Synopsis
Description
Revokes<email>’s grant on the named protected branch in the named project. No prompts and no TUI - same operation as pressing g on a branch row that reads access granted in capy users, but scriptable for CI.
Run it inside a Capy project: Capy reads the organization from keep.lock in the working directory, then authenticates with your cached session. If that session can’t be refreshed, the command falls back to the interactive browser OAuth flow rather than failing straight away.
<project> and <branch> must match the project and branch names exactly, while <email> matches case-insensitively. Revoking a branch grant leaves org membership alone - the member keeps every other branch and project they had.
capy revoke-branch is disabled in local-only mode, which has no organization, team, or server.
What revocation changes
The service stops serving that branch to them right away. Their nextcapy sync on the branch fails:
capy checkout production fails with You do not have access to branch "production".
Revocation doesn’t reach onto their machine. They’re still in the org, so their local keys stay intact and anything they already synced to disk stays readable - the project key is derived per organization and project, not per branch. Rotate any value you don’t want them to keep.
Example
Failure modes
Any other service error - for example, your role isn’t allowed to manage grants on that project - is printed as a raw error object rather than a tidy message. All exits are non-zero on failure, suitable for CI.
See also
capy grant-branch- the inversecapy users- interactive equivalent- Protected branches - the concept