Source: https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/revoke-privilege/
Documentation version: v5.3.2

# REVOKE

`REVOKE` removes privileges granted to a user or role in the current service group.

## Prerequisites

First [connect to the Graph service](https://dev-docs.nebula-graph.io/v5.3.2/get-started/first-query/#connect). Run the command in a GQL client.

To revoke privileges from a user or role, you must be the owner of the involved resource objects or the user with the role `ADMIN` in the service group.

## Limitations

- The role that you want to revoke privileges from must not be the role `ADMIN`.
- The resource object on which you want to revoke privileges must not be a temporary graph.
- `USAGE` on `/default_schema` cannot be revoked.
- A schema owner cannot revoke their own implicit `USAGE` on the schema.

`REVOKE` removes only the privilege records on the user or role specified in the command. The user might still be able to perform the operation if another role, a direct grant, ownership, or a privilege on a parent resource provides the same privilege.

A user with `ADMIN` always has every privilege in the current service group. Revoking an ordinary direct privilege from that user does not reduce the user's effective access.

## Syntax

Syntax diagramBNF

 revoke_privileges_command  

````
revoke_privileges_command ::=
    'REVOKE' action (',' action )* ('ON' resource_object_type resource_object_reference (',' resource_object_reference)* )? 'FROM' ( ('USER' user_name) | ( 'ROLE' role_name) )

````

## Parameters

### `action`

The action to grant or revoke. For the actions supported by each resource type, see [Grantable actions](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/privilege-reference/#grantable_actions).

If the action is on a service group or catalog, you do not need to specify `resource_object_type` or `resource_object_reference`.

### `resource_object_type`

The type of resource object whose privileges you want to revoke. Valid values include `SCHEMA`, `GRAPH TYPE`, `GRAPH`, `NODE TYPE`, `EDGE TYPE`, `NODE PROPERTY`, `EDGE PROPERTY`, and `PROCEDURE`. For the resource types supported by each action, see [Privilege reference](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/privilege-reference/).

For more information, see [Resource objects](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/privilege-reference/#resource_objects).

### `resource_object_reference`

A reference identifies the target resource. Use a name in the current schema or a reference that includes the schema path:

 | Resource type | Reference in the current schema | Reference with a schema path
 | `SCHEMA` | `schema_reference` | `schema_reference`
 | `GRAPH TYPE` and `GRAPH` | `graph_type_name`
`graph_name` | `schema_reference/graph_type_name`
`schema_reference/graph_name`
 | `PROCEDURE` | `procedure_name(parameter_type, ...)` | ``schema_reference/procedure_name`(parameter_type, ...)`
 | `NODE TYPE` and `EDGE TYPE` | `graph_name.node_type_name`
`graph_name.edge_type_name` | `schema_reference/graph_name.node_type_name`
`schema_reference/graph_name.edge_type_name`
 | `NODE PROPERTY` and `EDGE PROPERTY` | `graph_name.node_type_name.node_property_name`
`graph_name.edge_type_name.edge_property_name` | `schema_reference/graph_name.node_type_name.node_property_name`
`schema_reference/graph_name.edge_type_name.edge_property_name`

If multiple UDP signatures have the same name, specify the parameter types. For example:

````
REVOKE EXECUTE ON PROCEDURE `/default_schema/ufoo`(INT) FROM ROLE role1

````

- Always use `schema_reference` for a `SCHEMA` object.
- For other objects, omit the schema path only when the object is in the current schema. Include `schema_reference` for objects in another schema. To set or view the current schema, see [SESSION SET SCHEMA](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/sessions/set/) and [SHOW CURRENT_SCHEMA](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-current-schema/).
- `schema_reference` can be the absolute or relative path of the schema. For more information, see [CREATE SCHEMA](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/ddl/schema/create/#schema_reference).

### `user_name`

The username whose privileges are revoked.

### `role_name`

The role whose privileges are revoked.

## Examples

- Role `role1` must exist and user `user1` must have joined the service group. See [CREATE ROLE](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/create-role/) to create a role.
- Current-schema examples use `movie` from the [example dataset](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/overview/example-dataset/). Select the schema where it was loaded first.
- Before using `/my_schema` examples, prepare the corresponding objects there or replace the paths with existing object paths.

### Revoke access to a schema

Revoke `USAGE` from a user:

````
REVOKE USAGE ON SCHEMA /my_schema FROM USER user1

````

Alternatively, revoke it from a role:

````
REVOKE USAGE ON SCHEMA /my_schema FROM ROLE role1

````

Revoking `USAGE` prevents the affected user from accessing the schema but does not remove privileges or ownership on objects in the schema. If `USAGE` is granted again, unchanged object privileges become usable again. For more information, see [Schema access control](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/schema-access-control/).

### Revoke query access to a graph in the current schema

````
REVOKE MATCH ON GRAPH movie FROM ROLE role1

````

### Revoke query access to a graph in another schema

````
REVOKE MATCH ON GRAPH /my_schema/movie FROM ROLE role1

````

### Revoke insert and query access to a node type

````
REVOKE MATCH, INSERT ON NODE TYPE movie.Actor FROM ROLE role1

````

### Revoke query access to a node property

````
REVOKE MATCH ON NODE PROPERTY movie.Actor.name FROM ROLE role1

````