# rpk security acl delete

> For the complete documentation index, see [llms.txt](https://docs.redpanda.com/llms.txt). Component-specific: [cloud-data-platform-full.txt](https://docs.redpanda.com/cloud-data-platform-full.txt)

---
title: rpk security acl delete
latest-operator-version: v26.2.1
latest-console-tag: v3.10.0
latest-connect-version: 4.105.0
latest-redpanda-tag: v26.2.1
docname: rpk/rpk-security/rpk-security-acl-delete
page-component-name: cloud-data-platform
page-version: master
page-component-version: master
page-component-title: Cloud
page-relative-src-path: rpk/rpk-security/rpk-security-acl-delete.adoc
page-edit-url: https://github.com/redpanda-data/cloud-docs/edit/main/modules/reference/pages/rpk/rpk-security/rpk-security-acl-delete.adoc
description: Delete ACLs. See the <code>rpk security acl</code> help text for a full write up on ACLs.
page-git-created-date: "2024-07-25"
page-git-modified-date: "2026-08-11"
---

<!-- Source: https://docs.redpanda.com/cloud-data-platform/reference/rpk/rpk-security/rpk-security-acl-delete.md -->

Delete ACLs.

See the `rpk security acl` help text for a full write up on ACLs. Delete flags work in a similar multiplying effect as creating ACLs, but delete is more advanced: deletion works on a filter basis. Any unspecified flag defaults to matching everything (all operations, or all allowed principals, etc). To ensure that you do not accidentally delete more than you intend, this command prints everything that matches your input filters and prompts for a confirmation before the delete request is issued. Anything matching more than 10 ACLs doubly confirms.

As mentioned, not specifying flags matches everything. If no resources are specified, all resources are matched. If no operations are specified, all operations are matched. You can also opt in to matching everything with `any`: `--operation` any matches any operation.

The `--resource-pattern-type`, defaulting to `any`, configures how to filter. resource names: \* `any` returns exact name matches of either prefixed or literal pattern type \* `match` returns wildcard matches, prefix patterns that match your input, and literal matches \* `prefix` returns prefix patterns that match your input (prefix `fo` matches `foo`) \* `literal` returns exact name matches

## [](#usage)Usage

```bash
rpk security acl delete [flags]
```

## [](#examples)Examples

This section provides examples of how to use `rpk security acl delete`.

### [](#delete-all-permissions-for-a-user)Delete all permissions for a user

Delete all permissions to user bar on topic `foo` and group `g`:

```bash
rpk security acl delete --allow-principal bar --operation all --topic foo --group g
```

### [](#delete-specific-acl-from-a-role)Delete specific ACL from a role

In a scenario that 2 ACLs were created for the same role (red-role), 1 that allows access to topic foo, 1 that deny access to topic bar:

```bash
rpk security acl create --topic foo --operation all --allow-role red-role
rpk security acl create --topic bar --operation all --deny-role red-role
```

It’s possible to delete one of the roles:

```bash
rpk security acl delete --topic foo --operation all --allow-role red-role
```

## [](#flags)Flags

| Value | Type | Description |
| --- | --- | --- |
| --allow-host | stringSlice | Allowed host ACLs to remove (repeatable). |
| --allow-principal | stringSlice | Allowed principal ACLs to remove (repeatable). |
| --allow-role | stringSlice | Allowed role to remove this ACL from (repeatable). |
| --cluster | bool | Whether to remove ACLs for the cluster. |
| --deny-host | stringSlice | Hosts from which access will be denied (repeatable). |
| --deny-principal | stringSlice | Denied principal ACLs to remove (repeatable). |
| --deny-role | stringSlice | Denied role to remove this ACL from (repeatable). |
| -d, --dry | bool | Dry run: validate what would be deleted. |
| --format | string | Output format (json,yaml,text,wide,help). (New in v26.2.1) |
| --group | stringSlice | Group to remove ACLs for (repeatable). |
| --no-confirm | bool | Disable confirmation prompt. |
| --operation | stringSlice | Operation to remove (repeatable). |
| -f, --print-filters | bool | Print the filters that were requested (failed filters are always printed). |
| --registry-global | bool | Whether to remove ACLs for the schema registry. |
| --registry-subject | stringSlice | Schema Registry subjects to remove ACLs for (repeatable). |
| --resource-pattern-type | string | Pattern to use when matching resource names (any, match, literal, or prefixed). |
| --topic | stringSlice | Topic to remove ACLs for (repeatable). |
| --transactional-id | stringSlice | Transactional IDs to remove ACLs for (repeatable). |

## [](#global-flags)Global flags

| Value | Type | Description |
| --- | --- | --- |
| --config | string | Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml. |
| -X, --config-opt | stringArray | Override rpk configuration settings; -X help for detail or -X list for terser detail. |
| --ignore-profile | bool | Ignore rpk.yaml and redpanda.yaml; use default settings. |
| --profile | string | rpk profile to use. |
| -v, --verbose | bool | Enable verbose logging. |