Disconnect an app or agent: the grant goes revoked, its refresh credential is cleared and every installation token in every workspace is revoked in one transaction, so it is cut off at once. The item is the revoked grant; result.revoked_sessions counts the tokens cut. Idempotent (already_revoked true, 0 sessions). 404 when the sid is not the caller's own grant.

Contract:

• MCP tool revoke_oauth_authorization, registry package mcp.id/oauth_authorizations, mount id.access.
• Operation action, response envelope action.
• Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.