# REVOKE

## Privileges

### Syntax

```bnf
REVOKE 
    priv_type [(column_list)]
      [, priv_type [(column_list)]] ...
    ON [object_type] priv_level
    FROM user [, user] ...

REVOKE ALL PRIVILEGES, GRANT OPTION
    FROM user [, user] ...
```

### Description

The `REVOKE` statement enables system administrators to revoke privileges (or roles - see [section below](#roles)) from MariaDB accounts. Each account is named using the same format as for the `GRANT` statement; for example, '`jeffrey'@'localhost`'. If you specify only the user name part of the account name, a host name part of '`%`' is used. For details on the levels at which privileges exist, the  allowable`priv_type` and `priv_level` values, and the syntax for specifying users and passwords, see [GRANT](https://gitbook-v2-q3lwp8faq-gitbook.vercel.app/url/mariadb.com/docs/server/reference/sql-statements/account-management-sql-statements/grant).

To use the first `REVOKE` syntax, you must have the`GRANT OPTION` privilege, and you must have the privileges that you are revoking.

To revoke all privileges, use the second syntax, which drops all global, database, table, column, and routine privileges for the named user or users:

```sql
REVOKE ALL PRIVILEGES, GRANT OPTION FROM user [, user] ...
```

To use this `REVOKE` syntax, you must have the global [CREATE USER](https://gitbook-v2-q3lwp8faq-gitbook.vercel.app/url/mariadb.com/docs/server/reference/sql-statements/account-management-sql-statements/create-user) privilege or the [UPDATE](https://gitbook-v2-q3lwp8faq-gitbook.vercel.app/url/mariadb.com/docs/server/reference/sql-statements/data-manipulation/changing-deleting-data/update) privilege for the mysql database. See [GRANT](https://gitbook-v2-q3lwp8faq-gitbook.vercel.app/url/mariadb.com/docs/server/reference/sql-statements/account-management-sql-statements/grant).

### Examples

```sql
REVOKE SUPER ON *.* FROM 'alexander'@'localhost';
```

## Roles

### Syntax

```bnf
REVOKE role  [, role ...]
    FROM grantee [, grantee2 ... ]

REVOKE ADMIN OPTION FOR role FROM grantee [, grantee2]
```

### Description

`REVOKE` is also used to remove a [role](https://gitbook-v2-q3lwp8faq-gitbook.vercel.app/url/mariadb.com/docs/server/security/user-account-management/roles) from a user or another role that it's previously been assigned to. If a role has previously been set as a [default role](https://gitbook-v2-q3lwp8faq-gitbook.vercel.app/url/mariadb.com/docs/server/reference/sql-statements/account-management-sql-statements/set-default-role), `REVOKE` does not remove the record of the default role from the [mysql.user](https://gitbook-v2-q3lwp8faq-gitbook.vercel.app/url/mariadb.com/docs/server/reference/system-tables/the-mysql-database-tables/mysql-user-table) table. If the role is subsequently granted again, it will again be the user's default. Use [SET DEFAULT ROLE NONE](https://gitbook-v2-q3lwp8faq-gitbook.vercel.app/url/mariadb.com/docs/server/reference/sql-statements/account-management-sql-statements/set-default-role) to explicitly remove this.

{% tabs %}
{% tab title="Current" %}
`REVOKE role` is also permitted in [prepared statements](https://gitbook-v2-q3lwp8faq-gitbook.vercel.app/url/mariadb.com/docs/server/reference/sql-statements/prepared-statements).
{% endtab %}

{% tab title="< 10.1.13" %}
`REVOKE role` is not permitted in [prepared statements](https://gitbook-v2-q3lwp8faq-gitbook.vercel.app/url/mariadb.com/docs/server/reference/sql-statements/prepared-statements).
{% endtab %}
{% endtabs %}

### Example

```sql
REVOKE journalist FROM hulda
```

<sub>*This page is licensed: GPLv2, originally from*</sub> [<sub>*fill\_help\_tables.sql*</sub>](https://github.com/MariaDB/server/blob/main/scripts/fill_help_tables.sql)

{% @marketo/form formId="4316" %}
