Removes the access of one person of the organization users list to the organization's workspaces in the current region, in one transaction. id_or_email finds the person as in organization-users-get. The removal deletes the direct workspace roles, the direct grants on resources inside those workspaces, also the owner grants on resources, the user group memberships and the pending memberships of the email, the pending workspace and project invitations, and the pending and seat-denied assignments. It revokes the API keys of the person that reach a workspace where it revokes the person's role, as the API keys of the users list show them. A key that also reaches workspaces of another organization stops there too. The owner role of a workspace stays. The account, the login and the organization roles stay. A person whom a customer's directory pushed stays in the list with the status no_access, and gets no default landing at the first login. The removal is recorded with the caller as the remover. An owner of a workspace of the organization answers 409 with the code owns_workspaces and the ids of those workspaces in details.conflicts, and nothing changes. A person that the list does not show, or with no access entry, answers 404. Requires organization administration permission.