---
title: "Revoke a scoped Agent Connection credential"
method: POST
path: "/credits/agent-connections/{connectionId}/revoke"
tags: ["Authentication", "MCP"]
---

# Revoke a scoped Agent Connection credential

`POST /credits/agent-connections/{connectionId}/revoke`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/agent-connections/{connectionId}/revoke`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Idempotently revokes the lcac_ credential. A scoped secret key may automate this Agent Connection operation; human callers require owner/admin step-up.

## Path parameters

- `connectionId` string, uuid, required

## Headers

- `X-Locus-Step-Up` string, password

## Response `200`

Connection is revoked

- AgentConnectionEnvelope
  - `success` unknown, required
  - `connection` AgentConnection, required
    - `id` string, uuid, required
    - `name` string, required
    - `status` 'active' | 'expired' | 'revoked', required
    - `mode` 'platform' | 'end_user', required
    - `externalUserId` string: Case-sensitive immutable ID in the tenant namespace. Prefer an identity-provider subject, not an email address.
    - `tools` object
      - `enable` string[], nullable
    - `pricing` CredentialPricingPolicy
      - `markupBps` integer
      - `flatMarkupUsdc` string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
      - `endpoints` object
    - `maxCreditsPerCall` string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
    - `maxCreditsPerLoop` string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
    - `keyPrefix` string, required
    - `expiresAt` string, date-time, required
    - `revokedAt` string, date-time, nullable
    - `rotatedAt` string, date-time, nullable
    - `lastUsedAt` string, date-time, nullable
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `mcp` object, required
      - `url` string, uri, required
      - `headers` object
    - `credential` string: Present only in create/rotate responses and shown once

## Other responses

- `401`: Missing, invalid, expired, or revoked management credential
- `403`: The authenticated management credential lacks one or more required scopes
- `404`: Connection not found in this workspace

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)