DELETE · Bearer

DELETE /api/v1/oauth/grants/:client_id

All endpoints · Markdown

Summary

Revoke one connected app. Deletes every token and every unused authorization code for this account and client in one transaction. The client registration stays, so the app can connect again. Returns object oauth_grant with id, revoked true, and tokens_revoked. Those access tokens then return 401, and their refresh tokens fail at /oauth/token. Other apps and API keys stay valid. Nothing to revoke returns 404 oauth_grant_not_found. Requires key_write. An inbox-scoped key receives 403 permission_denied. MCP: cooper_revoke_oauth_grant.

Request

This call has no JSON body.

Response

HTTP 200. Sample values illustrate the schema.

{
  "object": "oauth_grant",
  "id": "inb_example",
  "revoked": true,
  "tokens_revoked": 1
}

Errors

  • HTTP 404 oauth_grant_not_found
  • HTTP 403 permission_denied

Idempotency

This route does not document Idempotency-Key or client_id.