Revoke a Grant or Connection

Choose the narrowest object that matches the intended outcome:

Revoke	Result
One Grant	Removes one Connector’s authority while preserving active sibling Grants.
GrantBundle	Removes the complete User-to-Application gateway authority root.
Connection	Disables that exact User-owned upstream account for every Grant pinned to it.

Revoke one Grant

As the owning User, list GET /api/v1/me/grant-bundles, select the exact root and Grant, then send:

DELETE /api/v1/me/grant-bundles/{grant_bundle_id}/grants/{grant_id}

The Grant becomes revoked, the root authority revision advances, and active siblings remain usable. If it was the final active Grant, Axec terminally revokes the root and its Refresh Family, if present.

To revoke all authority under the root, use:

DELETE /api/v1/me/grant-bundles/{grant_bundle_id}

Tenant administrators can revoke an offline root through the corresponding /api/v1/ws/{key}/offline-grant-bundles/{grant_bundle_id} operation.

Revoke a Connection

As the owning User, select the exact Connection from GET /api/v1/me/connections, including its status, then send:

DELETE /api/v1/me/connections/{connection_id}

The Connection becomes revoked. Every Grant pinned to that identity becomes unusable. Reconnecting creates a new Connection ID; old Grants do not inherit it and require new consent.

Use the Console or the documented SDK resource so browser session and CSRF requirements are handled correctly. Never choose an object by display name alone.

Verify live removal

1. Repeat a previously allowed tools/list, tools/call, mediated proxy, or credential-exchange request with the still-unexpired gateway bearer.
2. Confirm Axec denies the revoked authority before upstream contact.
3. Read the GrantBundle or Connection history and confirm the exact object is non-active.
4. Inspect correlated evidence for the revocation and denied follow-up request.

Bearer signature validity does not preserve removed authority: Axec reloads current state on every protected request. Revocation cannot retract an upstream access token that was already released before its provider expiry; mediated MCP and proxy execution provide stronger per-request enforcement.