Delete an Origin Repository Grant via the API

Remove the permission a user, group, or owning-team group holds directly on a repository with DELETE https://api.cursor.com/v1/origin/repos/{ownerSlug}/{repoName}/grants. Official reference: Origin API → Delete Repository Grant, and Origin Grants API.

Origin is in Early Beta and subject to change. Authenticate with an installation access token (oit_…) or a Cursor user access token that carries repository:settings:write. Availability: Early Beta per the API overview.

Permissions inherited from the repository's owner are unaffected, so an owning-team group falls back to its owner-level default. Removing a permission the principal does not hold directly succeeds without change. The response body is empty (204 No Content).

Cost: 5 points against the principal budget (ordinary write). Writes record the same repository.access_changed audit event as the Codebase permissions UI.

Path parameters

Param	Required	Meaning
ownerSlug	yes	Owning entity's unique slug
repoName	yes	Repo name, unique to the owner

Request body

Name exactly one principal:

Field	Required	Meaning
user	one of	User principal. Send id (prefixed user_).
group	one of	Cursor group. Send id (prefixed grp_).
teamGroup	one of	Built-in owning-team group. Send kind: members or admins.

curl --request DELETE \
  --url 'https://api.cursor.com/v1/origin/repos/OWNER_SLUG/REPO_NAME/grants' \
  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "group": {
    "id": "grp_01k2ja2000e0080000000000n2"
  }
}'

Response

Successful requests return 204 No Content with no body.

For interactive or scripted user calls, prefer origin api after origin auth login (or CURSOR_API_KEY). Do not put a Cursor API key directly in the Origin Authorization header.

Base URL: https://api.cursor.com/v1/origin.