---
title: "role unassign"
slug: "role-unassign"
updated: 2026-10-27T17:25:00Z
published: 2026-10-27T17:25:00Z
canonical: "docs.vastdata.com/role-unassign"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# role unassign

This command removes permissions from a role.

##### Usage

```plaintext
role unassign --id ID
             {--realm REALM| {--object-type OBJECT_TYPE --object-id OBJECT_ID}}
             [--permissions create|view|edit|delete]
             [--tenant-ids IDs]  
```

##### Required Parameters

| `--id` | Specifies the role. |
| --- | --- |

##### Options

| `--realm REALM` | Specify a realm of VMS objects. Possible values: - `events`. This realm includes alarms, events, event definitions and global event definition settings. - `hardware`. This realm includes the cluster object and all infrastructure components. - `logical`. This realm includes virtual IPs for network access, DNS service, Element Store views for protocol access, directory and user quotas, data protection features except for indestructibility, and S3 life cycle rules. - `monitoring`. This realm includes analytics reports, capacity usage estimations, data flow analytics. - `security`. This realm includes users and groups for data client access, authentication providers, VMS Role Based Access Control (RBAC), indestructibility for snapshots and protection policies, S3 identity policies, and VAST Data Support tunnels for remote support access. - `settings`. This realm includes VMS settings. - `support`. This realm includes Call Home configuration, support bundles, licenses, envs, and modules. |
| --- | --- |
| `--object-type OBJECT` | Use this parameter together with `--object-id` to specify an object. In this case, the command will remove permission to access a specific object. Examples of objects are: - `cluster` - `cnode` - `dnode` - `dbox` - `cbox` - `view` - `viewpolicy` - `quota` - `vippool` - `eventdefinition` - `ldap` For example, if you want to remove permission to access a given view, you would specify `--object-type view` and then provide the view's view ID as `--object-id`. |
| `--object-id OBJECT_ID` | Specify an object ID of the type specified by `--object-type`. For example: `--object-id 3` |
| `--permissions create\|view\|edit\|delete` | Include this parameter to specify a specific type of permission. Omit this parameter to remove all types. |
| `--tenant-ids IDs` | Determines the tenant(s) for the role. You can specify one tenant ID or a comma-separated list of tenant IDs. |

##### Example

The following example removes all permissions to the security realm on tenant 2:

```plaintext
vcli: admin> role unassign --id 2 --realm security --tenant-ids 2
```