---
title: "Record a confirmed kill on an abandoned upstream revoke"
method: POST
path: "/v1/admin/integrations/accounts/{account_id}/abandoned-revoke-clearances"
tags: ["admin"]
---

# Record a confirmed kill on an abandoned upstream revoke

`POST /v1/admin/integrations/accounts/{account_id}/abandoned-revoke-clearances`

## Request

- Base URL: `https://api.patricia.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.patricia.app/v1/admin/integrations/accounts/{account_id}/abandoned-revoke-clearances`
- Auth: HTTP bearer

Takes an account off the COGS orphan report when its upstream revoke was never attempted and nothing owns a retry. That is the crash-window row a disconnect leaves if the process dies between the local commit and the provider call, which the leak report shows as retry_ownership 'unowned'. Operator-only and deliberately manual: the route performs NO provider call, it writes down the answer you give it, so answering true without having killed the credential removes a live charge from the one report that would have shown it. Matches only a soft-deleted, revoked, attempt_pending row that is owed no live outbox debt and is older than the abandonment floor. That floor bounds an ordinary in-flight disconnect; it does NOT bound a tenant offboard, whose serial provider loop grows with the account count, so wait for a known offboard to finish before acting on its accounts. It never writes status_code or deleted_at, so it cannot reactivate an account or lift a reconnect fence, and a late disconnect still completes over it. Internal admin users only.

## Path parameters

- `account_id` string, uuid, required: Connected account abandoned at attempt_pending.

## Request body

- AbandonedRevokeClearance: The one fact this route records: the operator watched the credential die at the provider. Required rather than defaulted, and the only accepted answer is ``true``. This route writes a money statement and nothing else, so a default would answer that question on the operator's behalf, and ``false`` asks it to record a confirmation nobody made. There is deliberately no "I accept this leak" arm, unlike the dead-letter clearance. That route offers one because it must lift an access fence either way; here the row is already exactly what an accepted leak looks like, so accepting one is the act of doing nothing.
  - `upstream_confirmed_revoked` boolean, required: True when the operator verified in the provider's own console that the credential is gone. False records nothing and clears nothing, because an unconfirmed abandoned row already reports itself: kill the credential first, then call this.

## Response `200`

Successful Response

- AbandonedRevokeClearanceResult: What the operator's clearance did. ``cleared`` is exact. ``refusal`` says which of four conditions stopped it, and each one is a different next action: nothing to do, kill it at the provider first, wait for a worker, or wait for a disconnect. Reported rather than raised, so a double-click is an honest no-op.
  - `account` string, required
  - `tenant_id` string, required
  - `cleared` boolean, required: False when the clearance did not take; see ``refusal`` for why.
  - `refusal` 'upstream_not_confirmed' | 'not_abandoned' | 'live_debt_exists' | 'too_recent': Why an abandoned-revoke clearance did not take. DERIVED at the point of refusal, never stored. - ``UPSTREAM_NOT_CONFIRMED``: the request itself declined to confirm the kill. This route only records a confirmation, so there was nothing to write. Kill the credential in the provider's own console first, then call again. - ``NOT_ABANDONED``: the row is not an abandoned revoke. It is live, or it already carries an outcome, or an earlier clearance already recorded one. Nothing to do. - ``LIVE_DEBT_EXISTS``: a non-terminal outbox debt is still owed on the credential, so a worker may yet kill it. The leak report shows this account as ``owned``. Wait for that debt to settle. - ``TOO_RECENT``: the row is abandoned in shape but too young to be treated as abandoned in fact. A disconnect commits this exact marker BEFORE it calls the provider, so a call that is still running looks identical. Wait, then re-run the leak report.
  - `still_reported_as_orphaned` boolean, required: True when the account remains on the COGS orphan report, either because the row was not this route's to clear or because it never reached the write.

## Other responses

- `401`: Unauthorized
- `403`: Permission denied (PERMISSION_DENIED) or email not verified (EMAIL_NOT_VERIFIED)
- `404`: Not found
- `409`: Conflict: admin write rejected on a state invariant. Inspect ``errors[0].type`` for the specific case (for example: ``self_action_forbidden``, ``already_disabled``, ``not_disabled``, ``last_internal_admin``, ``value_error``)
- `422`: Validation error

---

[API](https://skmtc.dev/patricia/apis/patricia-api.md) · [All operations](https://skmtc.dev/patricia/apis/patricia-api/llms.txt) · [OpenAPI document](https://skmtc.dev/patricia/apis/patricia-api/revisions/0dfb44495ea1?raw)