Skip to content
AiKYNETIX

Revoke a person's access

POST
/api/clients/{id}/access/{access_id}/revoke/
curl --request POST \
  --url http://localhost:8000/api/clients/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/access/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/revoke/ \
  --header 'Authorization: Bearer <token>'

Ends a grant, invited or active; the link stops working and the person loses the card on their next request. The record stays, revoked. Revoking a revoked grant answers the same record.

A coach of the team, on a card of the active team. Every route answers 404 while client access is switched off on the environment. A partner API key and a client’s own account get 403. Open on every plan: a coach on a team whose plan no longer includes client access still sees who has it and can revoke it.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
access_id
required
string format: uuid
id
required
string format: uuid

Responses

Section titled “Responses”

200

Section titled “200”
Media typeapplication/json

One person with access to a card, as the coach sees it (ClientAccessRecord).

object
id
required
string format: uuid
email
required

The address the invite went to.

string format: email
display_name
required

The person’s name once they accepted; empty until then.

string
relation
required
string
Allowed values: athlete guardian
level
required
string
Allowed values: view contribute
status
required

invited · active · expired · revoked. expired is an invite whose 14-day link lapsed; the coach can resend it.

  • invited - Invited
  • active - Active
  • expired - Expired
  • revoked - Revoked
string
Allowed values: invited active expired revoked
language
required

The invite’s language. Later e-mails to this person use it too.

  • en - English
  • ru - Русский
  • es - Español
string
Allowed values: en ru es
invited_by_name
required

Who sent the invite, for the team’s coaches: the inviting coach’s name, else their e-mail address; once their account is gone, the name it left, else “A coach” in ?lang (English by default).

string
invited_at
required
string format: date-time
expires_at
required

When the invite link lapses — set only while the status is invited.

string format: date-time
nullable
accepted_at
required
string format: date-time
nullable
revoked_at
required
string format: date-time
nullable
last_sent_at
required

When the last invite or sign-in e-mail left; null when none ever did.

string format: date-time
nullable
email_sent
required

Whether the e-mail reached the person (false: the transport refused it — the grant stands, resend it). On an invite or resend answer: this call’s e-mail, null when the call sent nothing on purpose (a second resend within a minute). On every other answer: the latest attempt’s, null when none was ever made.

boolean
nullable

Examples

ExampleRevoked
{
  "id": "0b9e4d21-7a3c-4f6e-8d15-3c2a9b7e6f58",
  "email": "olga.lebedeva@example.com",
  "display_name": "Olga Lebedeva",
  "relation": "guardian",
  "level": "contribute",
  "status": "revoked",
  "language": "ru",
  "invited_by_name": "Kim Larsen",
  "invited_at": "2026-10-06T09:00:00Z",
  "expires_at": null,
  "accepted_at": "2026-10-07T18:20:00Z",
  "revoked_at": "2026-10-10T09:00:00Z",
  "last_sent_at": "2026-10-06T09:00:00Z",
  "email_sent": true
}

401

Section titled “401”
Media typeapplication/json
object
detail
required

Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).

string

Example generated

{
  "detail": "example"
}

403

Section titled “403”
Media typeapplication/json
object
detail
required

Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).

string

Examples

Example403—AClient'sOwnAccount

403 — a client's own account

The coach side is for a coach of the team; a client uses the portal.

{
  "detail": "client_account"
}

404

Section titled “404”
Media typeapplication/json
object
detail
required

Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).

string

Examples

Example404—NoSuchGrantOnTheCard

404 — no such grant on the card

{
  "detail": "access_not_found"
}