Skip to content
FractalOps

Offboard Principal Lifecycle

POST
/v1/admin/principal-assignments/lifecycle/offboard
curl --request POST \
  --url https://example.com/v1/admin/principal-assignments/lifecycle/offboard \
  --header 'Content-Type: application/json' \
  --data '{ "tenant_id": "default", "proposal_id": "example", "subject_key": "example", "email": "", "entra_object_id": "", "cleanup_after_days": 30, "dry_run": false }'

Immediate employee offboarding (ADR-0009 Phase 1). Resolves the principal’s STABLE ids from Keycloak (the identity broker — never a display name), revokes ALL group assignments (soft, no hard delete), and enqueues the connector removals keyed by the Entra object id. The T+30d cleanup is scheduled via the returned cleanup_due_at.

Parameters

Section titled “Parameters”

Header Parameters

Section titled “Header Parameters”
x-pomerium-jwt-assertion
Any of:
string

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
PrincipalOffboardIn
object
tenant_id
Tenant Id
string
default: default
proposal_id
required
Proposal Id
string
>= 1 characters
subject_key
required
Subject Key
string
email
Email
string
""
entra_object_id
Entra Object Id
string
""
cleanup_after_days
Cleanup After Days
integer
default: 30
dry_run
Dry Run
boolean

Responses

Section titled “Responses”

200

Section titled “200”

Successful Response

Media typeapplication/json
PrincipalOffboardOut
object
subject_key
Subject Key
string
""
entra_object_id
Entra Object Id
string
""
github_user_id
Github User Id
string
""
keycloak_resolved
Keycloak Resolved
boolean
revoked_count
Revoked Count
integer
0
revoked_paths
Revoked Paths
Array<string>
cleanup_due_at
Cleanup Due At
string
""
offboarding_state
Offboarding State
string
""
dry_run
Dry Run
boolean
Example
{
  "subject_key": "",
  "entra_object_id": "",
  "github_user_id": "",
  "keycloak_resolved": false,
  "revoked_count": 0,
  "cleanup_due_at": "",
  "offboarding_state": "",
  "dry_run": false
}

422

Section titled “422”

Validation Error

Media typeapplication/json
HTTPValidationError
object
detail
Detail
Array<object>
ValidationError
object
loc
required
Location
Array
msg
required
Message
string
type
required
Error Type
string
input
Input
ctx
Context
object
Examplegenerated
{
  "detail": [
    {
      "loc": [
        "example"
      ],
      "msg": "example",
      "type": "example",
      "input": "example",
      "ctx": {}
    }
  ]
}