Disconnect account

DELETEhttps://api.corespeed.io/connectors/:id

This path does two different things depending on what :id names. For an OAuth connector it disconnects one account; for an org-registered remote MCP connector it deletes the registration for the whole organization.

If :id is a remote MCP slug, this is not an account disconnect — it is whole-sale deregistration: the registration, its snapshots, its stored credentials, and the KV hot copies are all removed for the entire organization, and there is no undo. The route is admin-only for that reason (403 admin_required otherwise). Check kind in GET /connectors before calling this on an id you did not create.

For an OAuth connector, it removes the caller's own unambiguous private account: the upstream grant is revoked best-effort, then the stored credential is deleted regardless of the revoke outcome.

Authorizations

Authorizationstringheaderrequired: Bearer <sk-cs-…> — a CoreSpeed API key, or a user session JWT. x-api-key: <sk-cs-…> is accepted in its place.

Path parameters

idstringpathrequired: An OAuth connector id — whose private account is removed — or a remote MCP slug, whose entire org registration is deleted. The two cases are not distinguishable from this path alone.

OAuth connector behavior

204 — removed, or a no-op because only a shared credential exists. This route never deletes a shared account.
409 — more than one account matches, so the target is ambiguous. Address one account directly instead.

Remote MCP connector behavior

204 — the registration, snapshots, credentials, and KV copies are gone for the organization. Re-adding means registering the upstream again.
403 admin_required — the caller is a member, not an organization admin. Flat envelope, like the other remote-connector writes.
404 — the slug is not registered for this organization. Unknown ids never reveal anything, credentialed or not.

Shared accounts are removed over HTTP only through DELETE /connectors/:id/accounts/:accountId, which returns 204 and enforces the same per-scope authorization: private → owning member only; shared → creator or organization admin. The manage__accounts_remove MCP tool performs the same removal addressed by alias.

Authorizing a connector is not an HTTP operation — the OAuth dance runs in the dashboard over an internal binding, so there is no public route to initiate a connect.

curl -X DELETE https://api.corespeed.io/connectors/notion \
  -H "Authorization: Bearer $CORESPEED_API_KEY" \
  -i

const res = await fetch("https://api.corespeed.io/connectors/notion", {
  method: "DELETE",
  headers: { Authorization: `Bearer ${process.env.CORESPEED_API_KEY}` },
});

if (res.status === 409) {
  throw new Error("multiple accounts match; remove one by account id");
}

import os
import httpx

res = httpx.delete(
    "https://api.corespeed.io/connectors/notion",
    headers={"Authorization": f"Bearer {os.environ['CORESPEED_API_KEY']}"},
)

if res.status_code == 409:
    raise RuntimeError("multiple accounts match; remove one by account id")

package main

import (
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("DELETE", "https://api.corespeed.io/connectors/notion", nil)
	req.Header.Set("Authorization", "Bearer "+os.Getenv("CORESPEED_API_KEY"))

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	if res.StatusCode == http.StatusConflict {
		panic("multiple accounts match; remove one by account id")
	}
}

Removed, or a no-op on a shared credential

No body.

{
  "error": "multiple_accounts",
  "message": "Multiple accounts connected for notion; use manage accounts_remove with a specific alias."
}

{
  "error": "admin_required",
  "message": "Removing remote MCP connectors requires an org admin."
}