> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL.
>
> Documentation indexes by section:
> - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt
> - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt
> - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt
> - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt
>
> Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth
> Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks
>
> OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json
> MCP server: https://docusign.docs.buildwithfern.com/_mcp/server

# How to delete user product permission profiles using an email address

This topic demonstrates how to list and delete Docusign Admin user product permission profiles.

> **Warning**
>
> * This endpoint can only be used by organizations that have purchased Docusign plans for both CLM and eSignature.
> * If the eSignature permission profile of the last eSignature admin user is deleted, admin access will be removed from that account. Similarly, if the CLM permission profile of the last CLM admin user is deleted, CLM access will be removed from the account.
> * If the eSignature permission profile of a user is deleted, the user will be deleted from the account.
> * The user’s eSignature permission profile cannot be deleted if the user has a CLM permission profile. First delete the user’s CLM permission profile, then delete the user’s eSignature permission profile.

> **Note**
>
> Run this code example from our [Quickstart](/docs/esign-rest-api/quickstart) or launcher projects: [Bash](https://github.com/docusign/code-examples-bash), [C#](https://github.com/docusign/code-examples-csharp), [Java](https://github.com/docusign/code-examples-java), [Node.js](https://github.com/docusign/code-examples-node), [PHP](https://github.com/docusign/code-examples-php), [PowerShell](https://github.com/docusign/code-examples-powershell), [Python](https://github.com/docusign/code-examples-python), or [Ruby](https://github.com/docusign/code-examples-ruby).

## Required data

Running the code in this how-to requires this data:

| Data element       | Description                                                                                                                                                                                                                                                                                                        |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| \{API_ACCOUNT_ID}  | A [GUID](http://guid.one/) value that identifies your account. This value is automatically generated by Docusign for any account you create. Copy the value from the **API Account ID** field on the [Apps and Keys](https://admindemo.docusign.com/authenticate?goTo=appsAndKeys) page.                           |
| \{BASE_PATH}       | A string value that forms the root of the URL required to make API calls. The base path value in the example code is set to target the developer environment at https\://\<domain>/management Where \<domain> is api-d.docusign.net for the developer environment and api.docusign.net for production.             |
| \{EMAIL_ADDRESS}   | An email address for a user in the given organization.                                                                                                                                                                                                                                                             |
| \{ORGANIZATION_ID} | A [GUID](http://guid.one/) value that identifies the the organization that contains the account to which the user will be added. Copy the value from the **Organization ID** field in the **Organization** section of the [Account Profile](https://admindemo.docusign.com/authenticate?goTo=accountProfile) page. |
| \{PRODUCT_ID}      | A string value that identifies the product associated with your permission profile. This value should should be either:- 37f013eb-7012-4588-8028-357b39fdbd00 for the CLM product, or
- f6406c68-225c-4e9b-9894-64152a26fa83 for the eSignature product.                                                           |

## Step 1. Obtain your OAuth token

To make the API calls shown in this how-to, you need a valid OAuth access token. Docusign supports access tokens for three different recommended OAuth grant types: Public Authorization Code Grant, Confidential Authorization Code Grant, and JSON Web Token (JWT) Grant. Choose the OAuth grant type appropriate for your scenario.

Docusign Admin OAuth access tokens are the same ones used for our [eSignature REST API](/docs/esign-rest-api/esign101/auth), although you must request one or more Docusign Admin scopes to call the Docusign Admin API. The endpoint calls made in this how-to require that you request the Docusign Admin-specific `user_write` scope when obtaining your access token.

> **Note**
>
> See [Docusign Admin Authentication](/docs/admin-api/admin101/auth) for details and the full list of Docusign Admin scopes.

![Three icons that represent the three methods a user can use to obtain an OAuth token: JSON Web Token (JWT), Public Authorization Code Grant (ACG), and Confidential Authorization Code grant](/_fern-files/_img/64f473773042ee439449a096bf7673292b1585b86a4ccc55f82ba0dda41f61a1.webp)

## Step 2. Construct your API headers

After you have a valid OAuth access token, you are ready to construct the API headers that you will pass to the API call. Construct your headers like this, but make sure to substitute your valid OAuth access token for \{ACCESS_TOKEN}.

**`Bash`**

```bash title="Bash"
declare -a Headers=('--header' "Authorization: Bearer ${ACCESS_TOKEN}"
    '--header' "Accept: application/json"
    '--header' "Content-Type: application/json")
```

**`C#`**

```csharp title="C#"
var apiClient = new DocuSignClient(basePath);
apiClient.Configuration.DefaultHeader.Add("Authorization", "Bearer " + accessToken);
```

**`Java`**

```java title="Java"
ApiClient apiClient = new ApiClient(basePath);
apiClient.addDefaultHeader(
        HttpHeaders.AUTHORIZATION,
        BEARER_AUTHENTICATION + accessToken);
```

**`Node.js`**

```javascript title="Node.js"
const dsApiClient = new docusignAdmin.ApiClient();
dsApiClient.setBasePath(args.basePath);
dsApiClient.addDefaultHeader('Authorization', 'Bearer ' + args.accessToken);
```

**`PHP`**

```php title="PHP"
$config = new Configuration();
$config->setAccessToken($accessToken);
$config->setHost('https://api-d.docusign.net/management');
$config->addDefaultHeader('Authorization', 'Bearer ' . $accessToken);
$this->apiClient = new ApiClient($config);
```

**`PowerShell`**

```text title="PowerShell"
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.add("Authorization", "Bearer $accessToken")
$headers.add("Accept", "application/json")
$headers.add("Content-Type", "application/json")
```

**`Python`**

```python title="Python"
api_client = ApiClient(host=DS_CONFIG["admin_api_client_host"])
api_client.set_default_header(
    header_name="Authorization",
    header_value=f"Bearer {access_token}"
)
```

**`Ruby`**

```ruby title="Ruby"
configuration = DocuSign_Admin::Configuration.new
configuration.host = Rails.configuration.admin_host

api_client = DocuSign_Admin::ApiClient.new(configuration)
api_client.set_default_header('Authorization', "Bearer #{args[:access_token]}")
```

## Step 3. Retrieve user product permission profiles

Make a GET request to the [MultiProductUserManagement:getUserProductPermissionProfilesByEmail](/docs/admin-api/reference/usermanagement/multiproductusermanagement/getuserproductpermissionprofilesbyemail) endpoint to retrieve the product permission profiles associated with a user email address.

Here’s how you make the call, but make sure to substitute your organization ID for \{ORGANIZATION_ID}, your API account ID for \{API_ACCOUNT_ID}, and the desired email address for \{EMAIL_ADDRESS}.

**`Bash`**

```bash title="Bash"
curl --request GET ${base_path}/v2.1/organizations/${ORGANIZATION_ID}/accounts/${API_ACCOUNT_ID}/products/permission_profiles/users?email=${EMAIL_ADDRESS} \
    "${Headers[@]}" \
    --output ${response}
```

**`C#`**

```csharp title="C#"
var productPermissionProfileApi = new ProductPermissionProfilesApi(apiClient);

var getUserProductPermission = new ProductPermissionProfilesApi.GetUserProductPermissionProfilesByEmailOptions
{
    email = emailAddress,
};

var response = productPermissionProfileApi.GetUserProductPermissionProfilesByEmailWithHttpInfo(orgId, accountId, getUserProductPermission);
response.Headers.TryGetValue("X-RateLimit-Remaining", out string remaining);
response.Headers.TryGetValue("X-RateLimit-Reset", out string reset);

if (reset != null && remaining != null)
{
    DateTime resetDate = DateTimeOffset.FromUnixTimeSeconds(long.Parse(reset)).UtcDateTime;
    Console.WriteLine("API calls remaining: " + remaining);
    Console.WriteLine("Next Reset: " + resetDate);
}

return response.Data;
```

**`Java`**

```java title="Java"
ProductPermissionProfilesApi productPermissionProfilesApi = this.createProductPermissionProfilesApi(
        user.getAccessToken(),
        session.getBasePath()
);
ProductPermissionProfilesApi.GetUserProductPermissionProfilesByEmailOptions userProductPermissionProfilesByEmailOptions =
        productPermissionProfilesApi.new GetUserProductPermissionProfilesByEmailOptions();
userProductPermissionProfilesByEmailOptions.setEmail(emailAddress);
UserProductPermissionProfilesResponse userProductPermissionProfilesByEmail = productPermissionProfilesApi
        .getUserProductPermissionProfilesByEmail(organizationId, existingAccountId, userProductPermissionProfilesByEmailOptions);
```

**`Node.js`**

```javascript title="Node.js"
const productPermissionProfilesApi = new docusignAdmin.ProductPermissionProfilesApi(dsApiClient);
const getUserProductPermission = {
  email: args.email
};

const permissionProfiles = await productPermissionProfilesApi.getUserProductPermissionProfilesByEmail(args.organizationId, args.accountId, getUserProductPermission, (error, data, response) => {
    const headers = response?.headers;

    const remaining = headers?.['x-ratelimit-remaining'];
    const reset = headers?.['x-ratelimit-reset'];

    if (remaining && reset) {
      const resetInstant = new Date(Number(reset) * 1000);

      console.log(`API calls remaining: ${remaining}`);
      console.log(`Next Reset: ${resetInstant.toISOString()}`);
    }
});
return permissionProfiles.data['product_permission_profiles'];
```

**`PHP`**

```php title="PHP"
$permissionProfilesApi = $this->clientService->permProfilesApi();

$getUserProductPermissionProfilesByEmailOptions = new GetUserProductPermissionProfilesByEmailOptions();
$getUserProductPermissionProfilesByEmailOptions->setEmail($_SESSION['email_address']);

$userProductPermissionProfilesResponse = $permissionProfilesApi->
    getUserProductPermissionProfilesByEmailWithHttpInfo(
        $this->orgId,
        $this->args["account_id"],
        $getUserProductPermissionProfilesByEmailOptions
    );

$remaining = $userProductPermissionProfilesResponse[2]['X-RateLimit-Remaining'] ?? null;
$reset =  $userProductPermissionProfilesResponse[2]['X-RateLimit-Reset'] ?? null;

if ($remaining !== null && $reset !== null) {
    $resetInstant = (new DateTime())->setTimestamp((int)$reset);
    error_log("API calls remaining: $remaining");
    error_log("Next Reset: " . $resetInstant->format(\DateTime::ATOM));
}
```

**`PowerShell`**

```text title="PowerShell"
$uri = "${base_path}/v2.1/organizations/${organizationId}/accounts/${APIAccountId}/products/permission_profiles/users?email=${emailAddress}"
$response = Invoke-WebRequest -uri $uri -UseBasicParsing -headers $headers -method GET
$productProfiles = $($response.Content | ConvertFrom-Json).product_permission_profiles
```

**`Python`**

```python title="Python"
product_permission_profiles_api = ProductPermissionProfilesApi(api_client=api_client)
(profiles, status, headers) = product_permission_profiles_api.get_user_product_permission_profiles_by_email_with_http_info(
    organization_id=get_organization_id(),
    account_id=session["ds_account_id"],
    email=session["clm_email"]
)

remaining = headers.get("X-RateLimit-Remaining")
reset = headers.get("X-RateLimit-Reset")

if remaining is not None and reset is not None:
    reset_date = dt.fromtimestamp(int(reset), tz=timezone.utc)
    print(f"API calls remaining: {remaining}")
    print(f"Next Reset: {reset_date}")

profiles_list = profiles.to_dict()["product_permission_profiles"]
```

**`Ruby`**

```ruby title="Ruby"
product_permission_profiles_api = DocuSign_Admin::ProductPermissionProfilesApi.new(api_client)

options = DocuSign_Admin::GetUserProductPermissionProfilesByEmailOptions.new
options.email = args[:email]

product_permission_profiles, _status, headers = product_permission_profiles_api.get_user_product_permission_profiles_by_email_with_http_info(args[:organization_id], args[:account_id], options)

remaining = headers['X-RateLimit-Remaining']
reset = headers['X-RateLimit-Reset']

if remaining && reset
  reset_date = Time.at(reset.to_i).utc
  puts "API calls remaining: #{remaining}"
  puts "Next Reset: #{reset_date}"
end

product_permission_profiles.as_json['product_permission_profiles']
```

## Step 4. Create the request body

To delete a user product permission profile, construct your request body as shown.

Make sure to substitute the desired email address for \{EMAIL_ADDRESS} and the product ID associated with the permission profile you wish to delete for \{PRODUCT_ID}. These values can be taken from the response of the previous step.

**`Bash`**

```bash title="Bash"
printf \
'{
  "user_email": "'${EMAIL_ADDRESS}'",
  "product_ids": [
    "'${PRODUCT_ID}'",
  ]
}
' >>$request_data
```

**`C#`**

```csharp title="C#"
var userProductProfileDeleteRequest = new UserProductProfileDeleteRequest
{
    ProductIds = new List<Guid?>
    {
        productId,
    },
    UserEmail = emailAddress,
};
```

**`Java`**

```java title="Java"
var userProductProfileDeleteRequest = new UserProductProfileDeleteRequest();
userProductProfileDeleteRequest.setProductIds(Collections.singletonList(productId));
userProductProfileDeleteRequest.setUserEmail(emailAddress);
```

**`Node.js`**

```javascript title="Node.js"
const userProductProfileDeleteRequest = {
  user_email: args.email,
  product_ids: [ args.productId ]
};
```

**`PHP`**

```php title="PHP"
$userProductProfileDeleteRequest = new UserProductProfileDeleteRequest([
    'user_email' => $emailAddress,
    'product_ids' => [$productId],
]);
```

**`PowerShell`**

```text title="PowerShell"
$body = @"
{
    "user_email": "$emailAddress",
    "product_ids": [
      "$productId",
    ]
}
"@
```

**`Python`**

```python title="Python"
user_product_profile_delete_request = UserProductProfileDeleteRequest(
    user_email=email,
    product_ids=[product_id]
)
```

**`Ruby`**

```ruby title="Ruby"
user_product_profile_delete_request = DocuSign_Admin::UserProductProfileDeleteRequest.new({ 'user_email' => args[:email], 'product_ids' => [args[:product_id]] })
```

## Step 5. Call the Docusign Admin API

Now that you have constructed your request body, make a DELETE request to the [MultiProductUserManagement:removeUserProductPermission](/docs/admin-api/reference/usermanagement/multiproductusermanagement/removeuserproductpermission) endpoint to delete a product permission profile from the specified user. Please read the [warning](/docs/admin-api/how-to/delete-user-product-permission-profiles-using-email#this-endpoint-can-only-be-used) about using this endpoint.

Here’s how you make the call, but make sure to substitute your base path for \{BASE_PATH}, your API account ID for \{API_ACCOUNT_ID}, and your organization ID for \{ORGANIZATION_ID}.

> **Note**
>
> View the source code for this how-to on GitHub: [Bash](https://github.com/docusign/code-examples-bash/blob/master/examples/Admin/eg009DeleteUserProductPermissionProfile.sh), [C#](https://github.com/docusign/code-examples-csharp/blob/master/launcher-csharp/Admin/Examples/DeleteUserProductPermissionProfileById.cs), [Java](https://github.com/docusign/code-examples-java/blob/master/src/main/java/com/docusign/controller/admin/services/DeleteUserProductPermissionProfileById.java), [Node.js](https://github.com/docusign/code-examples-node/blob/master/lib/admin/examples/deleteUserProductPermissionProfile.js), [PHP](https://github.com/docusign/code-examples-php/blob/master/src/Services/Examples/Admin/DeleteUserProductPermissionProfileByIdService.php), [PowerShell](https://github.com/docusign/code-examples-powershell/blob/master/examples/Admin/eg009DeleteUserProductPermissionProfile.ps1), [Python](https://github.com/docusign/code-examples-python/blob/master/app/admin/examples/eg009_delete_user_product_permission_profile.py), or [Ruby](https://github.com/docusign/code-examples-ruby/blob/master/app/services/admin_api/eg009_delete_user_product_permission_profile_service.rb).

**`Bash`**

```bash title="Bash"
curl -w '%{http_code}' -i --request DELETE "${base_path}/v2.1/organizations/${ORGANIZATION_ID}/accounts/${API_ACCOUNT_ID}/products/users" \
  "${Headers[@]}" \
  --data-binary @${request_data} \
  --output ${response}
```

**`C#`**

```csharp title="C#"
var response = productPermissionProfilesApi.RemoveUserProductPermissionWithHttpInfo(orgId, accountId, userProductProfileDeleteRequest);
response.Headers.TryGetValue("X-RateLimit-Remaining", out string remaining);
response.Headers.TryGetValue("X-RateLimit-Reset", out string reset);

if (reset != null && remaining != null)
{
    DateTime resetDate = DateTimeOffset.FromUnixTimeSeconds(long.Parse(reset)).UtcDateTime;
    Console.WriteLine("API calls remaining: " + remaining);
    Console.WriteLine("Next Reset: " + resetDate);
}

return response.Data;
```

**`Java`**

```java title="Java"
RemoveUserProductsResponse removeUserProductsRepsonse = DeleteUserProductPermissionProfileById.deleteUserProductPermissionProfile(
        productPermissionProfilesApi,
        args.getProductId(),
        this.session.getEmailAddress(),
        organizationId,
        existingAccountId);
```

**`Node.js`**

```javascript title="Node.js"
const productPermissionProfilesApi = new docusignAdmin.ProductPermissionProfilesApi(dsApiClient);
return productPermissionProfilesApi.removeUserProductPermission(userProductProfileDeleteRequest, args.organizationId, args.accountId);
```

**`PHP`**

```php title="PHP"
$response = $productPermissionProfilesApi->removeUserProductPermissionWithHttpInfo(
    $organizationId,
    $accountId,
    $userProductProfileDeleteRequest
);

$remaining = $response[2]['X-RateLimit-Remaining'] ?? null;
$reset = $response[2]['X-RateLimit-Reset'] ?? null;

if ($remaining !== null && $reset !== null) {
    $resetInstant = (new DateTime())->setTimestamp((int)$reset);
    error_log("API calls remaining: $remaining");
    error_log("Next Reset: " . $resetInstant->format(\DateTime::ATOM));
}

return $response[0];
```

**`PowerShell`**

```text title="PowerShell"
$uri = "${base_path}/v2.1/organizations/${organizationId}/accounts/${APIAccountId}/products/users"
Invoke-WebRequest -uri $uri -headers $headers -body $body -method DELETE
```

**`Python`**

```python title="Python"
product_permission_profiles_api = ProductPermissionProfilesApi(api_client=api_client)
(response, status, headers) = product_permission_profiles_api.remove_user_product_permission_with_http_info(
    organization_id=org_id,
    account_id=account_id,
    user_product_permission_profiles_request=user_product_profile_delete_request
)

remaining = headers.get("X-RateLimit-Remaining")
reset = headers.get("X-RateLimit-Reset")

if remaining is not None and reset is not None:
    reset_date = dt.fromtimestamp(int(reset), tz=timezone.utc)
    print(f"API calls remaining: {remaining}")
    print(f"Next Reset: {reset_date}")
```

**`Ruby`**

```ruby title="Ruby"
product_permission_profiles_api = DocuSign_Admin::ProductPermissionProfilesApi.new(api_client)
results, _status, headers = product_permission_profiles_api.remove_user_product_permission_with_http_info(args[:organization_id], args[:account_id], user_product_profile_delete_request)

remaining = headers['X-RateLimit-Remaining']
reset = headers['X-RateLimit-Reset']

if remaining && reset
  reset_date = Time.at(reset.to_i).utc
  puts "API calls remaining: #{remaining}"
  puts "Next Reset: #{reset_date}"
end
```

## Expected response

If you run this code example from our Quickstart or launcher projects, you should see a JSON response   similar to “Sample successful response”. “Sample failed response” is shown in the second gist tab.

**`Sample successful response`**

```json title="Sample successful response"
{
  "is_success":true,
  "user_email":"example@example.com",
  "user_product_results":
  {
    "37f013eb-7012-4588-8028-357b39fdbd00":"deleted"
  }
}
```

**`Sample failed response`**

```json title="Sample failed response"
{
  "error":"bad_request",
  "error_description":"eSignature membership cannot be deleted as the user has membership with other products (37f013eb-7012-4588-8028-357b39fdbd00). Please delete other product memberships before deleting eSignature membership",
  "reference_id":"eb8d83ec-xxxx-xxxx-xxxx-847a3d0c2d35"
}
```

## Next steps

* Run this code example from our [Quickstart](/docs/esign-rest-api/quickstart) or launcher projects:    [Bash](https://github.com/docusign/code-examples-bash), [C#](https://github.com/docusign/code-examples-csharp), [Java](https://github.com/docusign/code-examples-java), [Node.js](https://github.com/docusign/code-examples-node), [PHP](https://github.com/docusign/code-examples-php), [PowerShell](https://github.com/docusign/code-examples-powershell), [Python](https://github.com/docusign/code-examples-python), or [Ruby](https://github.com/docusign/code-examples-ruby).
* See all available Admin API [How-to guides](/docs/admin-api/how-to).
* See [How to create a new active user for CLM and eSignature](/docs/admin-api/how-to/create-active-clm-esign-user).
* See [How to update user product permission profiles using an email address](/docs/admin-api/how-to/update-user-product-permission-profiles-using-email).
* See how to [Go-Live](/docs/admin-api/go-live) with a completed app and find the base path for API calls in the production environment.