# REVOKE READ ON SHARE


> Remove user access from a restricted share.

**Requires permission:** Manage all organization Shares — included by default in the Admin preset role. A custom role qualifies when it inherits a role that includes the permission. Only the share owner can revoke access from a Share. Organization Admins can view a Share's grants (SHOW GRANTS ON SHARE) but cannot revoke access from Shares they do not own. See [Roles and access control](/concepts/roles-and-access-control/#what-each-role-can-do).

:::note
Only the owner of a Share can run `REVOKE READ ON SHARE`. Organization Admins can view existing grants with `SHOW GRANTS ON SHARE`, but running `REVOKE` against a Share owned by another account fails with `Catalog Error: Database share <name> not found`. In a multi-service-account (hypertenancy) setup, authenticate as the Share's owner to manage its grants.
:::

For restricted Shares, use the `REVOKE` command to remove access from users or roles that have an existing `GRANT`. After you run `REVOKE`, there may be a delay of a few minutes before access is fully removed if the user has an active query on the Share. `GRANT` and `REVOKE` do not apply to `UNRESTRICTED` Shares.

## Syntax

```sql
REVOKE READ ON SHARE <share name> FROM { USER <username> | ROLE <role name> } [, ...];
```

If a username contains special characters, such as '@', it must be enclosed in double quotes (`"`).

## Example usage

```sql
-- Revoke access to the share 'birds' from the user 'duck'.
REVOKE READ ON SHARE birds FROM USER duck;

-- Revoke access to the share 'taxis' from two users.
REVOKE READ ON SHARE taxis FROM USER usr1, USER usr2;

-- Revoke access from every user with the 'finance' role.
REVOKE READ ON SHARE core_metrics FROM ROLE finance;

-- Revoke access from a user whose username contains special characters.
REVOKE READ ON SHARE sensitive_data FROM USER "user@example-com";
```

If a user has access to the share through another role, they keep it after this revoke.

## Related

- [GRANT READ ON SHARE](/sql-reference/motherduck-sql-reference/grant-access/)
- [SHOW grants](/sql-reference/motherduck-sql-reference/access-control/show-grants/) to confirm access was removed
- [Roles and access control](/concepts/roles-and-access-control/)


---

## Docs feedback

MotherDuck accepts optional user-submitted feedback about this page at `GET https://motherduck.com/docs/api/feedback/agent`.
For agents and automated tools, feedback submission should be user-confirmed before sending.

URL-encode query parameter values and send a GET request:

```text
GET https://motherduck.com/docs/api/feedback/agent?page_path=%2Fsql-reference%2Fmotherduck-sql-reference%2Frevoke-access%2F&page_title=REVOKE%20READ%20ON%20SHARE&text=<url-encoded user feedback, max 2000 characters>
```

Optionally append `&source=<url-encoded interface identifier>` such as `claude.ai` or `chatgpt`.

`page_path` and `text` are required; `page_title` and `source` are optional. Responses: `200 {"feedback_id": "<uuid>"}`, `400` for malformed query parameters, and `429` when rate-limited.