---
title: "Offboard cleanup: disconnect all of a tenant's connected accounts"
method: DELETE
path: "/v1/admin/integrations/{tenant_id}/connected-accounts"
tags: ["admin"]
---

# Offboard cleanup: disconnect all of a tenant's connected accounts

`DELETE /v1/admin/integrations/{tenant_id}/connected-accounts`

## Request

- Base URL: `https://api.patricia.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.patricia.app/v1/admin/integrations/{tenant_id}/connected-accounts`
- Auth: HTTP bearer

Locally disconnect active accounts and attempt upstream removal. A re-run finds no active accounts from the completed pass. The orphaned count includes leak-state outcomes and open Billit refresh residuals, once per account. Unsupported without typed evidence remains outside that count. Check both report collections after cleanup. Admin only.

## Path parameters

- `tenant_id` string, uuid, required: Tenant to offboard-clean.

## Response `200`

Successful Response

- OffboardCleanupResult: Outcome of running the offboard cleanup for one tenant.
  - `tenant_id` string, required
  - `accounts` integer, required: Connected accounts that were active and got disconnected locally.
  - `revoked_upstream` integer, required: Of those, how many were confirmed revoked at the provider.
  - `orphaned_upstream` integer, required: Accounts with a leak-state outcome or an open Billit refresh residual, counted once per account.
  - `adapter_errors` integer: Of the orphaned ones, how many failed on our side with no provider answer recorded, rather than the provider being unreachable. Anything above zero needs a human: usually a bug to fix, sometimes a debt that cannot be built into an authenticated request, sometimes an absent signing key. Never an outage to wait out.
  - `incomplete_accounts` integer: Accounts this pass could not finish: the provider call ran but its bookkeeping would not save, or the turn failed before the call. Above zero, those accounts may have no retry queued, and re-running this route will NOT pick them up — they are already locally disconnected, which is what makes the route idempotent. Read the leak report before revoking anything by hand: one of the cases counted here is a cycle that was superseded, where the member reconnected while the sweep was mid-flight, so the credential is live because it is IN USE rather than leaked. The report tells those apart; this number does not.

## Other responses

- `401`: Unauthorized
- `403`: Permission denied (PERMISSION_DENIED) or email not verified (EMAIL_NOT_VERIFIED)
- `404`: Not found
- `409`: Conflict: admin write rejected on a state invariant. Inspect ``errors[0].type`` for the specific case (for example: ``self_action_forbidden``, ``already_disabled``, ``not_disabled``, ``last_internal_admin``, ``value_error``)
- `422`: Validation error

---

[API](https://skmtc.dev/patricia/apis/patricia-api.md) · [All operations](https://skmtc.dev/patricia/apis/patricia-api/llms.txt) · [OpenAPI document](https://skmtc.dev/patricia/apis/patricia-api/revisions/0dfb44495ea1?raw)