Two different ways a connection can be cut off: one for your user, one for you.

This is meant for a first-party "connected apps" style screen on your own site, called with the logged-in user's own proxy_auth_token (any valid one for your block, not necessarily one issued through this OAuth flow), not something the third-party app calls on itself.

POST /oauth/revoke
proxy_auth_token: <your user's own token>

curl -X POST https://your-domain.example/api/oauth/revoke \
  -H "proxy_auth_token: <your user's own token>" \
  -H "Content-Type: application/json" \
  -d '{"grant_id": 42}'

{ "data": { "message": "Revoked Successfully." }, "status": "success", "hasError": false, "errors": [], "proxy_duration": 7 }

This immediately and completely kills that connection. Its access token stops working right away (the connecting app's next call to anything, including the Me endpoint, gets a plain 401), and its refresh token can no longer mint a new access token either (invalid_grant on the next refresh attempt).

A user can only revoke their own connection. Attempting someone else's grant_id returns a 403. A grant_id that doesn't exist at all returns a 422 instead, in Laravel's default validation-error shape ({"message": "...", "errors": {...}}), not the envelope shown above.

There is currently no endpoint to list a user's own connected apps/grant IDs. If you want a "connected apps" screen, you'll need to track grant_id yourself (e.g. when you build that UI, record it at whatever point your own backend learns about a new connection) rather than expecting to fetch the list from 36Blocks.

If you want to cut off an entire third-party integration at once, not just one user's connection, do this from your dashboard instead: disable the OAuth Config (see Dashboard setup). That immediately revokes every active connection made through that config, the same way as above, just for all of them in one action.