Deregistering a Delegated Administrator

Function

This API is used to remove the specified member account as the delegated administrator for the specified service. It can be called only from the organization's management account.

Debugging

You can debug this API through automatic authentication in API Explorer or use the SDK sample code generated by API Explorer.

Authorization Information

Each account has all the permissions required to call all APIs, but IAM users must be assigned the required permissions.

If you are using role/policy-based authorization, see Permissions Policies and Supported Actions for details on the required permissions.

If you are using identity policy-based authorization, the following identity policy-based permissions are required.

Action	Access Level	Resource Type (*: required)	Condition Key	Alias	Dependencies
organizations:delegatedAdministrators:deregister	Write	account *	g:ResourceTag/<tag-key>	-	-
organizations:delegatedAdministrators:deregister	Write	-	organizations:ServicePrincipal	-	-

URI

POST /v1/organizations/delegated-administrators/deregister

Request Parameters

**Table 1** Request header parameters
Parameter	Mandatory	Type	Description
X-Security-Token	No	String	Security token (session token) of your temporary security credentials. If a temporary security credential is used, this header is required.

**Table 2** Request body parameters
Parameter	Mandatory	Type	Description
service_principal	Yes	String	Name of the service principal.
account_id	Yes	String	Unique ID of an account.

Response Parameters

Status code: 200

Successful.

None

Example Requests

Deregistering a delegated administrator

POST https://{endpoint}/v1/organizations/delegated-administrators/deregister

{
  "service_principal" : "string",
  "account_id" : "_Auft226uZhGFRo5R8unWGQZ5N48PgFrfwyc"
}