implements REST API DELETE to /api/rbac-grants/{grantedRoleUuid}/{granteeUserUuid}:

src/main/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantController.java

@@ -60,4 +60,22 @@ public class RbacGrantController implements RbacgrantsApi {
         return ResponseEntity.created(uri).build();
     }
 
+    @Override
+    @Transactional
+    public ResponseEntity<Void> revokeRoleFromUser(
+        final String currentUser,
+        final String assumedRoles,
+        final UUID grantedRoleUuid,
+        final UUID granteeUserUuid) {
+
+        context.setCurrentUser(currentUser);
+        if (assumedRoles != null && !assumedRoles.isBlank()) {
+            context.assumeRoles(assumedRoles);
+        }
+
+        rbacGrantRepository.deleteByRbacGrantId(new RbacGrantId(granteeUserUuid, grantedRoleUuid));
+
+        return ResponseEntity.noContent().build();
+    }
+
 }

src/main/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantEntity.java

@@ -53,6 +53,10 @@ public class RbacGrantEntity {
     @Enumerated(EnumType.STRING)
     private RbacRoleType grantedRoleType;
 
+    RbacGrantId getRbacGrantId() {
+        return new RbacGrantId(granteeUserUuid, grantedRoleUuid);
+    }
+
     public String toDisplay() {
         return "{ grant " + (assumed ? "assumed " : "") +
             "role " + grantedRoleIdName + " to user " + granteeUserName + " by role " + grantedByRoleIdName + " }";

src/main/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantId.java

@@ -1,5 +1,6 @@
 package net.hostsharing.hsadminng.rbac.rbacgrant;
 
+import lombok.AllArgsConstructor;
 import lombok.EqualsAndHashCode;
 import lombok.Getter;
 import lombok.NoArgsConstructor;
@@ -10,6 +11,7 @@ import java.util.UUID;
 @Getter
 @EqualsAndHashCode
 @NoArgsConstructor
+@AllArgsConstructor
 public class RbacGrantId implements Serializable {
 
     private UUID granteeUserUuid;

src/main/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantRepository.java

@@ -1,5 +1,7 @@
 package net.hostsharing.hsadminng.rbac.rbacgrant;
 
+import org.springframework.data.jpa.repository.Modifying;
+import org.springframework.data.jpa.repository.Query;
 import org.springframework.data.repository.Repository;
 
 import java.util.List;
@@ -10,5 +12,11 @@ public interface RbacGrantRepository extends Repository<RbacGrantEntity, RbacGra
 
     void save(final RbacGrantEntity grant);
 
-    void delete(final RbacGrantEntity grant);
+    @Modifying
+    @Query(value = """
+         delete from RbacGrantEntity as g
+             where g.grantedRoleUuid=:#{#rbacGrantId.grantedRoleUuid}
+               and g.granteeUserUuid=:#{#rbacGrantId.granteeUserUuid}
+        """)
+    void deleteByRbacGrantId(RbacGrantId rbacGrantId);
 }

src/main/resources/api-definition.yaml

@@ -22,6 +22,9 @@ paths:
     /api/rbac-grants:
         $ref: "./api-definition/rbac-grants.yaml"
 
+    /api/rbac-grants/{grantedRoleUuid}/{granteeUserUuid}:
+        $ref: "./api-definition/rbac-grants-id.yaml"
+
     # HS
 
     /api/customers:

src/main/resources/api-definition/rbac-grants-id.yaml

@@ -0,0 +1,30 @@
+delete:
+    tags:
+        - rbacgrants
+    operationId: revokeRoleFromUser
+    parameters:
+        - $ref: './api-definition/auth.yaml#/components/parameters/currentUser'
+        - $ref: './api-definition/auth.yaml#/components/parameters/assumedRoles'
+        - name: grantedRoleUuid
+          in: path
+          required: true
+          schema:
+              type: string
+              format: uuid
+          description: UUID of the granted role.
+        - name: granteeUserUuid
+          in: path
+          required: true
+          schema:
+              type: string
+              format: uuid
+          description: UUID of the user to whom the role was granted.
+    responses:
+        "204":
+            description: No Content
+        "401":
+            $ref: './api-definition/error-responses.yaml#/components/responses/Unauthorized'
+        "403":
+            $ref: './api-definition/error-responses.yaml#/components/responses/Forbidden'
+        "404":
+            $ref: './api-definition/error-responses.yaml#/components/responses/NotFound'

src/main/resources/api-definition/rbac-grants.yaml

@@ -31,6 +31,7 @@ post:
     responses:
         "201":
             description: OK
+            content:
         "401":
             $ref: './api-definition/error-responses.yaml#/components/responses/Unauthorized'
         "403":