Disconnect EVERY Slack principal bound to the caller's own profile.

DELETE

/api/auth/slack/link/me

Plural on purpose. kb_profile_auth_links has UNIQUE(auth_provider, auth_provider_user_id)
and nothing keyed on (profile_id, auth_provider), so a human in two Slack workspaces holds
two rows — legitimately, because the already-linked refusal keys on the principal. Cutting
only one and answering "disconnected" would leave the other grant live and still minting
act-as-the-human tokens, which is the opposite of what the user asked for.

The 401 arm is the disabled-link branch. There is no 503: ApiError has no such variant, and
documenting one the code cannot return is worse than documenting nothing — it is baked into
openapi.json, the Ruby gem and schema.ts.

Request

Authorization

JWT Bearer

Add the parameter

Authorization

to Headers

Example:

Authorization: ********************

Header Params

Responses

🟢200OK

application/json

Disconnect completed (idempotent); disconnected lists every principal unbound

Bodyapplication/json

🟠401Unauthorized

Request Example

Shell

JavaScript

Java

Swift

curl --location --request DELETE '/api/auth/slack/link/me' \
--header 'X-Temper-Surface;' \
--header 'Authorization: Bearer <token>'

Response Example

200 - Example 1

{
    "disconnected": [
        {
            "grant_deleted": true,
            "idp_revocation": "not_attempted",
            "intents_deleted": 0,
            "slack_principal_id": "string"
        }
    ]
}

Modified at 2026-08-19 12:26:18

Disconnect any principal. Operator path — offboarding and stuck users.

auditor_dispatch