unassignRole

Remove a role from a member (idempotent). Requires change-user-roles permission. Rejects taking the admin role from the organization's only active admin (LAST_ADMIN), including an admin removing their own.

Deliberately NOT gated on team_management, unlike its acquiring siblings createRole / updateRole / assignRole (#2412). Unassigning a role can only reduce someone's access, and the rule removeOrganizationUser states applies here too: gate acquiring a capability, never relinquishing what was already acquired. An org that lapsed to Free must still be able to take a role away.

Safe to leave ungated only because the destructive edge is guarded in the domain: role.Unassign refuses to leave the org without an active admin, and makes that check and the write inside the org's admin-set lock (shared with removeOrganizationUser and changeOrganizationUserRole), so two admins removing each other at the same moment cannot both succeed. Without the guard a Free org could unassign its last admin while assignRole, still paywalled, could never restore one. See TestUnassignRole_LastAdminGuardIsLoadBearingForUngating.

unassignRole(
  organizationId: String!
  userId: String!
  roleName: String!
): Boolean!

Arguments

unassignRole.organizationId ● String! non-null scalar

unassignRole.userId ● String! non-null scalar

unassignRole.roleName ● String! non-null scalar

Type

Boolean scalar

The Boolean scalar type represents true or false.