---
title: "Meta Deauthorize"
method: POST
path: "/api/webhooks/meta/deauthorize"
tags: ["webhooks"]
---

# Meta Deauthorize

`POST /api/webhooks/meta/deauthorize`

## Request

- Base URL: `https://api.heymetra.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.heymetra.com/api/webhooks/meta/deauthorize`
- Auth: none declared

Somebody removed HeyMetra from their Facebook settings. Let the grant go.

Until this existed there was no path at all: `deauth_callback_url` was empty
on the Meta app, and nothing in the code base read a `signed_request`
(ZEISO-481). A customer who revoked the app at Facebook left a live-looking
connection here and a credential in the vault, and nobody was told. Our own
/data-protection/ page says disconnecting destroys the credential
immediately; this is the door that sentence did not cover, and Meta's
Platform Terms ask for the data to go when the access does.

UNVERIFIED IS NOT ACKNOWLEDGED. The whole message is the signature, and
nothing else in the request says who sent it — so an endpoint that answered
200 to an unsigned body would be an endpoint anybody could use to disconnect
a stranger's accounts. A refusal is 401 and stores nothing.

Meta wants 200 for a delivery it signed, including one that matches no
connection of ours: "we have nothing for this person" is a completed
instruction, not a failure, and an error would put the delivery back in
Meta's retry queue forever.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/heymetra/apis/heymetra-api.md) · [All operations](https://skmtc.dev/heymetra/apis/heymetra-api/llms.txt) · [OpenAPI document](https://skmtc.dev/heymetra/apis/heymetra-api/revisions/877b0f87d6d0?raw)