Revoke a privilege from a role
Removes one privilege (an area privilege for an event-type group) from a role.
Switches off one cell of a role's privilege matrix — the same change as unticking a privilege checkbox for a role in TimeLog's settings. Pages connected to the event-type group are removed from the role unless another of the role's groups still needs them. The call ALWAYS answers 200 null when it does not crash: if a TimeLog rule blocks the removal (last role that can edit all employees, hourly-rate privilege dependencies), nothing is deleted and the response is still 200. REST v1 cannot read a role's privileges, so the result cannot be verified through the API.
Use it to:
- Withdraw a privilege from a role on many accounts at once
Not for:
- Deleting a role — not possible in REST v1
- Removing a role from a user — not possible in REST v1
Rules across fields:
- R1: All three query parameters must be present; if any is missing the request matches no action and gets 405 UnsupportedApiVersion.
Behaviour:
- Idempotent.
- Safe to retry.
- Duplicates: Deleting a mapping that does not exist still runs the side effects and returns 200.
- Side effect: Recomputes the time-tracking search rows of the role's users when the privilege is 'projects available for employee department / resource group'.
- Side effect: Removes the group's connected pages from the role, unless another group of the same area still needs them.
Call first: GET /v1/role
See also: POST /v1/role
Not yet documented: errors; examples (success).
curl -X DELETE "https://app3.timelog.com/your-account/api/v1/role?roleId=123&areaPrivilegeGUID=123e4567-e89b-12d3-a456-426614174000&eventTypeGroupGUID=123e4567-e89b-12d3-a456-426614174000" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_API_TOKEN"
import requests
import json
url = "https://app3.timelog.com/your-account/api/v1/role?roleId=123&areaPrivilegeGUID=123e4567-e89b-12d3-a456-426614174000&eventTypeGroupGUID=123e4567-e89b-12d3-a456-426614174000"
headers = {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
response = requests.delete(url, headers=headers)
print(response.json())
const response = await fetch("https://app3.timelog.com/your-account/api/v1/role?roleId=123&areaPrivilegeGUID=123e4567-e89b-12d3-a456-426614174000&eventTypeGroupGUID=123e4567-e89b-12d3-a456-426614174000", {
method: "DELETE",
headers: {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
});
const data = await response.json();
console.log(data);
package main
import (
"fmt"
"net/http"
)
func main() {
req, err := http.NewRequest("DELETE", "https://app3.timelog.com/your-account/api/v1/role?roleId=123&areaPrivilegeGUID=123e4567-e89b-12d3-a456-426614174000&eventTypeGroupGUID=123e4567-e89b-12d3-a456-426614174000", nil)
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
fmt.Println("Response Status:", resp.Status)
}
require 'net/http'
require 'json'
uri = URI('https://app3.timelog.com/your-account/api/v1/role?roleId=123&areaPrivilegeGUID=123e4567-e89b-12d3-a456-426614174000&eventTypeGroupGUID=123e4567-e89b-12d3-a456-426614174000')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Delete.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
response = http.request(request)
puts response.body
"null"
{
"error": "Unauthorized",
"message": "Authentication required. Please provide a valid API token",
"code": 401
}
{
"code": "UnsupportedApiVersion",
"error": "No route providing a controller name with API version '1' was found to match HTTP method 'DELETE' and request URI 'https://app{server-number}.timelog.com/{account}/api/v1/role'.",
"traceId": "2d95ac09-c879-4c76-bb76-fe90a991d13f",
"type": "https://docs.api-versioning.org/problems#unsupported",
"title": "Unsupported API version",
"status": 405,
"detail": "The requested resource with API version '1' does not support HTTP method 'DELETE'."
}
{
"error": "Internal Server Error",
"message": "An unexpected error occurred on the server",
"code": 500,
"requestId": "req_1234567890"
}
/v1/role
Target server for requests. Edit to use your own host.
OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp).
The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user.
> Not yet documented: how to obtain a token.
> Not yet documented: token lifetime.
Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp).
The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user.
> Not yet documented: how to obtain a token.
> Not yet documented: token lifetime.The role to change. Query-string parameter (name matched case-insensitively).
Area privilege to remove.
Event-type group to remove. All rows of the role / area privilege for the group's event types are deleted (including duplicates left by POST).
Request Preview
Response
Response will appear here after sending the request
Authentication
Bearer token. OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp).
The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user.
Not yet documented: how to obtain a token.
Not yet documented: token lifetime.
Query Parameters
The role to change. Query-string parameter (name matched case-insensitively).
Area privilege to remove.
Event-type group to remove. All rows of the role / area privilege for the group's event types are deleted (including duplicates left by POST).
Responses
Success without content: HTTP 200 with the literal JSON body null. Literal JSON null — returned both when the rows were deleted and when a business rule blocked the delete.