---
title: "Unlink a node from the signed-in account"
method: POST
path: "/api/nodes/{node_id}/unlink"
tags: ["nodes"]
---

# Unlink a node from the signed-in account

`POST /api/nodes/{node_id}/unlink`

## Request

- Base URL: `https://app.nerdit.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://app.nerdit.ai/api/nodes/{node_id}/unlink`
- Auth: none declared

Revoke a node the session owns and its credentials, then tell the relay.

The cascade runs under the node's own compare-and-set and inside the
same transaction, so there is no moment in which the node is unlinked
while a connector's refresh family still reads as live. It is
bookkeeping rather than the thing that stops the access — every
credential path re-reads the node row on every presentation — but it is
what keeps ``/security`` truthful, what lets the purges reclaim the
rows, and what writes the per-subject audit detail underneath this
route's ``NODE_UNLINK`` umbrella (plan D-P6.2/D-P6.12).

The credentials' *streams* are ended after that transaction commits,
alongside the relay tombstone rather than inside the cascade: a
``close_stream`` frame survives the rollback of the transaction that
sent it, so a retryable transaction must not send one. The consumers are
killed before the ``revoke_node`` frame so that what they are told is
``access_revoked`` rather than whatever a dropped tunnel synthesises.

## Path parameters

- `node_id` string, uuid, required

## Response `204`

Successful Response

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `422`: Validation Error

---

[API](https://skmtc.dev/nerdit/apis/nerdit-cloud-web.md) · [All operations](https://skmtc.dev/nerdit/apis/nerdit-cloud-web/llms.txt) · [OpenAPI document](https://skmtc.dev/nerdit/apis/nerdit-cloud-web/revisions/06e3b44b58be?raw)