Revoke an OAuth client connection

DELETE

/connections/oauth/{client_id}

const url = 'https://api.engram.page/connections/oauth/example';
const options = {method: 'DELETE', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request DELETE \
  --url https://api.engram.page/connections/oauth/example \
  --header 'Authorization: Bearer <token>'

Revokes the refresh tokens for an OAuth client family (e.g. an MCP client) so it can no longer mint access tokens. Pass family_id to revoke ONE grant — a client the user authorized twice has two, and each is its own row in GET /connections. Omit it to disconnect the client entirely, which is what frees a connection-cap slot. vault_id is the older, coarser narrowing and is ignored when family_id is given: it revokes, whole, each of the client’s grants that can reach that vault. A grant with per-vault levels counts as reaching it at read or write, and through its new-vaults policy; a grant that lists vaults without levels, when the vault is one of them; and an all-vaults grant, which reaches every vault. A revoked grant’s access tokens stop working at once and its live sockets are disconnected. Session-auth only.

Authorizations

bearerAuth

Parameters

Path Parameters

client_id

required

string

OAuth client id

Query Parameters

family_id

string

Revoke only this grant lineage

vault_id

string

Revoke only the grants that can reach this vault, all-vaults grants included

Responses

204

Revoked (empty body)

404

No such connection

application/json

MessageError

object

error

required

string

Example

{
  "error": "not found"
}