Remove member

Removes a member from the organization. Irreversible: revokes the member's access to this organization immediately. Re-adding them means a fresh invite, and their roles and team memberships are not restored. Their connections are always deleted (with their stored credentials); a connection_actions entry saying transfer is refused with 400 connection_transfer_removed. To keep what used a connection working, name a replacement in connection_replacements: before the old connection is deleted, every toolbox entry and other member's synthetic tool step that names it is rewritten onto the replacement (toolbox entries are re-stamped with you as delegator). A replacement must be the same connector, active, not the leaver's, and usable by you (400 replacement_* otherwise) — the preflight's replacement_candidates are exactly those. Everything else they own goes to a person (target_user_id) or a team (target_team_id: the team's first active admin owns it and the team gets an edit share; 400 team_has_no_admin when nobody can) per row, or to one bulk defaults.transfer_to_user_id / transfer_to_team_id. A shared owned resource with no decision refuses with 409 <kind>_need_resolution. Requires member:manage. A browser session must also pass a fresh step-up reauthentication in the app (without it the call answers 428 step_up_required). An organization API token is not challenged. The step-up check runs last, after every resolution refusal above, so an admin never re-authenticates only to be told the removal needs decisions first. Custom connectors the member owns are resolved by connector_actions (transfer only — never delete, and never released: an ownerless connector is a legacy state). EVERY owned connector, private or shared, needs a new owner: one with no entry is refused with 409 connectors_need_resolution unless defaults.transfer_to_user_id names a bulk recipient. A body that still sends action: "release" or defaults.release_connectors is refused with 400 connector_release_removed (the message says what to send instead). Should the member still own a connector when the removal reaches the org itself, that is 409 member_owns_connectors. The response applied counts include connectors.