In order to delete a user enrollment using DELETE /d2l/api/lp/(version)/enrollments/orgUnits/(orgUnitId)/users/(userId)
(or the action that removes the enrollment by specifying user ID first and then org unit ID), the calling user context must have permission to:
See user enrollments in the first place (Users>View User Enrollments), at the organization level
Search for the user role type(Users>Search for RoleType), at the organization level
Enroll the user role type (Users>Enroll RoleType), at the organization level
Since the various enrollments
actions are considered administrator-type actions, they use the "Users" role permissions at the organization level.
D2L has not currently provided classlist level API actions to unenroll users (so user contexts that would be able to un-enroll users from the classlist tool, within the web UI, often cannot do so using the Learning Framework API, unless the calling user's role has the organization-level permissions required to unenroll users).