admin/removeAppliedLimitClasses (#1210)

cmd/zrok2/adminDeleteAppliedLimitClasses.go

@@ -0,0 +1,62 @@
+package main
+
+import (
+	"strconv"
+
+	"github.com/michaelquigley/df/dl"
+	"github.com/openziti/zrok/v2/environment"
+	"github.com/openziti/zrok/v2/rest_client_zrok/admin"
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	adminDeleteCmd.AddCommand(newAdminDeleteAppliedLimitClassesCommand().cmd)
+}
+
+type adminDeleteAppliedLimitClassesCommand struct {
+	cmd *cobra.Command
+}
+
+func newAdminDeleteAppliedLimitClassesCommand() *adminDeleteAppliedLimitClassesCommand {
+	cmd := &cobra.Command{
+		Use:     "applied-limit-classes <email> <limitClassId> [<limitClassId>...]",
+		Aliases: []string{"alcs"},
+		Short:   "Remove one or more applied limit classes from the specified account",
+		Args:    cobra.MinimumNArgs(2),
+	}
+	command := &adminDeleteAppliedLimitClassesCommand{cmd: cmd}
+	cmd.Run = command.run
+	return command
+}
+
+func (cmd *adminDeleteAppliedLimitClassesCommand) run(_ *cobra.Command, args []string) {
+	env, err := environment.LoadRoot()
+	if err != nil {
+		panic(err)
+	}
+
+	zrok, err := env.Client()
+	if err != nil {
+		panic(err)
+	}
+
+	var limitClassIds []int64
+	for _, arg := range args[1:] {
+		lcId, err := strconv.ParseInt(arg, 10, 64)
+		if err != nil {
+			panic(err)
+		}
+		limitClassIds = append(limitClassIds, lcId)
+	}
+
+	req := admin.NewRemoveAppliedLimitClassesParams()
+	req.Body.Email = args[0]
+	req.Body.LimitClassIds = limitClassIds
+
+	_, err = zrok.Admin.RemoveAppliedLimitClasses(req, mustGetAdminAuth())
+	if err != nil {
+		panic(err)
+	}
+
+	dl.Infof("removed %d applied limit class(es) from '%v'", len(limitClassIds), args[0])
+}

controller/controller.go

@@ -82,6 +82,7 @@ func Run(inCfg *config.Config) error {
 	api.AdminListNamespacesHandler = newListNamespacesHandler()
 	api.AdminListOrganizationMembersHandler = newListOrganizationMembersHandler()
 	api.AdminListOrganizationsHandler = newListOrganizationsHandler()
+	api.AdminRemoveAppliedLimitClassesHandler = newRemoveAppliedLimitClassesHandler()
 	api.AdminRemoveNamespaceFrontendMappingHandler = newRemoveNamespaceFrontendMappingHandler()
 	api.AdminRemoveNamespaceGrantHandler = newRemoveNamespaceGrantHandler()
 	api.AdminRemoveOrganizationMemberHandler = newRemoveOrganizationMemberHandler()

controller/removeAppliedLimitClasses.go

@@ -0,0 +1,48 @@
+package controller
+
+import (
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/michaelquigley/df/dl"
+	"github.com/openziti/zrok/v2/rest_model_zrok"
+	"github.com/openziti/zrok/v2/rest_server_zrok/operations/admin"
+)
+
+type removeAppliedLimitClassesHandler struct{}
+
+func newRemoveAppliedLimitClassesHandler() *removeAppliedLimitClassesHandler {
+	return &removeAppliedLimitClassesHandler{}
+}
+
+func (h *removeAppliedLimitClassesHandler) Handle(params admin.RemoveAppliedLimitClassesParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	if !principal.Admin {
+		dl.Error("invalid admin principal")
+		return admin.NewRemoveAppliedLimitClassesUnauthorized()
+	}
+
+	trx, err := str.Begin()
+	if err != nil {
+		dl.Errorf("error starting transaction: %v", err)
+		return admin.NewRemoveAppliedLimitClassesInternalServerError()
+	}
+	defer func() { _ = trx.Rollback() }()
+
+	acct, err := str.FindAccountWithEmail(params.Body.Email, trx)
+	if err != nil {
+		dl.Errorf("error finding account with email '%v': %v", params.Body.Email, err)
+		return admin.NewRemoveAppliedLimitClassesNotFound()
+	}
+
+	for _, lcId := range params.Body.LimitClassIds {
+		if err := str.RemoveAppliedLimitClass(acct.Id, int(lcId), trx); err != nil {
+			dl.Errorf("error removing applied limit class '%v' from '%v': %v", lcId, params.Body.Email, err)
+			return admin.NewRemoveAppliedLimitClassesInternalServerError()
+		}
+	}
+
+	if err := trx.Commit(); err != nil {
+		dl.Errorf("error committing transaction: %v", err)
+		return admin.NewRemoveAppliedLimitClassesInternalServerError()
+	}
+
+	return admin.NewRemoveAppliedLimitClassesOK()
+}

controller/store/appliedLimitClass.go

@@ -23,6 +23,13 @@ func (str *Store) ApplyLimitClass(lc *AppliedLimitClass, trx *sqlx.Tx) (int, err
 	return id, nil
 }
 
+func (str *Store) RemoveAppliedLimitClass(acctId, lcId int, trx *sqlx.Tx) error {
+	if _, err := trx.Exec("delete from applied_limit_classes where account_id = $1 and limit_class_id = $2", acctId, lcId); err != nil {
+		return errors.Wrap(err, "error deleting applied_limit_class")
+	}
+	return nil
+}
+
 func (str *Store) FindAppliedLimitClassesForAccount(acctId int, trx *sqlx.Tx) ([]*LimitClass, error) {
 	rows, err := trx.Queryx("select limit_classes.* from applied_limit_classes, limit_classes where applied_limit_classes.account_id = $1 and applied_limit_classes.limit_class_id = limit_classes.id", acctId)
 	if err != nil {

rest_client_zrok/admin/admin_client.go

@@ -152,6 +152,8 @@ type ClientService interface {
 
 	ListOrganizations(params *ListOrganizationsParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*ListOrganizationsOK, error)
 
+	RemoveAppliedLimitClasses(params *RemoveAppliedLimitClassesParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*RemoveAppliedLimitClassesOK, error)
+
 	RemoveNamespaceFrontendMapping(params *RemoveNamespaceFrontendMappingParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*RemoveNamespaceFrontendMappingOK, error)
 
 	RemoveNamespaceGrant(params *RemoveNamespaceGrantParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*RemoveNamespaceGrantOK, error)
@@ -1311,6 +1313,50 @@ func (a *Client) ListOrganizations(params *ListOrganizationsParams, authInfo run
 	panic(msg)
 }
 
+/*
+RemoveAppliedLimitClasses remove applied limit classes API
+*/
+func (a *Client) RemoveAppliedLimitClasses(params *RemoveAppliedLimitClassesParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*RemoveAppliedLimitClassesOK, error) {
+	// NOTE: parameters are not validated before sending
+	if params == nil {
+		params = NewRemoveAppliedLimitClassesParams()
+	}
+	op := &runtime.ClientOperation{
+		ID:                 "removeAppliedLimitClasses",
+		Method:             "DELETE",
+		PathPattern:        "/applied-limit-class",
+		ProducesMediaTypes: []string{"application/zrok.v1+json"},
+		ConsumesMediaTypes: []string{"application/zrok.v1+json"},
+		Schemes:            []string{"http"},
+		Params:             params,
+		Reader:             &RemoveAppliedLimitClassesReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Context:            params.Context,
+		Client:             params.HTTPClient,
+	}
+	for _, opt := range opts {
+		opt(op)
+	}
+	result, err := a.transport.Submit(op)
+	if err != nil {
+		return nil, err
+	}
+
+	// only one success response has to be checked
+	success, ok := result.(*RemoveAppliedLimitClassesOK)
+	if ok {
+		return success, nil
+	}
+
+	// unexpected success response.
+
+	// no default response is defined.
+	//
+	// safeguard: normally, in the absence of a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for removeAppliedLimitClasses: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
 /*
 RemoveNamespaceFrontendMapping remove namespace frontend mapping API
 */

rest_client_zrok/admin/remove_applied_limit_classes_parameters.go

@@ -0,0 +1,146 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewRemoveAppliedLimitClassesParams creates a new RemoveAppliedLimitClassesParams object,
+// with the default timeout for this client.
+//
+// Default values are not hydrated, since defaults are normally applied by the API server side.
+//
+// To enforce default values in parameter, use SetDefaults or WithDefaults.
+func NewRemoveAppliedLimitClassesParams() *RemoveAppliedLimitClassesParams {
+	return &RemoveAppliedLimitClassesParams{
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewRemoveAppliedLimitClassesParamsWithTimeout creates a new RemoveAppliedLimitClassesParams object
+// with the ability to set a timeout on a request.
+func NewRemoveAppliedLimitClassesParamsWithTimeout(timeout time.Duration) *RemoveAppliedLimitClassesParams {
+	return &RemoveAppliedLimitClassesParams{
+		timeout: timeout,
+	}
+}
+
+// NewRemoveAppliedLimitClassesParamsWithContext creates a new RemoveAppliedLimitClassesParams object
+// with the ability to set a context for a request.
+func NewRemoveAppliedLimitClassesParamsWithContext(ctx context.Context) *RemoveAppliedLimitClassesParams {
+	return &RemoveAppliedLimitClassesParams{
+		Context: ctx,
+	}
+}
+
+// NewRemoveAppliedLimitClassesParamsWithHTTPClient creates a new RemoveAppliedLimitClassesParams object
+// with the ability to set a custom HTTPClient for a request.
+func NewRemoveAppliedLimitClassesParamsWithHTTPClient(client *http.Client) *RemoveAppliedLimitClassesParams {
+	return &RemoveAppliedLimitClassesParams{
+		HTTPClient: client,
+	}
+}
+
+/*
+RemoveAppliedLimitClassesParams contains all the parameters to send to the API endpoint
+
+	for the remove applied limit classes operation.
+
+	Typically these are written to a http.Request.
+*/
+type RemoveAppliedLimitClassesParams struct {
+
+	// Body.
+	Body RemoveAppliedLimitClassesBody
+
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithDefaults hydrates default values in the remove applied limit classes params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *RemoveAppliedLimitClassesParams) WithDefaults() *RemoveAppliedLimitClassesParams {
+	o.SetDefaults()
+	return o
+}
+
+// SetDefaults hydrates default values in the remove applied limit classes params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *RemoveAppliedLimitClassesParams) SetDefaults() {
+	// no default values defined for this parameter
+}
+
+// WithTimeout adds the timeout to the remove applied limit classes params
+func (o *RemoveAppliedLimitClassesParams) WithTimeout(timeout time.Duration) *RemoveAppliedLimitClassesParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the remove applied limit classes params
+func (o *RemoveAppliedLimitClassesParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the remove applied limit classes params
+func (o *RemoveAppliedLimitClassesParams) WithContext(ctx context.Context) *RemoveAppliedLimitClassesParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the remove applied limit classes params
+func (o *RemoveAppliedLimitClassesParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the remove applied limit classes params
+func (o *RemoveAppliedLimitClassesParams) WithHTTPClient(client *http.Client) *RemoveAppliedLimitClassesParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the remove applied limit classes params
+func (o *RemoveAppliedLimitClassesParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WithBody adds the body to the remove applied limit classes params
+func (o *RemoveAppliedLimitClassesParams) WithBody(body RemoveAppliedLimitClassesBody) *RemoveAppliedLimitClassesParams {
+	o.SetBody(body)
+	return o
+}
+
+// SetBody adds the body to the remove applied limit classes params
+func (o *RemoveAppliedLimitClassesParams) SetBody(body RemoveAppliedLimitClassesBody) {
+	o.Body = body
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *RemoveAppliedLimitClassesParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+	if err := r.SetBodyParam(o.Body); err != nil {
+		return err
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_client_zrok/admin/remove_applied_limit_classes_responses.go

@@ -0,0 +1,317 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+)
+
+// RemoveAppliedLimitClassesReader is a Reader for the RemoveAppliedLimitClasses structure.
+type RemoveAppliedLimitClassesReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *RemoveAppliedLimitClassesReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (any, error) {
+	switch response.Code() {
+	case 200:
+		result := NewRemoveAppliedLimitClassesOK()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 401:
+		result := NewRemoveAppliedLimitClassesUnauthorized()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 404:
+		result := NewRemoveAppliedLimitClassesNotFound()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 500:
+		result := NewRemoveAppliedLimitClassesInternalServerError()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	default:
+		return nil, runtime.NewAPIError("[DELETE /applied-limit-class] removeAppliedLimitClasses", response, response.Code())
+	}
+}
+
+// NewRemoveAppliedLimitClassesOK creates a RemoveAppliedLimitClassesOK with default headers values
+func NewRemoveAppliedLimitClassesOK() *RemoveAppliedLimitClassesOK {
+	return &RemoveAppliedLimitClassesOK{}
+}
+
+/*
+RemoveAppliedLimitClassesOK describes a response with status code 200, with default header values.
+
+removed
+*/
+type RemoveAppliedLimitClassesOK struct {
+}
+
+// IsSuccess returns true when this remove applied limit classes o k response has a 2xx status code
+func (o *RemoveAppliedLimitClassesOK) IsSuccess() bool {
+	return true
+}
+
+// IsRedirect returns true when this remove applied limit classes o k response has a 3xx status code
+func (o *RemoveAppliedLimitClassesOK) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this remove applied limit classes o k response has a 4xx status code
+func (o *RemoveAppliedLimitClassesOK) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this remove applied limit classes o k response has a 5xx status code
+func (o *RemoveAppliedLimitClassesOK) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this remove applied limit classes o k response a status code equal to that given
+func (o *RemoveAppliedLimitClassesOK) IsCode(code int) bool {
+	return code == 200
+}
+
+// Code gets the status code for the remove applied limit classes o k response
+func (o *RemoveAppliedLimitClassesOK) Code() int {
+	return 200
+}
+
+func (o *RemoveAppliedLimitClassesOK) Error() string {
+	return fmt.Sprintf("[DELETE /applied-limit-class][%d] removeAppliedLimitClassesOK", 200)
+}
+
+func (o *RemoveAppliedLimitClassesOK) String() string {
+	return fmt.Sprintf("[DELETE /applied-limit-class][%d] removeAppliedLimitClassesOK", 200)
+}
+
+func (o *RemoveAppliedLimitClassesOK) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewRemoveAppliedLimitClassesUnauthorized creates a RemoveAppliedLimitClassesUnauthorized with default headers values
+func NewRemoveAppliedLimitClassesUnauthorized() *RemoveAppliedLimitClassesUnauthorized {
+	return &RemoveAppliedLimitClassesUnauthorized{}
+}
+
+/*
+RemoveAppliedLimitClassesUnauthorized describes a response with status code 401, with default header values.
+
+unauthorized
+*/
+type RemoveAppliedLimitClassesUnauthorized struct {
+}
+
+// IsSuccess returns true when this remove applied limit classes unauthorized response has a 2xx status code
+func (o *RemoveAppliedLimitClassesUnauthorized) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this remove applied limit classes unauthorized response has a 3xx status code
+func (o *RemoveAppliedLimitClassesUnauthorized) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this remove applied limit classes unauthorized response has a 4xx status code
+func (o *RemoveAppliedLimitClassesUnauthorized) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this remove applied limit classes unauthorized response has a 5xx status code
+func (o *RemoveAppliedLimitClassesUnauthorized) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this remove applied limit classes unauthorized response a status code equal to that given
+func (o *RemoveAppliedLimitClassesUnauthorized) IsCode(code int) bool {
+	return code == 401
+}
+
+// Code gets the status code for the remove applied limit classes unauthorized response
+func (o *RemoveAppliedLimitClassesUnauthorized) Code() int {
+	return 401
+}
+
+func (o *RemoveAppliedLimitClassesUnauthorized) Error() string {
+	return fmt.Sprintf("[DELETE /applied-limit-class][%d] removeAppliedLimitClassesUnauthorized", 401)
+}
+
+func (o *RemoveAppliedLimitClassesUnauthorized) String() string {
+	return fmt.Sprintf("[DELETE /applied-limit-class][%d] removeAppliedLimitClassesUnauthorized", 401)
+}
+
+func (o *RemoveAppliedLimitClassesUnauthorized) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewRemoveAppliedLimitClassesNotFound creates a RemoveAppliedLimitClassesNotFound with default headers values
+func NewRemoveAppliedLimitClassesNotFound() *RemoveAppliedLimitClassesNotFound {
+	return &RemoveAppliedLimitClassesNotFound{}
+}
+
+/*
+RemoveAppliedLimitClassesNotFound describes a response with status code 404, with default header values.
+
+account not found
+*/
+type RemoveAppliedLimitClassesNotFound struct {
+}
+
+// IsSuccess returns true when this remove applied limit classes not found response has a 2xx status code
+func (o *RemoveAppliedLimitClassesNotFound) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this remove applied limit classes not found response has a 3xx status code
+func (o *RemoveAppliedLimitClassesNotFound) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this remove applied limit classes not found response has a 4xx status code
+func (o *RemoveAppliedLimitClassesNotFound) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this remove applied limit classes not found response has a 5xx status code
+func (o *RemoveAppliedLimitClassesNotFound) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this remove applied limit classes not found response a status code equal to that given
+func (o *RemoveAppliedLimitClassesNotFound) IsCode(code int) bool {
+	return code == 404
+}
+
+// Code gets the status code for the remove applied limit classes not found response
+func (o *RemoveAppliedLimitClassesNotFound) Code() int {
+	return 404
+}
+
+func (o *RemoveAppliedLimitClassesNotFound) Error() string {
+	return fmt.Sprintf("[DELETE /applied-limit-class][%d] removeAppliedLimitClassesNotFound", 404)
+}
+
+func (o *RemoveAppliedLimitClassesNotFound) String() string {
+	return fmt.Sprintf("[DELETE /applied-limit-class][%d] removeAppliedLimitClassesNotFound", 404)
+}
+
+func (o *RemoveAppliedLimitClassesNotFound) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewRemoveAppliedLimitClassesInternalServerError creates a RemoveAppliedLimitClassesInternalServerError with default headers values
+func NewRemoveAppliedLimitClassesInternalServerError() *RemoveAppliedLimitClassesInternalServerError {
+	return &RemoveAppliedLimitClassesInternalServerError{}
+}
+
+/*
+RemoveAppliedLimitClassesInternalServerError describes a response with status code 500, with default header values.
+
+internal server error
+*/
+type RemoveAppliedLimitClassesInternalServerError struct {
+}
+
+// IsSuccess returns true when this remove applied limit classes internal server error response has a 2xx status code
+func (o *RemoveAppliedLimitClassesInternalServerError) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this remove applied limit classes internal server error response has a 3xx status code
+func (o *RemoveAppliedLimitClassesInternalServerError) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this remove applied limit classes internal server error response has a 4xx status code
+func (o *RemoveAppliedLimitClassesInternalServerError) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this remove applied limit classes internal server error response has a 5xx status code
+func (o *RemoveAppliedLimitClassesInternalServerError) IsServerError() bool {
+	return true
+}
+
+// IsCode returns true when this remove applied limit classes internal server error response a status code equal to that given
+func (o *RemoveAppliedLimitClassesInternalServerError) IsCode(code int) bool {
+	return code == 500
+}
+
+// Code gets the status code for the remove applied limit classes internal server error response
+func (o *RemoveAppliedLimitClassesInternalServerError) Code() int {
+	return 500
+}
+
+func (o *RemoveAppliedLimitClassesInternalServerError) Error() string {
+	return fmt.Sprintf("[DELETE /applied-limit-class][%d] removeAppliedLimitClassesInternalServerError", 500)
+}
+
+func (o *RemoveAppliedLimitClassesInternalServerError) String() string {
+	return fmt.Sprintf("[DELETE /applied-limit-class][%d] removeAppliedLimitClassesInternalServerError", 500)
+}
+
+func (o *RemoveAppliedLimitClassesInternalServerError) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+/*
+RemoveAppliedLimitClassesBody remove applied limit classes body
+swagger:model RemoveAppliedLimitClassesBody
+*/
+type RemoveAppliedLimitClassesBody struct {
+
+	// email
+	Email string `json:"email,omitempty"`
+
+	// limit class ids
+	LimitClassIds []int64 `json:"limitClassIds"`
+}
+
+// Validate validates this remove applied limit classes body
+func (o *RemoveAppliedLimitClassesBody) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this remove applied limit classes body based on context it is used
+func (o *RemoveAppliedLimitClassesBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *RemoveAppliedLimitClassesBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *RemoveAppliedLimitClassesBody) UnmarshalBinary(b []byte) error {
+	var res RemoveAppliedLimitClassesBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_server_zrok/embedded_spec.go

@@ -1013,6 +1013,50 @@ func init() {
             "description": "internal server error"
           }
         }
+      },
+      "delete": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "admin"
+        ],
+        "operationId": "removeAppliedLimitClasses",
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "schema": {
+              "properties": {
+                "email": {
+                  "type": "string"
+                },
+                "limitClassIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "integer"
+                  }
+                }
+              }
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "removed"
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "404": {
+            "description": "account not found"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
       }
     },
     "/applied-limit-class/list": {
@@ -5544,6 +5588,50 @@ func init() {
             "description": "internal server error"
           }
         }
+      },
+      "delete": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "admin"
+        ],
+        "operationId": "removeAppliedLimitClasses",
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "schema": {
+              "properties": {
+                "email": {
+                  "type": "string"
+                },
+                "limitClassIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "integer"
+                  }
+                }
+              }
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "removed"
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "404": {
+            "description": "account not found"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
       }
     },
     "/applied-limit-class/list": {

rest_server_zrok/operations/admin/remove_applied_limit_classes.go

@@ -0,0 +1,115 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+
+	"github.com/openziti/zrok/v2/rest_model_zrok"
+)
+
+// RemoveAppliedLimitClassesHandlerFunc turns a function with the right signature into a remove applied limit classes handler
+type RemoveAppliedLimitClassesHandlerFunc func(RemoveAppliedLimitClassesParams, *rest_model_zrok.Principal) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn RemoveAppliedLimitClassesHandlerFunc) Handle(params RemoveAppliedLimitClassesParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	return fn(params, principal)
+}
+
+// RemoveAppliedLimitClassesHandler interface for that can handle valid remove applied limit classes params
+type RemoveAppliedLimitClassesHandler interface {
+	Handle(RemoveAppliedLimitClassesParams, *rest_model_zrok.Principal) middleware.Responder
+}
+
+// NewRemoveAppliedLimitClasses creates a new http.Handler for the remove applied limit classes operation
+func NewRemoveAppliedLimitClasses(ctx *middleware.Context, handler RemoveAppliedLimitClassesHandler) *RemoveAppliedLimitClasses {
+	return &RemoveAppliedLimitClasses{Context: ctx, Handler: handler}
+}
+
+/*
+	RemoveAppliedLimitClasses swagger:route DELETE /applied-limit-class admin removeAppliedLimitClasses
+
+RemoveAppliedLimitClasses remove applied limit classes API
+*/
+type RemoveAppliedLimitClasses struct {
+	Context *middleware.Context
+	Handler RemoveAppliedLimitClassesHandler
+}
+
+func (o *RemoveAppliedLimitClasses) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		*r = *rCtx
+	}
+	var Params = NewRemoveAppliedLimitClassesParams()
+	uprinc, aCtx, err := o.Context.Authorize(r, route)
+	if err != nil {
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+	if aCtx != nil {
+		*r = *aCtx
+	}
+	var principal *rest_model_zrok.Principal
+	if uprinc != nil {
+		principal = uprinc.(*rest_model_zrok.Principal) // this is really a rest_model_zrok.Principal, I promise
+	}
+
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params, principal) // actually handle the request
+
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}
+
+// RemoveAppliedLimitClassesBody remove applied limit classes body
+//
+// swagger:model RemoveAppliedLimitClassesBody
+type RemoveAppliedLimitClassesBody struct {
+
+	// email
+	Email string `json:"email,omitempty"`
+
+	// limit class ids
+	LimitClassIds []int64 `json:"limitClassIds"`
+}
+
+// Validate validates this remove applied limit classes body
+func (o *RemoveAppliedLimitClassesBody) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this remove applied limit classes body based on context it is used
+func (o *RemoveAppliedLimitClassesBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *RemoveAppliedLimitClassesBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *RemoveAppliedLimitClassesBody) UnmarshalBinary(b []byte) error {
+	var res RemoveAppliedLimitClassesBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_server_zrok/operations/admin/remove_applied_limit_classes_parameters.go

@@ -0,0 +1,75 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/validate"
+)
+
+// NewRemoveAppliedLimitClassesParams creates a new RemoveAppliedLimitClassesParams object
+//
+// There are no default values defined in the spec.
+func NewRemoveAppliedLimitClassesParams() RemoveAppliedLimitClassesParams {
+
+	return RemoveAppliedLimitClassesParams{}
+}
+
+// RemoveAppliedLimitClassesParams contains all the bound params for the remove applied limit classes operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters removeAppliedLimitClasses
+type RemoveAppliedLimitClassesParams struct {
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+
+	/*
+	  In: body
+	*/
+	Body RemoveAppliedLimitClassesBody
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewRemoveAppliedLimitClassesParams() beforehand.
+func (o *RemoveAppliedLimitClassesParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	if runtime.HasBody(r) {
+		defer func() {
+			_ = r.Body.Close()
+		}()
+		var body RemoveAppliedLimitClassesBody
+		if err := route.Consumer.Consume(r.Body, &body); err != nil {
+			res = append(res, errors.NewParseError("body", "body", "", err))
+		} else {
+			// validate body object
+			if err := body.Validate(route.Formats); err != nil {
+				res = append(res, err)
+			}
+
+			ctx := validate.WithOperationRequest(r.Context())
+			if err := body.ContextValidate(ctx, route.Formats); err != nil {
+				res = append(res, err)
+			}
+
+			if len(res) == 0 {
+				o.Body = body
+			}
+		}
+	}
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_server_zrok/operations/admin/remove_applied_limit_classes_responses.go

@@ -0,0 +1,112 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+)
+
+// RemoveAppliedLimitClassesOKCode is the HTTP code returned for type RemoveAppliedLimitClassesOK
+const RemoveAppliedLimitClassesOKCode int = 200
+
+/*
+RemoveAppliedLimitClassesOK removed
+
+swagger:response removeAppliedLimitClassesOK
+*/
+type RemoveAppliedLimitClassesOK struct {
+}
+
+// NewRemoveAppliedLimitClassesOK creates RemoveAppliedLimitClassesOK with default headers values
+func NewRemoveAppliedLimitClassesOK() *RemoveAppliedLimitClassesOK {
+
+	return &RemoveAppliedLimitClassesOK{}
+}
+
+// WriteResponse to the client
+func (o *RemoveAppliedLimitClassesOK) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) // Remove Content-Type on empty responses
+
+	rw.WriteHeader(200)
+}
+
+// RemoveAppliedLimitClassesUnauthorizedCode is the HTTP code returned for type RemoveAppliedLimitClassesUnauthorized
+const RemoveAppliedLimitClassesUnauthorizedCode int = 401
+
+/*
+RemoveAppliedLimitClassesUnauthorized unauthorized
+
+swagger:response removeAppliedLimitClassesUnauthorized
+*/
+type RemoveAppliedLimitClassesUnauthorized struct {
+}
+
+// NewRemoveAppliedLimitClassesUnauthorized creates RemoveAppliedLimitClassesUnauthorized with default headers values
+func NewRemoveAppliedLimitClassesUnauthorized() *RemoveAppliedLimitClassesUnauthorized {
+
+	return &RemoveAppliedLimitClassesUnauthorized{}
+}
+
+// WriteResponse to the client
+func (o *RemoveAppliedLimitClassesUnauthorized) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) // Remove Content-Type on empty responses
+
+	rw.WriteHeader(401)
+}
+
+// RemoveAppliedLimitClassesNotFoundCode is the HTTP code returned for type RemoveAppliedLimitClassesNotFound
+const RemoveAppliedLimitClassesNotFoundCode int = 404
+
+/*
+RemoveAppliedLimitClassesNotFound account not found
+
+swagger:response removeAppliedLimitClassesNotFound
+*/
+type RemoveAppliedLimitClassesNotFound struct {
+}
+
+// NewRemoveAppliedLimitClassesNotFound creates RemoveAppliedLimitClassesNotFound with default headers values
+func NewRemoveAppliedLimitClassesNotFound() *RemoveAppliedLimitClassesNotFound {
+
+	return &RemoveAppliedLimitClassesNotFound{}
+}
+
+// WriteResponse to the client
+func (o *RemoveAppliedLimitClassesNotFound) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) // Remove Content-Type on empty responses
+
+	rw.WriteHeader(404)
+}
+
+// RemoveAppliedLimitClassesInternalServerErrorCode is the HTTP code returned for type RemoveAppliedLimitClassesInternalServerError
+const RemoveAppliedLimitClassesInternalServerErrorCode int = 500
+
+/*
+RemoveAppliedLimitClassesInternalServerError internal server error
+
+swagger:response removeAppliedLimitClassesInternalServerError
+*/
+type RemoveAppliedLimitClassesInternalServerError struct {
+}
+
+// NewRemoveAppliedLimitClassesInternalServerError creates RemoveAppliedLimitClassesInternalServerError with default headers values
+func NewRemoveAppliedLimitClassesInternalServerError() *RemoveAppliedLimitClassesInternalServerError {
+
+	return &RemoveAppliedLimitClassesInternalServerError{}
+}
+
+// WriteResponse to the client
+func (o *RemoveAppliedLimitClassesInternalServerError) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) // Remove Content-Type on empty responses
+
+	rw.WriteHeader(500)
+}

rest_server_zrok/operations/admin/remove_applied_limit_classes_urlbuilder.go

@@ -0,0 +1,87 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+)
+
+// RemoveAppliedLimitClassesURL generates an URL for the remove applied limit classes operation
+type RemoveAppliedLimitClassesURL struct {
+	_basePath string
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *RemoveAppliedLimitClassesURL) WithBasePath(bp string) *RemoveAppliedLimitClassesURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *RemoveAppliedLimitClassesURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *RemoveAppliedLimitClassesURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/applied-limit-class"
+
+	_basePath := o._basePath
+	if _basePath == "" {
+		_basePath = "/api/v2"
+	}
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *RemoveAppliedLimitClassesURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *RemoveAppliedLimitClassesURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *RemoveAppliedLimitClassesURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on RemoveAppliedLimitClassesURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on RemoveAppliedLimitClassesURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *RemoveAppliedLimitClassesURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}

rest_server_zrok/operations/zrok_api.go

@@ -486,6 +486,13 @@ func NewZrokAPI(spec *loads.Document) *ZrokAPI {
 			return middleware.NotImplemented("operation agent.RemoteUnshare has not yet been implemented")
 		}),
 
+		AdminRemoveAppliedLimitClassesHandler: admin.RemoveAppliedLimitClassesHandlerFunc(func(params admin.RemoveAppliedLimitClassesParams, principal *rest_model_zrok.Principal) middleware.Responder {
+			_ = params
+			_ = principal
+
+			return middleware.NotImplemented("operation admin.RemoveAppliedLimitClasses has not yet been implemented")
+		}),
+
 		AdminRemoveNamespaceFrontendMappingHandler: admin.RemoveNamespaceFrontendMappingHandlerFunc(func(params admin.RemoveNamespaceFrontendMappingParams, principal *rest_model_zrok.Principal) middleware.Responder {
 			_ = params
 			_ = principal
@@ -791,6 +798,8 @@ type ZrokAPI struct {
 	AgentRemoteUnaccessHandler agent.RemoteUnaccessHandler
 	// AgentRemoteUnshareHandler sets the operation handler for the remote unshare operation
 	AgentRemoteUnshareHandler agent.RemoteUnshareHandler
+	// AdminRemoveAppliedLimitClassesHandler sets the operation handler for the remove applied limit classes operation
+	AdminRemoveAppliedLimitClassesHandler admin.RemoveAppliedLimitClassesHandler
 	// AdminRemoveNamespaceFrontendMappingHandler sets the operation handler for the remove namespace frontend mapping operation
 	AdminRemoveNamespaceFrontendMappingHandler admin.RemoveNamespaceFrontendMappingHandler
 	// AdminRemoveNamespaceGrantHandler sets the operation handler for the remove namespace grant operation
@@ -1099,6 +1108,9 @@ func (o *ZrokAPI) Validate() error {
 	if o.AgentRemoteUnshareHandler == nil {
 		unregistered = append(unregistered, "agent.RemoteUnshareHandler")
 	}
+	if o.AdminRemoveAppliedLimitClassesHandler == nil {
+		unregistered = append(unregistered, "admin.RemoveAppliedLimitClassesHandler")
+	}
 	if o.AdminRemoveNamespaceFrontendMappingHandler == nil {
 		unregistered = append(unregistered, "admin.RemoveNamespaceFrontendMappingHandler")
 	}
@@ -1511,6 +1523,10 @@ func (o *ZrokAPI) initHandlerCache() {
 	if o.handlers["DELETE"] == nil {
 		o.handlers["DELETE"] = make(map[string]http.Handler)
 	}
+	o.handlers["DELETE"]["/applied-limit-class"] = admin.NewRemoveAppliedLimitClasses(o.context, o.AdminRemoveAppliedLimitClassesHandler)
+	if o.handlers["DELETE"] == nil {
+		o.handlers["DELETE"] = make(map[string]http.Handler)
+	}
 	o.handlers["DELETE"]["/namespace/frontend/mapping"] = admin.NewRemoveNamespaceFrontendMapping(o.context, o.AdminRemoveNamespaceFrontendMappingHandler)
 	if o.handlers["DELETE"] == nil {
 		o.handlers["DELETE"] = make(map[string]http.Handler)

sdk/nodejs/sdk/src/api/apis/AdminApi.ts

@@ -198,6 +198,10 @@ export interface ListOrganizationMembersRequest {
     body?: CreateOrganization201Response;
 }
 
+export interface RemoveAppliedLimitClassesRequest {
+    body?: ApplyLimitClassesRequest;
+}
+
 export interface RemoveNamespaceFrontendMappingOperationRequest {
     body?: RemoveNamespaceFrontendMappingRequest;
 }
@@ -1099,6 +1103,39 @@ export class AdminApi extends runtime.BaseAPI {
         return await response.value();
     }
 
+    /**
+     */
+    async removeAppliedLimitClassesRaw(requestParameters: RemoveAppliedLimitClassesRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/zrok.v1+json';
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["x-token"] = await this.configuration.apiKey("x-token"); // key authentication
+        }
+
+
+        let urlPath = `/applied-limit-class`;
+
+        const response = await this.request({
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+            body: ApplyLimitClassesRequestToJSON(requestParameters['body']),
+        }, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     */
+    async removeAppliedLimitClasses(requestParameters: RemoveAppliedLimitClassesRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.removeAppliedLimitClassesRaw(requestParameters, initOverrides);
+    }
+
     /**
      */
     async removeNamespaceFrontendMappingRaw(requestParameters: RemoveNamespaceFrontendMappingOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {

sdk/python/src/README.md

@@ -126,6 +126,7 @@ Class | Method | HTTP request | Description
 *AdminApi* | [**list_namespaces**](docs/AdminApi.md#list_namespaces) | **GET** /namespaces | 
 *AdminApi* | [**list_organization_members**](docs/AdminApi.md#list_organization_members) | **POST** /organization/list | 
 *AdminApi* | [**list_organizations**](docs/AdminApi.md#list_organizations) | **GET** /organizations | 
+*AdminApi* | [**remove_applied_limit_classes**](docs/AdminApi.md#remove_applied_limit_classes) | **DELETE** /applied-limit-class | 
 *AdminApi* | [**remove_namespace_frontend_mapping**](docs/AdminApi.md#remove_namespace_frontend_mapping) | **DELETE** /namespace/frontend/mapping | 
 *AdminApi* | [**remove_namespace_grant**](docs/AdminApi.md#remove_namespace_grant) | **DELETE** /namespace/grant | 
 *AdminApi* | [**remove_organization_member**](docs/AdminApi.md#remove_organization_member) | **POST** /organization/remove | 

sdk/python/src/docs/AdminApi.md

@@ -30,6 +30,7 @@ Method | HTTP request | Description
 [**list_namespaces**](AdminApi.md#list_namespaces) | **GET** /namespaces | 
 [**list_organization_members**](AdminApi.md#list_organization_members) | **POST** /organization/list | 
 [**list_organizations**](AdminApi.md#list_organizations) | **GET** /organizations | 
+[**remove_applied_limit_classes**](AdminApi.md#remove_applied_limit_classes) | **DELETE** /applied-limit-class | 
 [**remove_namespace_frontend_mapping**](AdminApi.md#remove_namespace_frontend_mapping) | **DELETE** /namespace/frontend/mapping | 
 [**remove_namespace_grant**](AdminApi.md#remove_namespace_grant) | **DELETE** /namespace/grant | 
 [**remove_organization_member**](AdminApi.md#remove_organization_member) | **POST** /organization/remove | 
@@ -2004,6 +2005,81 @@ This endpoint does not need any parameter.
 
 [[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
 
+# **remove_applied_limit_classes**
+> remove_applied_limit_classes(body=body)
+
+### Example
+
+* Api Key Authentication (key):
+
+```python
+import zrok_api
+from zrok_api.models.apply_limit_classes_request import ApplyLimitClassesRequest
+from zrok_api.rest import ApiException
+from pprint import pprint
+
+# Defining the host is optional and defaults to /api/v2
+# See configuration.py for a list of all supported configuration parameters.
+configuration = zrok_api.Configuration(
+    host = "/api/v2"
+)
+
+# The client must configure the authentication and authorization parameters
+# in accordance with the API server security policy.
+# Examples for each auth method are provided below, use the example that
+# satisfies your auth use case.
+
+# Configure API key authorization: key
+configuration.api_key['key'] = os.environ["API_KEY"]
+
+# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
+# configuration.api_key_prefix['key'] = 'Bearer'
+
+# Enter a context with an instance of the API client
+with zrok_api.ApiClient(configuration) as api_client:
+    # Create an instance of the API class
+    api_instance = zrok_api.AdminApi(api_client)
+    body = zrok_api.ApplyLimitClassesRequest() # ApplyLimitClassesRequest |  (optional)
+
+    try:
+        api_instance.remove_applied_limit_classes(body=body)
+    except Exception as e:
+        print("Exception when calling AdminApi->remove_applied_limit_classes: %s\n" % e)
+```
+
+
+
+### Parameters
+
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **body** | [**ApplyLimitClassesRequest**](ApplyLimitClassesRequest.md)|  | [optional] 
+
+### Return type
+
+void (empty response body)
+
+### Authorization
+
+[key](../README.md#key)
+
+### HTTP request headers
+
+ - **Content-Type**: application/zrok.v1+json
+ - **Accept**: Not defined
+
+### HTTP response details
+
+| Status code | Description | Response headers |
+|-------------|-------------|------------------|
+**200** | removed |  -  |
+**401** | unauthorized |  -  |
+**404** | account not found |  -  |
+**500** | internal server error |  -  |
+
+[[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
+
 # **remove_namespace_frontend_mapping**
 > remove_namespace_frontend_mapping(body=body)
 

sdk/python/src/test/test_admin_api.py

@@ -182,6 +182,12 @@ class TestAdminApi(unittest.TestCase):
         """
         pass
 
+    def test_remove_applied_limit_classes(self) -> None:
+        """Test case for remove_applied_limit_classes
+
+        """
+        pass
+
     def test_remove_namespace_frontend_mapping(self) -> None:
         """Test case for remove_namespace_frontend_mapping
 

sdk/python/src/zrok_api/api/admin_api.py

@@ -7141,6 +7141,279 @@ class AdminApi:
 
 
 
+    @validate_call
+    def remove_applied_limit_classes(
+        self,
+        body: Optional[ApplyLimitClassesRequest] = None,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> None:
+        """remove_applied_limit_classes
+
+
+        :param body:
+        :type body: ApplyLimitClassesRequest
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._remove_applied_limit_classes_serialize(
+            body=body,
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+            '200': None,
+            '401': None,
+            '404': None,
+            '500': None,
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        response_data.read()
+        return self.api_client.response_deserialize(
+            response_data=response_data,
+            response_types_map=_response_types_map,
+        ).data
+
+
+    @validate_call
+    def remove_applied_limit_classes_with_http_info(
+        self,
+        body: Optional[ApplyLimitClassesRequest] = None,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> ApiResponse[None]:
+        """remove_applied_limit_classes
+
+
+        :param body:
+        :type body: ApplyLimitClassesRequest
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._remove_applied_limit_classes_serialize(
+            body=body,
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+            '200': None,
+            '401': None,
+            '404': None,
+            '500': None,
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        response_data.read()
+        return self.api_client.response_deserialize(
+            response_data=response_data,
+            response_types_map=_response_types_map,
+        )
+
+
+    @validate_call
+    def remove_applied_limit_classes_without_preload_content(
+        self,
+        body: Optional[ApplyLimitClassesRequest] = None,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> RESTResponseType:
+        """remove_applied_limit_classes
+
+
+        :param body:
+        :type body: ApplyLimitClassesRequest
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._remove_applied_limit_classes_serialize(
+            body=body,
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+            '200': None,
+            '401': None,
+            '404': None,
+            '500': None,
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        return response_data.response
+
+
+    def _remove_applied_limit_classes_serialize(
+        self,
+        body,
+        _request_auth,
+        _content_type,
+        _headers,
+        _host_index,
+    ) -> RequestSerialized:
+
+        _host = None
+
+        _collection_formats: Dict[str, str] = {
+        }
+
+        _path_params: Dict[str, str] = {}
+        _query_params: List[Tuple[str, str]] = []
+        _header_params: Dict[str, Optional[str]] = _headers or {}
+        _form_params: List[Tuple[str, str]] = []
+        _files: Dict[
+            str, Union[str, bytes, List[str], List[bytes], List[Tuple[str, bytes]]]
+        ] = {}
+        _body_params: Optional[bytes] = None
+
+        # process the path parameters
+        # process the query parameters
+        # process the header parameters
+        # process the form parameters
+        # process the body parameter
+        if body is not None:
+            _body_params = body
+
+
+
+        # set the HTTP header `Content-Type`
+        if _content_type:
+            _header_params['Content-Type'] = _content_type
+        else:
+            _default_content_type = (
+                self.api_client.select_header_content_type(
+                    [
+                        'application/zrok.v1+json'
+                    ]
+                )
+            )
+            if _default_content_type is not None:
+                _header_params['Content-Type'] = _default_content_type
+
+        # authentication setting
+        _auth_settings: List[str] = [
+            'key'
+        ]
+
+        return self.api_client.param_serialize(
+            method='DELETE',
+            resource_path='/applied-limit-class',
+            path_params=_path_params,
+            query_params=_query_params,
+            header_params=_header_params,
+            body=_body_params,
+            post_params=_form_params,
+            files=_files,
+            auth_settings=_auth_settings,
+            collection_formats=_collection_formats,
+            _host=_host,
+            _request_auth=_request_auth
+        )
+
+
+
+
     @validate_call
     def remove_namespace_frontend_mapping(
         self,

specs/src/admin.yml

@@ -872,6 +872,32 @@
         description: account or limit class not found
       500:
         description: internal server error
+  delete:
+    tags:
+      - admin
+    security:
+      - key: []
+    operationId: removeAppliedLimitClasses
+    parameters:
+      - name: body
+        in: body
+        schema:
+          properties:
+            email:
+              type: string
+            limitClassIds:
+              type: array
+              items:
+                type: integer
+    responses:
+      200:
+        description: removed
+      401:
+        description: unauthorized
+      404:
+        description: account not found
+      500:
+        description: internal server error
 
 /applied-limit-class/list:
   post:

specs/zrok.yml

@@ -1096,6 +1096,32 @@ paths:
           description: account or limit class not found
         500:
           description: internal server error
+    delete:
+      tags:
+        - admin
+      security:
+        - key: []
+      operationId: removeAppliedLimitClasses
+      parameters:
+        - name: body
+          in: body
+          schema:
+            properties:
+              email:
+                type: string
+              limitClassIds:
+                type: array
+                items:
+                  type: integer
+      responses:
+        200:
+          description: removed
+        401:
+          description: unauthorized
+        404:
+          description: account not found
+        500:
+          description: internal server error
   
   /applied-limit-class/list:
     post:

ui/src/api/apis/AdminApi.ts

@@ -198,6 +198,10 @@ export interface ListOrganizationMembersRequest {
     body?: CreateOrganization201Response;
 }
 
+export interface RemoveAppliedLimitClassesRequest {
+    body?: ApplyLimitClassesRequest;
+}
+
 export interface RemoveNamespaceFrontendMappingOperationRequest {
     body?: RemoveNamespaceFrontendMappingRequest;
 }
@@ -1099,6 +1103,39 @@ export class AdminApi extends runtime.BaseAPI {
         return await response.value();
     }
 
+    /**
+     */
+    async removeAppliedLimitClassesRaw(requestParameters: RemoveAppliedLimitClassesRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/zrok.v1+json';
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["x-token"] = await this.configuration.apiKey("x-token"); // key authentication
+        }
+
+
+        let urlPath = `/applied-limit-class`;
+
+        const response = await this.request({
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+            body: ApplyLimitClassesRequestToJSON(requestParameters['body']),
+        }, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     */
+    async removeAppliedLimitClasses(requestParameters: RemoveAppliedLimitClassesRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.removeAppliedLimitClassesRaw(requestParameters, initOverrides);
+    }
+
     /**
      */
     async removeNamespaceFrontendMappingRaw(requestParameters: RemoveNamespaceFrontendMappingOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {