Revoke an MCP session

Revokes a session by primary key. Accepts these row kinds:

• OAuth token rows → hard-deletes the token plus any pending OAuth flow for the same binding (so an in-flight callback can’t undo the revoke)
• Header credential rows → hard-deletes the credential plus any pending header submission flow for the same binding
• Pending per-user-headers flow rows → hard-deletes just the flow

Note: pending per-user OAuth flow rows are not revocable by this endpoint — they expire naturally or are cleared when the bound token row is revoked. To cancel a pending OAuth flow, revoke its parent token (if one exists) or wait for expiry.

Bifrost does not call the upstream provider’s revoke endpoint — revocation is local. Per-user-headers credentials never call upstream.

DELETE /api/mcp/sessions/{id}

Error

A valid request URL is required to generate request examples

401

{
  "event_id": "<string>",
  "type": "<string>",
  "is_bifrost_error": true,
  "status_code": 123,
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "event_id": "<string>"
  },
  "extra_fields": {
    "model_requested": "<string>",
    "request_type": "<string>"
  }
}

Authorizations

Authorization · string · header · required

Management API authentication for /api/* endpoints. Use the Authorization header with Bearer <API key>. Virtual keys, dashboard/user/session tokens, and x-api-key headers are not supported on management APIs.

Path Parameters

id · string · required

Session / credential / flow row ID

Response

204

Revoked