---
title: "REVOKE PERMISSION"
url: "https://docs.yugabyte.com/stable/api/ycql/ddl_revoke_permission/"
---

# REVOKE PERMISSION

Use the REVOKE PERMISSION statement to revoke a permission (or all the granted permissions) from a role.

## Synopsis

Use the `REVOKE PERMISSION` statement to revoke a permission (or all the granted permissions) from a role.

When a database object is deleted (keyspace, table, or role), all the permissions on that object are automatically deleted.

This statement is enabled by setting the YB-TServer flag [--use\_cassandra\_authentication](/stable/reference/configuration/yb-tserver/#ycql "--use_cassandra_authentication") to `true`.

## Syntax

### Diagram

#### revoke\_permission

REVOKE[all\_permissions](/stable/api/ycql/grammar_diagrams#all-permissions)[permission](/stable/api/ycql/grammar_diagrams#permission)ON[resource](/stable/api/ycql/grammar_diagrams#resource)FROM[role\_name](/stable/api/ycql/grammar_diagrams#role-name)

#### all\_permissions

ALLPERMISSIONS

#### permission

CREATEALTERDROPSELECTMODIFYAUTHORIZEDESCRIBEEXECUTEPERMISSION

#### resource

ALLKEYSPACESROLESKEYSPACE[keyspace\_name](/stable/api/ycql/grammar_diagrams#keyspace-name)TABLE[table\_name](/stable/api/ycql/grammar_diagrams#table-name)ROLE[role\_name](/stable/api/ycql/grammar_diagrams#role-name)

### Grammar

```ebnf
revoke_permission := REVOKE all_permission | permission ON resource FROM role_name;
all_permissions := ALL [ PERMISSIONS ]
permission :=  ( CREATE | ALTER | DROP | SELECT | MODIFY | AUTHORIZE | DESCRIBE | EXECUTE ) [ PERMISSION ]
resource := ALL ( KEYSPACES | ROLES ) | KEYSPACE keyspace_name | [ TABLE ] table_name | ROLE role_name;
```

Where

- `keyspace_name`, `table_name`, and `role_name` are text identifiers (`table_name` may be qualified with a keyspace name).

## Semantics

Permission `AUTHORIZE` on `ALL ROLES` or on the role being used in the statement is necessary. Otherwise, an unauthorized error will be returned.

## Examples

```sql
ycqlsh:example> REVOKE CREATE ON KEYSPACE qa FROM fred;
```

## See also

- [ALTER ROLE](/stable/api/ycql/ddl_alter_role "ALTER ROLE")
- [DROP ROLE](/stable/api/ycql/ddl_drop_role "DROP ROLE")
- [CREATE ROLE](/stable/api/ycql/ddl_create_role "CREATE ROLE")
- [GRANT ROLE](/stable/api/ycql/ddl_grant_role "GRANT ROLE")
- [REVOKE ROLE](/stable/api/ycql/ddl_revoke_role "REVOKE ROLE")
- [GRANT PERMISSION](/stable/api/ycql/ddl_grant_permission "GRANT PERMISSION")