POST

Permissions.Remove

Remove custom permissions from a team member. Only the owner or a manager can call this method. It clears permission JSON, folder visibility, folder permissions, and manager flag.

Permissions

On a company subdomain (e.g. https://{user_domain}.bull36.com) the user must match that Host — Login and protected APIs reject another company with success=0, error user_not_in_company. On a main brand host (bull36.com, biz1.co.il, mastrocrm.com, …) the company domain gate is skipped.
Only the organization owner or a manager can call this route.

Action

Removes the requested Permissions record when the user has permission.

Push Service

Pushes event permissions.remove.deleted to users who should see this change.

Automation

No automation is run for this function.

Special Instructions

Send the bearer token on protected calls with Authorization: Bearer YOUR TOKEN.
On a company subdomain (e.g. https://{user_domain}.bull36.com) the user must match that Host — Login and protected APIs reject another company with success=0, error user_not_in_company. On a main brand host (bull36.com, biz1.co.il, mastrocrm.com, …) the company domain gate is skipped.
Send parameters as POST body fields exactly as documented.

Required Parameters

Name	Type	Sample	Explanation
`team_member_id` post	int	`321`	Team member id. Aliases: member_id, user_id, id.

Optional Parameters

No optional body parameters are defined for this function.

Authentication

Send the bearer token returned by Login in the request header. The user must be from the same company domain as this Host — a token from another company is rejected (user_not_in_company).

Authorization: Bearer YOUR TOKEN

Sample Request

{
    "url": "\/app\/Permissions.Remove",
    "method": "POST",
    "headers": {
        "Authorization": "Bearer YOUR TOKEN"
    },
    "body": {
        "team_member_id": "321"
    },
    "url_user": "https:\/\/{user}.bull36.com\/app\/Permissions.Remove",
    "url_domain": "https:\/\/{domain}\/app\/Permissions.Remove"
}

Endpoint

POST /app/Permissions.Remove
POST https://{user}.bull36.com/app/Permissions.Remove
POST https://{domain}/app/Permissions.Remove

Sample Output

{
    "success": 1,
    "message": "Permissions removed",
    "team_member_id": "321",
    "socket_event": "permissions.remove.deleted",
    "automation_event": null
}

JavaScript Example

const token = 'YOUR TOKEN';
const body = new URLSearchParams({ team_member_id: '321' });

const res = await fetch('/app/Permissions.Remove', { method: 'POST', headers: { Authorization: `Bearer ${token}` }, body });
const data = await res.json();
console.log(data);

Error Example

{
    "success": "0",
    "error": "permission_denied",
    "message": "Permission denied to manage this resource"
}