{
    "name": "REVOKE(7)",
    "mode": "man",
    "parameter": "REVOKE",
    "section": "7",
    "url": "/phpMan.php/man/REVOKE/7/json",
    "generated": "2026-05-27T16:09:28Z",
    "synopsis": "REVOKE [ GRANT OPTION FOR ]\n{ { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }\n[, ...] | ALL [ PRIVILEGES ] }\nON { [ TABLE ] tablename [, ...]\n| ALL TABLES IN SCHEMA schemaname [, ...] }\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\nREVOKE [ GRANT OPTION FOR ]\n{ { SELECT | INSERT | UPDATE | REFERENCES } ( columnname [, ...] )\n[, ...] | ALL [ PRIVILEGES ] ( columnname [, ...] ) }\nON [ TABLE ] tablename [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\nREVOKE [ GRANT OPTION FOR ]\n{ { USAGE | SELECT | UPDATE }\n[, ...] | ALL [ PRIVILEGES ] }\nON { SEQUENCE sequencename [, ...]\n| ALL SEQUENCES IN SCHEMA schemaname [, ...] }\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\nREVOKE [ GRANT OPTION FOR ]\n{ { CREATE | CONNECT | TEMPORARY | TEMP } [, ...] | ALL [ PRIVILEGES ] }\nON DATABASE databasename [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\nREVOKE [ GRANT OPTION FOR ]\n{ USAGE | ALL [ PRIVILEGES ] }\nON DOMAIN domainname [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\nREVOKE [ GRANT OPTION FOR ]\n{ USAGE | ALL [ PRIVILEGES ] }\nON FOREIGN DATA WRAPPER fdwname [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\nREVOKE [ GRANT OPTION FOR ]\n{ USAGE | ALL [ PRIVILEGES ] }\nON FOREIGN SERVER servername [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\nREVOKE [ GRANT OPTION FOR ]\n{ EXECUTE | ALL [ PRIVILEGES ] }\nON { { FUNCTION | PROCEDURE | ROUTINE } functionname [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] [, ...]\n| ALL { FUNCTIONS | PROCEDURES | ROUTINES } IN SCHEMA schemaname [, ...] }\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\nREVOKE [ GRANT OPTION FOR ]\n{ USAGE | ALL [ PRIVILEGES ] }\nON LANGUAGE langname [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\nREVOKE [ GRANT OPTION FOR ]\n{ { SELECT | UPDATE } [, ...] | ALL [ PRIVILEGES ] }\nON LARGE OBJECT loid [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\nREVOKE [ GRANT OPTION FOR ]\n{ { CREATE | USAGE } [, ...] | ALL [ PRIVILEGES ] }\nON SCHEMA schemaname [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\nREVOKE [ GRANT OPTION FOR ]\n{ CREATE | ALL [ PRIVILEGES ] }\nON TABLESPACE tablespacename [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\nREVOKE [ GRANT OPTION FOR ]\n{ USAGE | ALL [ PRIVILEGES ] }\nON TYPE typename [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\nREVOKE [ ADMIN OPTION FOR ]\nrolename [, ...] FROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\nwhere rolespecification can be:\n[ GROUP ] rolename\n| PUBLIC\n| CURRENTROLE\n| CURRENTUSER\n| SESSIONUSER",
    "sections": [
        {
            "name": "NAME",
            "level": 1,
            "content": "REVOKE - remove access privileges\n",
            "subsections": []
        },
        {
            "name": "SYNOPSIS",
            "level": 1,
            "content": "REVOKE [ GRANT OPTION FOR ]\n{ { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }\n[, ...] | ALL [ PRIVILEGES ] }\nON { [ TABLE ] tablename [, ...]\n| ALL TABLES IN SCHEMA schemaname [, ...] }\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\n\nREVOKE [ GRANT OPTION FOR ]\n{ { SELECT | INSERT | UPDATE | REFERENCES } ( columnname [, ...] )\n[, ...] | ALL [ PRIVILEGES ] ( columnname [, ...] ) }\nON [ TABLE ] tablename [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\n\nREVOKE [ GRANT OPTION FOR ]\n{ { USAGE | SELECT | UPDATE }\n[, ...] | ALL [ PRIVILEGES ] }\nON { SEQUENCE sequencename [, ...]\n| ALL SEQUENCES IN SCHEMA schemaname [, ...] }\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\n\nREVOKE [ GRANT OPTION FOR ]\n{ { CREATE | CONNECT | TEMPORARY | TEMP } [, ...] | ALL [ PRIVILEGES ] }\nON DATABASE databasename [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\n\nREVOKE [ GRANT OPTION FOR ]\n{ USAGE | ALL [ PRIVILEGES ] }\nON DOMAIN domainname [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\n\nREVOKE [ GRANT OPTION FOR ]\n{ USAGE | ALL [ PRIVILEGES ] }\nON FOREIGN DATA WRAPPER fdwname [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\n\nREVOKE [ GRANT OPTION FOR ]\n{ USAGE | ALL [ PRIVILEGES ] }\nON FOREIGN SERVER servername [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\n\nREVOKE [ GRANT OPTION FOR ]\n{ EXECUTE | ALL [ PRIVILEGES ] }\nON { { FUNCTION | PROCEDURE | ROUTINE } functionname [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] [, ...]\n| ALL { FUNCTIONS | PROCEDURES | ROUTINES } IN SCHEMA schemaname [, ...] }\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\n\nREVOKE [ GRANT OPTION FOR ]\n{ USAGE | ALL [ PRIVILEGES ] }\nON LANGUAGE langname [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\n\nREVOKE [ GRANT OPTION FOR ]\n{ { SELECT | UPDATE } [, ...] | ALL [ PRIVILEGES ] }\nON LARGE OBJECT loid [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\n\nREVOKE [ GRANT OPTION FOR ]\n{ { CREATE | USAGE } [, ...] | ALL [ PRIVILEGES ] }\nON SCHEMA schemaname [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\n\nREVOKE [ GRANT OPTION FOR ]\n{ CREATE | ALL [ PRIVILEGES ] }\nON TABLESPACE tablespacename [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\n\nREVOKE [ GRANT OPTION FOR ]\n{ USAGE | ALL [ PRIVILEGES ] }\nON TYPE typename [, ...]\nFROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\n\nREVOKE [ ADMIN OPTION FOR ]\nrolename [, ...] FROM rolespecification [, ...]\n[ GRANTED BY rolespecification ]\n[ CASCADE | RESTRICT ]\n\nwhere rolespecification can be:\n\n[ GROUP ] rolename\n| PUBLIC\n| CURRENTROLE\n| CURRENTUSER\n| SESSIONUSER\n",
            "subsections": []
        },
        {
            "name": "DESCRIPTION",
            "level": 1,
            "content": "The REVOKE command revokes previously granted privileges from one or more roles. The key word\nPUBLIC refers to the implicitly defined group of all roles.\n\nSee the description of the GRANT command for the meaning of the privilege types.\n\nNote that any particular role will have the sum of privileges granted directly to it,\nprivileges granted to any role it is presently a member of, and privileges granted to PUBLIC.\nThus, for example, revoking SELECT privilege from PUBLIC does not necessarily mean that all\nroles have lost SELECT privilege on the object: those who have it granted directly or via\nanother role will still have it. Similarly, revoking SELECT from a user might not prevent\nthat user from using SELECT if PUBLIC or another membership role still has SELECT rights.\n\nIf GRANT OPTION FOR is specified, only the grant option for the privilege is revoked, not the\nprivilege itself. Otherwise, both the privilege and the grant option are revoked.\n\nIf a user holds a privilege with grant option and has granted it to other users then the\nprivileges held by those other users are called dependent privileges. If the privilege or the\ngrant option held by the first user is being revoked and dependent privileges exist, those\ndependent privileges are also revoked if CASCADE is specified; if it is not, the revoke\naction will fail. This recursive revocation only affects privileges that were granted through\na chain of users that is traceable to the user that is the subject of this REVOKE command.\nThus, the affected users might effectively keep the privilege if it was also granted through\nother users.\n\nWhen revoking privileges on a table, the corresponding column privileges (if any) are\nautomatically revoked on each column of the table, as well. On the other hand, if a role has\nbeen granted privileges on a table, then revoking the same privileges from individual columns\nwill have no effect.\n\nWhen revoking membership in a role, GRANT OPTION is instead called ADMIN OPTION, but the\nbehavior is similar. This form of the command also allows a GRANTED BY option, but that\noption is currently ignored (except for checking the existence of the named role). Note also\nthat this form of the command does not allow the noise word GROUP in rolespecification.\n",
            "subsections": []
        },
        {
            "name": "NOTES",
            "level": 1,
            "content": "A user can only revoke privileges that were granted directly by that user. If, for example,\nuser A has granted a privilege with grant option to user B, and user B has in turn granted it\nto user C, then user A cannot revoke the privilege directly from C. Instead, user A could\nrevoke the grant option from user B and use the CASCADE option so that the privilege is in\nturn revoked from user C. For another example, if both A and B have granted the same\nprivilege to C, A can revoke their own grant but not B's grant, so C will still effectively\nhave the privilege.\n\nWhen a non-owner of an object attempts to REVOKE privileges on the object, the command will\nfail outright if the user has no privileges whatsoever on the object. As long as some\nprivilege is available, the command will proceed, but it will revoke only those privileges\nfor which the user has grant options. The REVOKE ALL PRIVILEGES forms will issue a warning\nmessage if no grant options are held, while the other forms will issue a warning if grant\noptions for any of the privileges specifically named in the command are not held. (In\nprinciple these statements apply to the object owner as well, but since the owner is always\ntreated as holding all grant options, the cases can never occur.)\n\nIf a superuser chooses to issue a GRANT or REVOKE command, the command is performed as though\nit were issued by the owner of the affected object. Since all privileges ultimately come from\nthe object owner (possibly indirectly via chains of grant options), it is possible for a\nsuperuser to revoke all privileges, but this might require use of CASCADE as stated above.\n\nREVOKE can also be done by a role that is not the owner of the affected object, but is a\nmember of the role that owns the object, or is a member of a role that holds privileges WITH\nGRANT OPTION on the object. In this case the command is performed as though it were issued by\nthe containing role that actually owns the object or holds the privileges WITH GRANT OPTION.\nFor example, if table t1 is owned by role g1, of which role u1 is a member, then u1 can\nrevoke privileges on t1 that are recorded as being granted by g1. This would include grants\nmade by u1 as well as by other members of role g1.\n\nIf the role executing REVOKE holds privileges indirectly via more than one role membership\npath, it is unspecified which containing role will be used to perform the command. In such\ncases it is best practice to use SET ROLE to become the specific role you want to do the\nREVOKE as. Failure to do so might lead to revoking privileges other than the ones you\nintended, or not revoking anything at all.\n\nSee Section 5.7 for more information about specific privilege types, as well as how to\ninspect objects' privileges.\n",
            "subsections": []
        },
        {
            "name": "EXAMPLES",
            "level": 1,
            "content": "Revoke insert privilege for the public on table films:\n\nREVOKE INSERT ON films FROM PUBLIC;\n\nRevoke all privileges from user manuel on view kinds:\n\nREVOKE ALL PRIVILEGES ON kinds FROM manuel;\n\nNote that this actually means “revoke all privileges that I granted”.\n\nRevoke membership in role admins from user joe:\n\nREVOKE admins FROM joe;\n",
            "subsections": []
        },
        {
            "name": "COMPATIBILITY",
            "level": 1,
            "content": "The compatibility notes of the GRANT command apply analogously to REVOKE. The keyword\nRESTRICT or CASCADE is required according to the standard, but PostgreSQL assumes RESTRICT by\ndefault.\n",
            "subsections": [
                {
                    "name": "SEE ALSO",
                    "level": 2,
                    "content": "GRANT(7), ALTER DEFAULT PRIVILEGES (ALTERDEFAULTPRIVILEGES(7))\n\n\n"
                }
            ]
        },
        {
            "name": "PostgreSQL 14.23                                2026                                       REVOKE(7)",
            "level": 1,
            "content": "",
            "subsections": []
        }
    ]
}