Disconnect a subject from an MCP server

Deletes a subject’s OAuth token or admin-installed per-subject credential override for an MCP server. Permissions: callers with MANAGE_MCP_SERVER (MCP managers) may revoke any supported subject; other callers may only revoke their own auth.

DELETE /api/svc/v1/mcp/{mcpServerId}/auth

Disconnect a subject from an MCP server

cURL

curl --request DELETE \
  --url https://{controlPlaneURL}/api/svc/v1/mcp/{mcpServerId}/auth \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "subjectId": "<string>"
}
'

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

mcpServerId · string · required

MCP server id (the id returned by GET /v1/mcp, not the name).

Example:

"mcp-01HXYZ..."

Body

application/json

authSource · enum<string> · required

Which auth record to delete. oauth revokes the subject's OAuth tokens; auth-override removes the admin-installed per-subject credential override.

Available options: oauth, auth-override

subjectId · string · required

Target subject id whose auth record should be deleted.

subjectType · enum<string> · required

Subject type for the target principal. Delete is currently only supported for user and virtualaccount subjects.

Available options: user, virtualaccount

Response

200

Auth record deleted.