Revoke a Connection
DELETE /v1/connections/{connection_id}
| Property | Value |
|---|---|
| Operation | revoke_connection |
| Group | Connections |
| Scope | integrations:write |
| Route class | control |
| Idempotency | No Idempotency-Key |
| Audit | Audited integrations.connection.revoke (mutation) |
| Released in | 1.60.0 |
| Phase 0 host | Served (the hosted api pins 1.65.0) |
Revokes the Connection at the revision If-Match names and answers it revoked (1.60.0; integrations.md section 7). The invalidation is published on the cell's Redis at once, so a grant that still names the Connection fails with connection_not_active; a leased task calls the vendor's revocation endpoint where one exists, then the sealed secrets are destroyed. Revoked is terminal: a second revocation is connection_revoked. Writes the event connection.revoked.
Request
Set VOCAL_API to the base URL of your API and VOCAL_API_KEY to an API key with the integrations:write scope (Authentication and keys). Replace each placeholder, such as agt_... or <name>, with your own value.
curl -X DELETE "$VOCAL_API/v1/connections/con_..." \
-H "Authorization: Bearer $VOCAL_API_KEY" \
-H 'If-Match: "1"'const response = await fetch(`${process.env.VOCAL_API}/v1/connections/con_...`, {
method: 'DELETE',
headers: {
Authorization: `Bearer ${process.env.VOCAL_API_KEY}`,
'If-Match': '"1"',
},
});
console.log(response.status, await response.text());import os
import requests
response = requests.delete(
f"{os.environ['VOCAL_API']}/v1/connections/con_...",
headers={
"Authorization": f"Bearer {os.environ['VOCAL_API_KEY']}",
"If-Match": '"1"',
},
)
print(response.status_code, response.text)Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
connection_id | path | ConnectionId | yes | The id of a Connection: con_ and the row's UUIDv7 in 26 Crockford base32 characters. Opaque and safe to log. |
if-match | header | string | yes | The revision the change was made against, quoted as the ETag returns it, or * to overwrite. |
Responses
| Status | Content type | Shape | Error codes |
|---|---|---|---|
200 | application/json | Connection | |
400 | application/json | ErrorEnvelope | invalid_request |
401 | application/json | ErrorEnvelope | unauthenticated |
403 | application/json | ErrorEnvelope | forbidden, org_suspended |
404 | application/json | ErrorEnvelope | not_found |
409 | application/json | ErrorEnvelope | connection_revoked |
412 | application/json | ErrorEnvelope | revision_mismatch |
428 | application/json | ErrorEnvelope | precondition_required |
429 | application/json | ErrorEnvelope | rate_limited |
500 | application/json | ErrorEnvelope | internal_error |
Fields of the 200 answer
The shape is Connection.
| Field | Type | Required | Description |
|---|---|---|---|
allowed_environments | array of Environment | yes | The environments whose runs may use it; live only by default. A test run against a Connection that does not allow test executes the Connector's mock (integrations.md section 3). |
auth_strategy | ConnectionAuthStrategy | yes | |
authorized_at | Timestamp or null | yes | |
base_url | ConnectionBaseUrl or null | yes | |
connector_id | ConnectorId or null | yes | The Connector; null for an MCP server. |
connector_major | integer or null | yes | The major version of the Connector's manifest the Connection pins; null for an MCP server. |
created_at | Timestamp | yes | |
enabled_tools | array of ConnectorToolName | yes | The Connector's tools the Organization allows, which set the scopes requested (integrations.md section 10); empty for an MCP server, whose registration's allowed_tools govern. |
external_account | string or null | yes | The external account authorized (a tenant id, an instance URL); null before. |
granted_scopes | array of VendorScope | yes | The scopes the vendor granted at the last authorization; empty before. |
id | ConnectionId | yes | |
mcp_server_id | McpServerId or null | yes | The MCP server registration whose credential the Connection holds; null for a Connector. |
name | ConnectionName | yes | |
object | "connection" | yes | |
organization_id | OrganizationId | yes | |
origin | ConnectionOrigin | yes | |
phi_attestation | ConnectionPhiAttestation or null | yes | The PHI attestation, or null; only an attested Connection may receive PHI. |
requested_scopes | array of VendorScope | yes | The union of the scopes of enabled_tools; nothing more is requested. |
revision | integer | yes | Counts writes to the Connection; returned as the ETag and required in If-Match. |
revoked_at | Timestamp or null | yes | |
sandbox | boolean | yes | True for a vendor sandbox, which may allow test; a test Call never books a real appointment. |
secret_hint | string or null | yes | The last characters of the stored key or token, or null; never the secret. |
secret_version | integer | yes | Counts the secrets stored; 0 before the first. A refresh write-back compares and sets it. |
sender | ConnectionSender or null | yes | The sender of a messaging Connection; null otherwise. |
status | ConnectionStatus | yes | |
status_reason | ConnectionStatusReason or null | yes | Null while active. |
updated_at | Timestamp | yes |