> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Remove users and groups > Take users and groups out of a machine identity's delegation. Taking out the last one removes the delegation, and the sessions it started for them stop working. ## OpenAPI ````yaml DELETE /api/v1/agent-vault/delegations/{machineIdentityId}/subjects openapi: 3.0.3 info: title: Infisical API description: List of all available APIs that can be consumed version: 0.0.1 servers: - url: https://us.infisical.com description: Production server (US) - url: https://eu.infisical.com description: Production server (EU) - url: http://localhost:8080 description: Local server security: [] paths: /api/v1/agent-vault/delegations/{machineIdentityId}/subjects: delete: tags: - Agent Vault Delegations description: >- Take users and groups out of a machine identity's delegation. Taking out the last one removes the delegation, and the sessions it started for them stop working. operationId: removeAgentVaultDelegationSubjects parameters: - schema: type: string minLength: 1 maxLength: 36 in: query name: projectId required: false description: The ID of the Agent Vault project. - schema: type: string format: uuid in: path name: machineIdentityId required: true description: The ID of the machine identity the delegation belongs to. requestBody: required: true content: application/json: schema: type: object properties: userIds: type: array items: type: string format: uuid maxItems: 100 default: [] description: >- The users to take out of the delegation, up to 100. Users it doesn't name are skipped. example: - 3c90c3cc-0d44-4b50-8888-8dd25736052a groupIds: type: array items: type: string format: uuid maxItems: 100 default: [] description: >- The groups to take out of the delegation, up to 100. Groups it doesn't name are skipped. example: - 7b1e4f2a-9c3d-4a6b-8e5f-1d2c3b4a5e6f additionalProperties: false responses: '200': description: Default Response content: application/json: schema: type: object properties: delegation: type: object properties: machineIdentity: type: object properties: id: type: string format: uuid description: >- The ID of the machine identity the delegation belongs to. name: type: string description: The name of the machine identity. required: - id - name additionalProperties: false description: >- The machine identity that can start sessions on behalf of users. scope: type: string enum: - all-members - selected description: >- Which users the machine identity can start sessions on behalf of: every member of the project (all-members), or only the users and the members of the groups in the delegation (selected). example: selected users: type: array items: type: object properties: id: type: string format: uuid description: The ID of the user. username: type: string description: The username of the user. email: type: string nullable: true description: The email address of the user. firstName: type: string nullable: true description: The first name of the user. lastName: type: string nullable: true description: The last name of the user. addedAt: type: string format: date-time description: >- When the user or group was added to the delegation. missingAccessBundles: type: array items: type: object properties: id: type: string format: uuid description: The ID of the access bundle. name: type: string description: The name of the access bundle. required: - id - name additionalProperties: false description: >- The access bundles this user can use and the machine identity can't, so the machine identity can't start sessions over them on the user's behalf. For an Agent Vault admin, this is every access bundle the machine identity can't use. Always empty when the machine identity reads its own delegation, unless it's an Agent Vault admin. required: - id - username - email - firstName - lastName - addedAt - missingAccessBundles additionalProperties: false description: The users in the delegation. groups: type: array items: type: object properties: id: type: string format: uuid description: The ID of the group. name: type: string description: The name of the group. addedAt: type: string format: date-time description: >- When the user or group was added to the delegation. missingAccessBundles: type: array items: type: object properties: id: type: string format: uuid description: The ID of the access bundle. name: type: string description: The name of the access bundle. required: - id - name additionalProperties: false description: >- The access bundles granted to this group, or every bundle if the group has the Admin role, that the machine identity can't use. Always empty when the machine identity reads its own delegation, unless it's an Agent Vault admin. required: - id - name - addedAt - missingAccessBundles additionalProperties: false description: >- The groups in the delegation. Their members are covered while they stay in the group. createdAt: type: string format: date-time description: When the delegation was set up. updatedAt: type: string format: date-time description: When the delegation was last saved. missingAccessBundles: type: array items: type: object properties: id: type: string format: uuid description: The ID of the access bundle. name: type: string description: The name of the access bundle. required: - id - name additionalProperties: false description: >- The access bundles that users the delegation covers can use and the machine identity can't. A session on behalf of a user can use only an access bundle that both can use, so the machine identity can't start sessions over these. With all-members, this is every access bundle the machine identity can't use, since Agent Vault admins can use every bundle. Always empty when the machine identity reads its own delegation, unless it's an Agent Vault admin. required: - machineIdentity - scope - users - groups - createdAt - updatedAt - missingAccessBundles additionalProperties: false nullable: true description: >- The delegation after the change, or null if it no longer names anyone. A delegation that names no one is removed. required: - delegation additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.