---
title: "Revoke a connected app"
method: POST
path: "/oauth-grants/{id}/revoke"
tags: ["Organization settings"]
---

# Revoke a connected app

`POST /oauth-grants/{id}/revoke`

## Request

- Base URL: `https://api.primitive.dev/v1`
- URL: `https://api.primitive.dev/v1/oauth-grants/{id}/revoke`
- Auth: HTTP bearer

Revoke one connected app for the whole organization. Where the app has revocation rights on, only the person who connected it, an owner or an admin may revoke it. Scheduled and repeating mail it created is stopped.

Person only: a dashboard session. The person's role must hold oauth_grants:manage. API keys, agent connection keys and agents are refused.

## Path parameters

- `id` string, required

## Headers

- `Idempotency-Key` string

## Response `200`

Success

- object
  - `success` true, required
  - `data` OrgSettingsRevokeOAuthGrantResult, required
    - `id` string, required
    - `kind` string, required
    - `revoked` true, required

## Other responses

- `400`: Invalid request parameters
- `401`: Invalid or missing API key
- `403`: Authenticated caller lacks permission for the operation
- `404`: Resource not found
- `429`: Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.

---

[API](https://skmtc.dev/primitive/apis/primitive-api.md) - [All operations](https://skmtc.dev/primitive/apis/primitive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/primitive/apis/primitive-api/revisions/bce409c97acb?raw)