---
title: "Revoke an OAuth client connection"
method: DELETE
path: "/api/connections/oauth/{client_id}"
tags: ["Connections"]
---

# Revoke an OAuth client connection

`DELETE /api/connections/oauth/{client_id}`

## Request

- Base URL: `https://api.engram.page`
- URL: `https://api.engram.page/api/connections/oauth/{client_id}`
- Auth: HTTP bearer

Revokes the refresh tokens for an OAuth client family (e.g. an MCP client) so it can no longer mint access tokens. Pass `family_id` to revoke ONE grant — a client the user authorized twice has two, and each is its own row in `GET /connections`. Omit it to disconnect the client entirely, which is what frees a connection-cap slot. `vault_id` is the older, coarser narrowing and is ignored when `family_id` is given: it revokes, whole, each of the client's grants that can reach that vault. A grant with per-vault levels counts as reaching it at read or write, and through its new-vaults policy; a grant that lists vaults without levels, when the vault is one of them; and an all-vaults grant, which reaches every vault. A revoked grant's access tokens stop working at once and its live sockets are disconnected. Session-auth only.

## Path parameters

- `client_id` string, required

## Query parameters

- `family_id` string
- `vault_id` string

## Response `204`

Revoked (empty body)

## Other responses

- `404`: No such connection

---

[API](https://skmtc.dev/engram/apis/engram-api.md) · [All operations](https://skmtc.dev/engram/apis/engram-api/llms.txt) · [OpenAPI document](https://skmtc.dev/engram/apis/engram-api/revisions/8c4c2eec29dc?raw)