# revokeTeamMemberCapability

Turn ONE permission off for a teammate, the same switch and the same capabilities as grantTeamMemberCapability, which turns it back on. Their role does not change. An Admin holds every permission whatever is stored, so read getTeamMemberCapabilities first and never offer one for an Admin (their role changes first). Organization admins only; the person approves it on a card naming the teammate and the permission.

- Call: `POST https://server.goliathdata.com/api/v1/call` with `{ "operationId": "revokeTeamMemberCapability", "variables": {...} }`
- Scope: `ADMIN`
- Type: mutation
- Idempotency: honors `Idempotency-Key` (24 h)
- Rate-limited: no

## Variables

- `userId`: `ID!` (required)
- `capability`: `OrganizationCapability!` (required, one of `VIEW_ALL_CONTACTS`, `VIEW_ALL_PIPELINE_ITEMS`, `VIEW_ALL_DEALS`, `VIEW_ALL_PHONES`, `CONTRACTS_VIEW`, `CONTRACTS_MANAGE`, `CAN_SKIPTRACE`, `CAN_EXPORT`, `CAN_WORKFLOW`, `VIEW_TEAM_DIRECTORY`, `CAN_USE_AUTOMATIONS`, `CAN_USE_FILES`, `CAN_USE_MARKETPLACE`, `VIEW_ORGANIZATION_SETTINGS`, `CAN_USE_API_KEYS`, `CAN_USE_COMPUTER`, `CAN_MANAGE_SPENDING`, `VIEW_TEAM_CALENDARS`, `VIEW_TEAM_CALLS_TEXTS`)

## Response (data, an example)

```json
{
  "teamMutation": {
    "revokeTeamMemberCapability": {
      "id": "<ID>"
    }
  }
}
```

## Example

```bash
curl https://server.goliathdata.com/api/v1/call \
  -H "Authorization: Bearer $GOLIATH_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
    "operationId": "revokeTeamMemberCapability",
    "variables": {
      "userId": "<userId>",
      "capability": "VIEW_ALL_CONTACTS"
    }
  }'
```