---
title: "Operator: disconnect one connected app of a person"
method: DELETE
path: "/api/ops/users/{userId}/grants/{grantId}"
tags: ["Operator"]
---

# Operator: disconnect one connected app of a person

`DELETE /api/ops/users/{userId}/grants/{grantId}`

## Request

- Base URL: `https://tre-app.com`
- URL: `https://tre-app.com/api/ops/users/{userId}/grants/{grantId}`
- Auth: one of:
  - API key in cookie `__Secure-authjs.session-token`
  - API key in cookie `authjs.session-token`

Operator console only: requires the web session of an address in the operator allowlist of this installation, sent from the application itself. Every other signed-in caller and every valid Bearer token receives 404 NOT_FOUND, whether or not this installation has an operator configured; a caller with no valid credential receives 401, as on every route. Recorded in the operator log. Revokes the grant, every access token it issued and its refresh tokens. The body gives the reason, from a closed list, and may give a reference: a ticket or card key, never an address. A grant that is not this person’s or is already revoked answers 404.

## Request body

- OpsCredentialRevoke
  - `reasonCode` 'security_incident' | 'customer_request' | 'acceptable_use', required
  - `reference` string

## Response `204`

No content

## Other responses

- `400`: Invalid request
- `401`: Unauthenticated
- `403`: The request did not come from the application’s own origin
- `404`: Not the operator, or no such object
- `409`: Conflict
- `429`: Rate limited
- `500`: Internal server error
- `503`: Temporarily unavailable

---

[API](https://skmtc.dev/tre-app/apis/tre-rest-api.md) · [All operations](https://skmtc.dev/tre-app/apis/tre-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tre-app/apis/tre-rest-api/revisions/26a7187a05fc?raw)