Remove a default scope from a client
keycloak_client_scope_unassignRemoves a default client scope from a Keycloak client. Requires explicit confirmation to prevent accidental removal.
Instructions
Removes a default client scope from a client. This is a destructive write operation and is gated by an explicit confirmation step, so it does nothing unless confirm is true. It is not idempotent in effect: the first successful call detaches the scope, and a later call once the scope is gone reports that it was not removed. Use keycloak_client_default_scopes_get first to see which scopes are currently assigned. Returns a confirmation message when the scope is removed, or a message starting with "Not removed:" with the reason (for example missing confirmation, or an unknown client or scope).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| scope | Yes | The name of the default client scope to remove from the client, for example "profile". Should match a scope currently returned by keycloak_client_default_scopes_get. Required. | |
| confirm | No | Explicit confirmation flag for this destructive removal. Must be set to true to actually detach the scope; when omitted or false the tool declines and reports that the change was not confirmed. Defaults to false. | |
| clientId | Yes | The internal Keycloak UUID of the client (the "id" field, not the human-readable clientId), for example "a1b2c3d4-5678-90ab-cdef-1234567890ab". Required. |