Disconnect app (revoke grant)
Disconnect an app: flip the grant to status=revoked, clear its refresh credential, and cascade-revoke every installation token (all teams) in one transaction, so the agent is cut off immediately. The envelope item is the post-action grant (it persists, revoked); result.revoked_sessions is the count cut. Idempotent (already-revoked → 0). 404 if the sid is not the caller’s own grant.
Contract:
- MCP tool
revoke_oauth_authorization, registry packagemcp.id/oauth_authorizations, mountid.access. - Operation
action, response envelopeaction. - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.
Authorizations
Access token issued by gtm.service.id. Its access_identity claim carries team_sid, actor_sid and actor_type, and that team scope is authoritative.
Team scope for tokens that do not carry one. Ignored when the token already names a team.
Path Parameters
OAuth authorization (grant) sid (id_oa_…).
18^id_oa_