Remove a buyer's access

POST/v1/organization/{orgId}/learning/workspace/sales/{orderId}/remove-access

US Region: https://public-api.sessionboard.com · EU Region: https://public-api-eu.sessionboard.com

Ends the learner's access to the order's course. The sale stays on record. A refund in the payment gateway keeps access until this is called. Waits for a person's OK (202 needs_approval). Needs the permission that manages plan and billing, or an organization admin (403 otherwise). Requires write:learning. Also at POST /v1/learning/workspace/sales/{orderId}/remove-access.

Request example

curl --request POST \
  --url 'https://public-api.sessionboard.com/v1/organization/{orgId}/learning/workspace/sales/{orderId}/remove-access' \
  --header 'x-access-token: <api-token>'

const response = await fetch('https://public-api.sessionboard.com/v1/organization/{orgId}/learning/workspace/sales/{orderId}/remove-access', {
  method: 'POST',
  headers: {
    "x-access-token": "<api-token>"
  },
});

const data = await response.json();
console.log(data);

import requests

response = requests.request(
    "POST",
    "https://public-api.sessionboard.com/v1/organization/{orgId}/learning/workspace/sales/{orderId}/remove-access",
    headers={
        "x-access-token": "<api-token>"
    },
)

print(response.json())

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => "https://public-api.sessionboard.com/v1/organization/{orgId}/learning/workspace/sales/{orderId}/remove-access",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_HTTPHEADER => [
        "x-access-token: <api-token>",
    ],
]);

$response = curl_exec($curl);
curl_close($curl);

echo $response;

package main

import (
  "fmt"
  "io"
  "net/http"
)

func main() {
  req, _ := http.NewRequest("POST", "https://public-api.sessionboard.com/v1/organization/{orgId}/learning/workspace/sales/{orderId}/remove-access", nil)
  req.Header.Add("x-access-token", "<api-token>")

  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)

  fmt.Println(string(body))
}

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://public-api.sessionboard.com/v1/organization/{orgId}/learning/workspace/sales/{orderId}/remove-access"))
    .header("x-access-token", "<api-token>")
    .method("POST", HttpRequest.BodyPublishers.noBody())
    .build();

HttpResponse<String> response = HttpClient.newHttpClient()
    .send(request, HttpResponse.BodyHandlers.ofString());

System.out.println(response.body());

Try it

Response headers

Authorizations

x-access-tokenstringheader
Organization API token. Generate from Organization Settings → API Tokens.
AuthorizationBearer <token>headeror
OAuth 2.1 access token. Obtained via the OAuth PKCE flow at /oauth/token.

Send one of these. See Authentication.

Path parameters

orgIdstringpathrequired
Your organization ID. Any other organization returns 404.
orderIdstring<uuid>pathrequired
The order id (from List course sales).

Responses

202`application/json`

Waiting for a person. Nothing was published or sent: a person approves or declines the request in Sessionboard Learning (payload.url), and it then runs as them. Do not call again.

successboolean
payloadLearningApprovalRequest
Show child attributes
- statusstring
- approval_idstring<uuid>
- urlstring
  Where a person approves or declines it, in Sessionboard Learning.
- messagestring
  Waiting for your OK in Sessionboard: <url>
- notestring
  Says nothing was sent or published and not to call again.
- approvalLearningApproval
  Show child attributes
  - idstring<uuid>
  - statusstring
    Allowed values
    "pending", "approved", "declined", "failed"
  - actionstring
    publish_course, publish_on_demand or publish_course_draft.
  - surfacestring
    courses for these operations.
  - titlestring
    The approval card's headline, e.g. Publish the course “Intro to Safety”.
  - summarystring
    What the person asked the assistant, when given (From “…”), else empty.
  - targetobject | null
    Show child attributes
    typestring
    course, event or course_draft.
    idstring
  - event_idinteger | null
  - assistantobject
    Show child attributes
    vendorstring
    labelstring
    clientstring | null
    viastring | null
    Allowed values
    "api_token", "oauth", null
  - requested_byobject
    Show child attributes
    user_idinteger | null
    namestring | null
  - decided_byobject | null
    Show child attributes
    user_idinteger
    namestring | null
  - decided_atstring<date-time> | null
  - errorstring | null
  - remedyobject | null
    Set only when a run failed for a reason a person can fix in one step.
  - can_retryboolean
  - created_atstring<date-time>
  - productstring
  - urlstring

400`application/json`

A path, query or body value failed validation, or an unknown body property was sent. message names the field. (A source object naming the assistant, with the person's prompt, is accepted on every write and removed before validation.) For an {eventId} path that is not a whole number: error: VALIDATION_ERROR, eventId must be a valid integer.