---
title: "Disconnect app (revoke grant)"
method: POST
path: "/api/oauth-authorizations/{sid}/revoke"
tags: ["oauth_authorizations"]
---

# Disconnect app (revoke grant)

`POST /api/oauth-authorizations/{sid}/revoke`

## Request

- Base URL: `https://beta.getsales.io/id/v1`
- URL: `https://beta.getsales.io/id/v1/api/oauth-authorizations/{sid}/revoke`
- Auth: HTTP bearer and API key in header `Team-SID`

Disconnect an app or agent: the grant goes revoked, its refresh credential is cleared and every installation token in every workspace is revoked in one transaction, so it is cut off at once. The item is the revoked grant; result.revoked_sessions counts the tokens cut. Idempotent (already_revoked true, 0 sessions). 404 when the sid is not the caller's own grant.

Contract:
- MCP tool `revoke_oauth_authorization`, registry package `mcp.id/oauth_authorizations`, mount `id.access`.
- Operation `action`, response envelope `action`.
- Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.

## Path parameters

- `sid` string, required: OAuth authorization (grant) sid (id_oa_...).

## Response `200`

`action` success envelope.

- RevokeOauthAuthorizationResponse
  - `success` true, required
  - `operation` 'action', required
  - `action` string, required: kebab-case verb; matches the route segment.
  - `item` object, nullable, required
    - `sid` string, required: Grant sid (id_oa_...).
    - `user_sid` string, required: The account that consented (us_mb_...).
    - `oauth_client_sid` string, required: The connected app or agent (id_oc_...).
    - `team_scope_mode` 'selected' | 'all_my_teams', required: selected = the listed workspaces; all_my_teams = every workspace the user is in, now and later.
    - `consented_team_sids` string[], required: The workspaces in scope (ts_tm_...); empty under all_my_teams.
    - `permissions` string[], required: What the app may do, inside the client's ceiling.
    - `status` 'active' | 'revoked', required: active = tokens can be minted from it; revoked = disconnected.
    - `last_used_at` string, nullable, required: ISO 8601 UTC of the last token minted from the grant; null = never.
    - `created_at` string, required: ISO 8601 UTC (connected since).
    - `updated_at` string, required: ISO 8601 UTC.
  - `result` object, required
    - `revoked_sessions` integer, required: Installation tokens cut by this call.
    - `already_revoked` boolean, required: true: the grant was revoked before the call.
  - `meta` object, required
    - `trace_id` string, required: UUID v7; same 128-bit value as the X-Trace-Id header.
    - `span_id` string, required: 16 hex chars, root span of this request.
    - `timestamp` string, required: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
    - `duration_ms` integer, required: Server-side wall clock.
    - `team_sid` string, nullable: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends.
    - `actor_type` string, nullable: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends.

## Other responses

- `4XX`: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented.
- `5XX`: MCP error envelope with `error.code` internal_error or service_unavailable.

---

[API](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-id.md) - [All operations](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-id/llms.txt) - [OpenAPI document](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-id/revisions/95e48541fe85?raw)