---
title: "Disconnect one MCP client as the Bearer actor"
method: POST
path: "/auth/v1/account/grants/revoke"
tags: ["Auth"]
---

# Disconnect one MCP client as the Bearer actor

`POST /auth/v1/account/grants/revoke`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/auth/v1/account/grants/revoke`
- Auth: API key in header `apikey` and HTTP bearer

Machine route (apikey + user Bearer; `auth.grants.revoke(id)` in @run402/functions). Ends one grant of the user identified by the token: its refresh token and every access token it issued are refused on the next request, so the client's next `/_run402/mcp` call gets the 401 sign-in challenge. Another user's grant, a browser session id, or an ended grant answers `revoked: false`. No recent sign-in is required.

## Request body

- object
  - `grant_id` string, uuid, required

## Response `200`

Revocation result; revoked is false when no live grant of this user matched.

- object
  - `ok` true, required
  - `revoked` boolean, required

## Other responses

- `400`: grant_id missing.
- `401`: Missing or invalid authentication. Run402-originated JSON bodies use the canonical ErrorEnvelope.

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)