oh revoke
Revoke privileges, roles, group / service-principal membership, and fine-grained data access.
Each subcommand mirrors its oh grant counterpart. The principal is chosen with one of --user EMAIL, --group NAME or --service-principal NAME.
oh revoke privilege NAME
Revokes one or more privileges on the object NAME, or on every child of a container.
Flags and semantics match oh grant privilege: exactly one of --on / --on-all, grade roles alone, and --in only with --on-all.
oh revoke privilege my-lake.events.clicks \
--privilege SELECT --on TABLE \
--user alice@example.com
oh revoke privilege my-lake.events \
--privilege SELECT --privilege INSERT \
--on-all tables --in database \
--group analytics
oh revoke role ROLE NAME
Revokes a role on the project NAME. The server removes the principal from the project whichever ROLE is given — account roles cannot be revoked through SQL.
| Flag | Required | Description |
|---|---|---|
--on | Yes | PROJECT |
--user / --group / --service-principal | Yes | Principal |
oh revoke role admin my-project --on PROJECT --user alice@example.com
oh revoke member NAME
Removes a principal from the group or service principal NAME. The server removes the membership whichever --role is given.
| Flag | Required | Description |
|---|---|---|
--on | Yes | GROUP or SERVICE_PRINCIPAL |
--role | No | member (default) or manager |
--user / --group / --service-principal | Yes | Principal to remove |
oh revoke member analytics --on GROUP --user alice@example.com
oh revoke row-filter [EXPRESSION]
Removes the row filter EXPRESSION on --table for the principal. Omit EXPRESSION to remove every row filter on --table.
| Flag | Required | Description |
|---|---|---|
--table | Yes | Fully-qualified table |
--user / --group / --service-principal | Yes | Principal |
# Remove one filter
oh revoke row-filter "region = 'EU'" \
--table my-lake.events.clicks \
--user alice@example.com
# Remove every filter on the table for the principal
oh revoke row-filter \
--table my-lake.events.clicks \
--user alice@example.com
oh revoke column-mask COLUMN
Removes the mask on COLUMN of --table for the principal.
| Flag | Required | Description |
|---|---|---|
--table | Yes | Fully-qualified table |
--user / --group / --service-principal | Yes | Principal |
oh revoke column-mask ssn \
--table my-lake.customers.profiles \
--user alice@example.com
oh revoke column-access
Removes the column-access restriction on --table for the principal.
| Flag | Required | Description |
|---|---|---|
--table | Yes | Fully-qualified table |
--user / --group / --service-principal | Yes | Principal |
oh revoke column-access \
--table my-lake.events.clicks \
--group analytics
oh revoke data-admin
Revokes DATA_ADMIN from the principal.
| Flag | Required | Description |
|---|---|---|
--user / --group / --service-principal | Yes | Principal |
oh revoke data-admin --user alice@example.com