID of the user to remove from the organization. Format: `UUID` schema: type: string format: uuid example: 8f1c2d3e-4b5a-4c6d-9e7f-a1b2c3d4e5f6 - name: organizationId in: path required: true description: |- ID of the organization to remove the user from. Format: `UUID` schema: type: string format: uuid example: c4bd3f21-dfbd-44e8-8055-68ba15bed410 responses: '200': description: Successful response content: application/json: schema: type: object properties: id: type: string description: ID of the user. example: 8f1c2d3e-4b5a-4c6d-9e7f-a1b2c3d4e5f6 format: uuid email: type: string description: >- E-mail address the user signs in with. It can't be changed. example: ana.souza@acme.com.br firstName: type: string description: First name. example: Ana lastName: type: string description: Last name. example: Souza cpf: type: string description: CPF, digits only. example: '52998224725' birthdate: type: string description: Date of birth, at midnight UTC. example: '1990-05-17T00:00:00.000Z' format: date-time phone: type: string description: >- Phone number in E.164 format. Omitted when the user has none. example: '+5511987654321' status: type: string enum: - IN_ONBOARDING - CREATING - ACTIVE - DEACTIVATED - BLOCKED description: >- Lifecycle status. `IN_ONBOARDING`: invited, still completing onboarding. `ACTIVE`: can sign in. `DEACTIVATED`: access removed by an administrator. `BLOCKED`: access suspended, for example after too many wrong PINs. `CREATING`: being set up. example: ACTIVE statusCode: type: string enum: - BLOCKED_BY_PIN - BLOCKED_BY_MFA - BLOCKED_BY_ADMIN - USER_ACTIVE - USER_DEACTIVATED - ONLY_ONBOARDING description: >- Reason behind `status`: `USER_ACTIVE`, `USER_DEACTIVATED`, `ONLY_ONBOARDING`, or the cause of a block (`BLOCKED_BY_PIN`, `BLOCKED_BY_MFA`, `BLOCKED_BY_ADMIN`). example: USER_ACTIVE realm: type: object properties: id: type: string description: ID of the realm. example: f495ff0c-ab54-4f99-8e92-ca8682e4de9b format: uuid level: type: string enum: - ADMIN - USER - APP_CLIENT description: >- Access level in the realm. `ADMIN` can manage every organization and user of the realm; `USER` acts only in the organizations listed in `organizations`. `APP_CLIENT` can appear on users created with that level. example: USER name: type: string description: Display name of the realm. Can be empty. example: '' required: - id - level - name description: The user's realm and their access level in it. hasMfa: type: boolean description: Whether the user has set up multi-factor authentication. example: true hasPin: type: boolean description: Whether the user has created a transaction PIN. example: true hasFacialBiometric: type: boolean description: Whether the user's face was validated during onboarding. example: true pinErrorsCount: type: number description: >- Consecutive wrong PIN attempts. At 3 the user is blocked (`BLOCKED_BY_PIN`). example: 0 mfaErrorsCount: type: number description: Consecutive wrong multi-factor codes. example: 0 customFields: type: object additionalProperties: {} description: >- Values of the realm's user custom fields, keyed by the custom field's `slug`, for example `{"cost-center": "Marketing"}`. Omitted when the user has none. createdAt: type: string description: When the user was created. example: '2026-03-02T14:21:07.512Z' format: date-time updatedAt: type: string description: When the user last changed. example: '2026-10-13T18:43:50.746Z' format: date-time createdBy: type: string description: >- ID of the user or API client that created this user. Empty when unknown. example: 43230779-2cfb-4525-a40c-77fbf15e68f0 updatedBy: type: string description: >- ID of the user or API client that last changed this user. Empty when unknown. example: 43230779-2cfb-4525-a40c-77fbf15e68f0 deletedBy: type: string description: >- ID of the user or API client that deactivated this user. Empty unless the user was deactivated. example: '' userOrgLevel: type: string description: >- Always `null`: the user no longer belongs to the organization of the request, so they have no level in it. example: null nullable: true enum: - null required: - cpf - createdAt - createdBy - deletedBy - email - firstName - hasFacialBiometric - hasMfa - hasPin - id - lastName - mfaErrorsCount - pinErrorsCount - realm - status - statusCode - updatedAt - updatedBy - userOrgLevel description: >- A user just removed from an organization: the same fields as a user of the organization (`OrganizationUserResponse`), with `userOrgLevel` set to `null`. '403': description: '`FORBIDDEN_USER` — The user is a realm administrator.' content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - FORBIDDEN_USER description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - IDENTITY description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: FORBIDDEN_USER origin: IDENTITY message: You do not have permission to perform this action on this user '404': description: '`USER_NOT_FOUND` — No user with this ID exists in your realm.' content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - USER_NOT_FOUND description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - IDENTITY description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: USER_NOT_FOUND origin: IDENTITY message: User not found '422': description: >- `BAD_REQUEST` — A path parameter is not a valid ID; `fields` lists each one. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - BAD_REQUEST description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - IDENTITY description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. fields: type: array description: >- One entry per invalid request field (validation errors only). items: type: object properties: field: type: string description: >- Path of the invalid field, e.g. `label` or `values[0].value`. example: label message: type: string description: Why the field was rejected. example: label is required code: type: string description: >- `_` — e.g. `LABEL_REQUIRED`, `TYPE_ONE_OF`, `VALUES_VALUE_TYPE_ERROR`. example: LABEL_REQUIRED values: type: array items: type: string description: >- The accepted values, when the field is an enumeration. required: - field - message - code required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: BAD_REQUEST origin: IDENTITY message: >- Bad Request: Your request is invalid or incomplete. Please make sure you are requesting with the right fields. fields: - field: organizationId message: Invalid UUID code: ORGANIZATIONID_UUID ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.