Docs
OverviewGuidesZero & MCPAPI referenceChangelog
OAuth

Disconnect App

Revoke the grant and every token of it at once (the app must ask for consent again). Your own apps, or any for admins. Audited as `oauth.revoked`.

API key access

Not available to API keys or connected apps: only a signed-in person can call this route.
DELETE/api/v1/workspaces/current/connected-apps/{grant_id}

Authorization

AuthorizationBearer <token>

Access token from /api/v1/auth/login, or an API key (ro_pat_..., RO-176) from /api/v1/workspaces/current/api-keys: the key implies its workspace and needs the route's scope. MCP connectors (/api/v1/mcp only) may use an OAuth access token (ro_oat_..., RO-284).

In: header

Path Parameters

grant_idstring
Formatuuid

Header Parameters

X-Workspace-Id?string | null

Id of the workspace to act on (must be a member).

Response Body

curl -X DELETE "http://localhost:8000/api/v1/workspaces/current/connected-apps/497f6eca-6276-4993-bfeb-53cbbbba6f08" \  -H "X-Workspace-Id: string"
Empty
Empty
Empty
{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "input": null,
      "ctx": {}
    }
  ]
}

Decide Consent Request

Approve (a grant for `workspace_id` and a one-time code, 5 minutes) or deny. Granting `admin` needs the admin role; a suspended workspace can't be connected (403 `workspace_suspended`). Audited as `oauth.granted`.

Get Consent Request

What a signed authorization request asks for: the app, where the browser returns, the scopes, and the signed-in user's workspaces. 400 `invalid_request` for a bad or expired request.