From df78b15c12f60adcbf329c8f7ae2061f709f0ed4 Mon Sep 17 00:00:00 2001 From: Liam Thompson Date: Thu, 13 Aug 2026 09:33:15 +0200 Subject: [PATCH 1/5] docs: document MCP client editing and deletion AI-Assisted: Codex drafted and validated the OAuth client management updates. --- deploy-manage/app-connections.md | 6 +-- .../app-connections/create-oauth-client.md | 30 +++++++++++-- .../app-connections/manage-app-connections.md | 24 ++++++++--- .../app-connections/oauth-clients.md | 6 +-- .../app-connections/revoke-oauth-client.md | 42 +++++++++++++++---- 5 files changed, 86 insertions(+), 22 deletions(-) diff --git a/deploy-manage/app-connections.md b/deploy-manage/app-connections.md index aa2ddd3d0b..73d793ab95 100644 --- a/deploy-manage/app-connections.md +++ b/deploy-manage/app-connections.md @@ -17,7 +17,7 @@ Application connections let users authorize external applications to act on thei Currently, only MCP clients for the [](/explore-analyze/ai-features/agent-builder/mcp-server.md) are supported. For that use case, OAuth 2.1 replaces static API keys when you need multi-user, delegated access. OAuth tokens are accepted only by the MCP server endpoint. -The sections below describe tasks for registering MCP clients, connecting hosts, revoking access, and managing connections at the project or organization level. +The sections below describe tasks for registering and editing MCP clients, connecting hosts, revoking access, deleting revoked clients and connections, and managing connections at the project or organization level. :::{note} Application connections are not the same as [{{kib}} connectors](/deploy-manage/manage-connectors.md) or [search connectors](elasticsearch://reference/search-connectors/index.md). {{kib}} connectors store credentials so {{kib}} can send actions to external systems. Search connectors sync data from third-party sources into {{es}}. Application connections allow external systems access to your {{serverless-short}} projects. @@ -31,5 +31,5 @@ To choose between an application connection or API keys to authorize external ap Use the following pages to set up and manage application connections for MCP clients: -- [](app-connections/oauth-clients.md): Set up and manage OAuth access for MCP clients, including registering clients, connecting hosts, and revoking access at the project level. -- [](app-connections/manage-app-connections.md): Audit and revoke authorized connections across your organization's {{serverless-short}} projects in the {{ecloud}} Console. +- [](app-connections/oauth-clients.md): Set up and manage OAuth access for MCP clients, including registering and editing clients, connecting hosts, revoking access, and deleting revoked clients and connections at the project level. +- [](app-connections/manage-app-connections.md): Audit, revoke, and delete authorized connections across your organization's {{serverless-short}} projects in the {{ecloud}} Console. diff --git a/deploy-manage/app-connections/create-oauth-client.md b/deploy-manage/app-connections/create-oauth-client.md index 63c0a1b81e..65d91c1024 100644 --- a/deploy-manage/app-connections/create-oauth-client.md +++ b/deploy-manage/app-connections/create-oauth-client.md @@ -1,6 +1,7 @@ --- -navigation_title: "Create an OAuth client" -description: "Register an OAuth client in Agent Builder to get the credentials and server URL needed to connect an MCP host over OAuth." +navigation_title: "Create or edit an OAuth client" +description: "Register an OAuth client in Agent Builder to get the credentials and server URL needed to connect an MCP host over OAuth, or edit an existing client's name, logo, and redirect URIs." +type: how-to applies_to: serverless: ga products: @@ -11,7 +12,7 @@ products: - id: cloud-serverless --- -# Create an OAuth client in {{agent-builder}} +# Create or edit an OAuth client in {{agent-builder}} Register a new OAuth client in {{agent-builder}} to generate the credentials that an MCP host, such as Claude Desktop, needs to connect over OAuth 2.1. This is a one-time step you complete before connecting any host to {{agent-builder}}. @@ -21,6 +22,8 @@ Each OAuth client is scoped to a single {{serverless-short}} project. Creating a In the {{kib}} UI, OAuth clients are labeled **MCP clients**. The button and menu labels in these steps, such as **Add MCP client**, refer to the OAuth client you're creating. ::: +You can also [edit an existing client](#edit-oauth-client) to change its name, logo, or redirect URIs without replacing its credentials. + ## Before you begin [create-oauth-client-before-you-begin] Before you create an OAuth client: @@ -98,9 +101,28 @@ The client ID and MCP server URL can be retrieved at any time from the **MCP cli ::::: +## Edit a client [edit-oauth-client] + +You can edit an active client's name, logo, and redirect URIs. You can't edit its client type, client ID, MCP server URL, or client secret. Revoked clients can't be edited. + +To edit a client: + +1. Find **Agents** in the navigation menu. You can also search for **Agent Builder** in the [global search bar](/explore-analyze/find-and-organize/find-apps-and-objects.md). +2. In the secondary navigation, select **Tools**. +3. In the **Tools** workspace, click **Manage all tools**. +4. In the **Tools library** workspace, click **Manage MCP**, and then select **Manage MCP clients (OAuth)**. +5. Find the client. Click **Actions**, and then click **Edit**. +6. Edit any of the following fields: + - **Name**: Enter a name with no more than 128 characters. + - **Client logo (optional)**: Select a provided logo, upload a PNG, JPEG, or GIF of up to 192 KB, or remove the existing logo. + - **Redirect URI type**: Select **Local** or **Remote**, and then enter at least one redirect URI. Local clients support up to 20 redirect URIs. Remote clients support one HTTPS redirect URI. Each URI can contain up to 2,048 characters. +7. Click **Update**. + +{{kib}} returns you to the **MCP clients** page and confirms that the client was updated. + ## Next steps -Now that you have the client ID and MCP server URL for your OAuth client, [configure your MCP host to use them](connect-mcp-host.md). +After creating a client, [configure your MCP host](connect-mcp-host.md) with its client ID and MCP server URL. You can also share these values so that other people connect the same client in their own MCP hosts. Each person authorizes access separately and gets their own connection. diff --git a/deploy-manage/app-connections/manage-app-connections.md b/deploy-manage/app-connections/manage-app-connections.md index d5eed050c1..63560c61fe 100644 --- a/deploy-manage/app-connections/manage-app-connections.md +++ b/deploy-manage/app-connections/manage-app-connections.md @@ -1,5 +1,5 @@ --- -description: "Audit and revoke OAuth client connections across an Elastic Cloud organization's serverless projects from a single organization-level view." +description: "Audit, revoke, and delete OAuth client connections across an Elastic Cloud organization's serverless projects from a single organization-level view." type: how-to applies_to: serverless: ga @@ -9,7 +9,7 @@ products: # Manage application connections -The **Application connections** page in the {{ecloud}} Console gives organization administrators a single place to audit and revoke [OAuth client](oauth-clients.md) connections that members of your organization have authorized across their {{serverless-short}} projects. +The **Application connections** page in the {{ecloud}} Console gives organization administrators a single place to audit, revoke, and delete [OAuth client](oauth-clients.md) connections that members of your organization have authorized across their {{serverless-short}} projects. To create an OAuth client or connect an MCP host such as Claude Desktop, refer to [](oauth-clients.md). This page covers organization-level management only. @@ -18,7 +18,7 @@ To create an OAuth client or connect an MCP host such as Claude Desktop, refer t Before you manage application connections: * You have access to the {{ecloud}} Console for your organization. To open the page, go to **Organization** → **Security settings** → **Application connections**. -* Your role determines what you can see and revoke: +* Your role determines what you can view, revoke, and delete: * **Organization owners** see every application connection in the organization. * Other users see connections for the projects they administer, plus any connections they authorized themselves. @@ -80,7 +80,7 @@ To revoke several connections at once: 1. Select the checkbox for each connection you want to revoke. In grouped view, use **Select all connections for this client** to select every connection under a client, or **Clear selection** to start over. 2. Click **Revoke *N* connections**. -3. Review the connections in the confirmation dialog, then click **Revoke access**. +3. Review the connections in the confirmation dialog, then click **Revoke**. You can revoke up to 100 connections at a time. @@ -88,7 +88,21 @@ You can revoke up to 100 connections at a time. Removing a user from your identity provider does **not** automatically revoke that user's connections. When a user leaves, revoke their connections here to cut off access. ::: -To revoke an entire OAuth client and all its connections, the client's creator removes it from the project's Agent Builder client management in Kibana. Refer to [](revoke-oauth-client.md). +To revoke an entire OAuth client and all its connections, revoke it from the project's Agent Builder client management in {{kib}}. Refer to [](revoke-oauth-client.md). + +## Delete revoked connections + +Deleting a revoked connection permanently removes it immediately instead of waiting for the 90-day retention period. This action can't be undone. + +To delete a single revoked connection, click **Delete** in its row. + +To delete several revoked connections at once: + +1. Select the checkbox for each revoked connection you want to delete. In grouped view, use **Select all connections for this client** to select every revoked connection under a client, or **Clear selection** to start over. +2. Click **Delete *N* connections**. +3. Review the connections in the confirmation dialog, then click **Delete permanently**. + +You can delete up to 100 connections at a time. ## Next steps diff --git a/deploy-manage/app-connections/oauth-clients.md b/deploy-manage/app-connections/oauth-clients.md index 232d584894..b5022d4744 100644 --- a/deploy-manage/app-connections/oauth-clients.md +++ b/deploy-manage/app-connections/oauth-clients.md @@ -67,12 +67,12 @@ Access tokens are short-lived and refreshed automatically in the background, so Use the following pages to create and manage OAuth access for MCP clients: -- [](create-oauth-client.md): Register a client in {{agent-builder}} and get the client ID and MCP server URL your MCP host needs. +- [](create-oauth-client.md): Register a client in {{agent-builder}} and get the client ID and MCP server URL your MCP host needs, or edit an existing client's name, logo, or redirect URIs. - [](connect-mcp-host.md): Configure your MCP host with those values and complete browser authorization. -- [](revoke-oauth-client.md): Remove access for a single connection or an entire client at the project level. +- [](revoke-oauth-client.md): Revoke a connection or client to cut off access, or permanently delete a revoked connection or client. ## Related pages -- [](manage-app-connections.md): Audit and revoke connections across your organization's {{serverless-short}} projects in the {{ecloud}} Console. +- [](manage-app-connections.md): Audit, revoke, and delete connections across your organization's {{serverless-short}} projects in the {{ecloud}} Console. - [](/explore-analyze/ai-features/agent-builder/mcp-server.md): Configure the {{agent-builder}} MCP server and compare authentication methods. - [](/deploy-manage/api-keys.md): Authenticate to the MCP server with API keys instead of OAuth. diff --git a/deploy-manage/app-connections/revoke-oauth-client.md b/deploy-manage/app-connections/revoke-oauth-client.md index f039920a18..07e47839a9 100644 --- a/deploy-manage/app-connections/revoke-oauth-client.md +++ b/deploy-manage/app-connections/revoke-oauth-client.md @@ -1,6 +1,6 @@ --- -navigation_title: "Revoke an OAuth client or connection" -description: "Remove an individual connection or an entire OAuth client from Agent Builder to cut off OAuth access for a user or application." +navigation_title: "Revoke or delete a client or connection" +description: "Remove an individual connection or an entire OAuth client from Agent Builder to cut off OAuth access for a user or application, or permanently delete the retained record after revocation." type: how-to applies_to: serverless: ga @@ -12,13 +12,15 @@ products: - id: cloud-serverless --- -# Revoke an OAuth client or connection +# Revoke or delete an OAuth client or connection Revoking OAuth access in {{agent-builder}} immediately cuts off an MCP host's ability to use the Agent Builder tools. You can revoke access at two levels: - **Revoke a connection**: Removes one user's authorized session for an OAuth client, while leaving the client registered. The user can reconnect by going through the authorization flow again. - **Revoke an OAuth client**: Revokes the entire client and all its connections. Users whose connections are removed can no longer connect until a new client is created. +After revocation, you can permanently delete the retained [connection](#delete-a-connection) or [client](#delete-an-oauth-client) record. Deletion can't be undone. + Organization owners and project administrators can revoke connections for projects they administer from the {{ecloud}} Console. Users can also revoke connections they created themselves from the {{ecloud}} Console. Refer to [](manage-app-connections.md). :::{warning} @@ -27,7 +29,8 @@ Removing a user from your identity provider does **not** automatically revoke th ## Before you begin [revoke-oauth-client-before-you-begin] -Revoking connections or clients from the **Application connections** page in {{kib}} requires the `manage_security` cluster privilege. A user with only `read_security` can view connections but can't revoke them. +- Revoking or deleting connections from the **Application connections** page in {{kib}} requires the `manage_security` cluster privilege. A user with only `read_security` can view connections but can't revoke or delete them. +- Revoking or deleting clients requires **Read** access to the {{agent-builder}} {{kib}} feature. To learn more, refer to [Permissions](/explore-analyze/ai-features/agent-builder/permissions.md#kib-privileges). ## Revoke a connection @@ -42,14 +45,27 @@ To revoke a single connection: The connection is revoked immediately. The OAuth client stays registered and can accept new connections. Applications can be reconnected at any time by going through the authorization flow again. +## Delete a connection + +Only revoked connections can be deleted. Deleting a connection permanently removes it immediately instead of waiting for the 90-day retention period. + +To delete one or more connections: + +1. In {{kib}}, go to **Admin and settings** → **Application connections**. +2. Find a revoked connection. In **Group by client** view, expand a client row to see its connections. Switch to **List view** to see all connections in a flat list. +3. Click **Delete** in the connection's row. Alternatively, select the checkbox next to each revoked connection you want to delete and click **Delete *N* connections**. +4. Review the connections in the confirmation dialog, then click **Delete permanently**. + +The deleted connections are removed from the list. This action can't be undone. The OAuth client stays registered and can accept new connections. + ## Revoke an OAuth client -Revoking a client immediately terminates all its connections. The client is no longer listed in Agent Builder, and existing OAuth tokens for those connections stop working at the next validation. +Revoking a client immediately terminates all its connections. The client remains listed with a revoked status, and existing OAuth tokens for its connections stop working at the next validation. To revoke an OAuth client: 1. In {{kib}}, go to **Agent Builder** → **Tools library**, click **Manage MCP**, and select **Manage MCP clients (OAuth)**. -2. Find the client and click **Revoke** in its row. +2. Find the client. Click **Actions**, and then click **Revoke**. 3. In the **Revoke [client name]?** dialog, review the number of active connections that will be affected. 4. In the **MCP client name** field, type the client name exactly as shown to confirm, then click **Revoke**. @@ -57,9 +73,21 @@ After revocation, users can no longer connect with that client until a new OAuth To restore access after revoking a client, you can [create a new OAuth client](create-oauth-client.md) and distribute the new credentials to users. +## Delete an OAuth client + +Only revoked clients can be deleted. Deleting a client permanently removes it and can't be undone. + +To delete an OAuth client: + +1. In {{kib}}, go to **Agent Builder** → **Tools library**, click **Manage MCP**, and select **Manage MCP clients (OAuth)**. +2. Find the revoked client. Click **Actions**, and then click **Delete**. +3. In the **Delete [client name]?** dialog, review the warning, then click **Delete**. + +The client is permanently removed from the **MCP clients** page. + ## Related pages - [](oauth-clients.md) - [](create-oauth-client.md) - [](connect-mcp-host.md) -- [](manage-app-connections.md): Revoke connections at the organization level in the {{ecloud}} Console. +- [](manage-app-connections.md): Revoke or delete connections at the organization level in the {{ecloud}} Console. From cf3a2ffdd1728931dd2025a739ed39ea75998730 Mon Sep 17 00:00:00 2001 From: Liam Thompson Date: Thu, 13 Aug 2026 14:40:24 +0200 Subject: [PATCH 2/5] docs: clarify bulk connection deletion labels --- deploy-manage/app-connections/manage-app-connections.md | 2 +- deploy-manage/app-connections/revoke-oauth-client.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/deploy-manage/app-connections/manage-app-connections.md b/deploy-manage/app-connections/manage-app-connections.md index 63560c61fe..d1bb23c789 100644 --- a/deploy-manage/app-connections/manage-app-connections.md +++ b/deploy-manage/app-connections/manage-app-connections.md @@ -99,7 +99,7 @@ To delete a single revoked connection, click **Delete** in its row. To delete several revoked connections at once: 1. Select the checkbox for each revoked connection you want to delete. In grouped view, use **Select all connections for this client** to select every revoked connection under a client, or **Clear selection** to start over. -2. Click **Delete *N* connections**. +2. Click the bulk delete button, which displays the number of selected connections, for example: **Delete 9 connections**. 3. Review the connections in the confirmation dialog, then click **Delete permanently**. You can delete up to 100 connections at a time. diff --git a/deploy-manage/app-connections/revoke-oauth-client.md b/deploy-manage/app-connections/revoke-oauth-client.md index 07e47839a9..73d4c50127 100644 --- a/deploy-manage/app-connections/revoke-oauth-client.md +++ b/deploy-manage/app-connections/revoke-oauth-client.md @@ -53,7 +53,7 @@ To delete one or more connections: 1. In {{kib}}, go to **Admin and settings** → **Application connections**. 2. Find a revoked connection. In **Group by client** view, expand a client row to see its connections. Switch to **List view** to see all connections in a flat list. -3. Click **Delete** in the connection's row. Alternatively, select the checkbox next to each revoked connection you want to delete and click **Delete *N* connections**. +3. Click **Delete** in the connection's row. Alternatively, select the checkbox next to each revoked connection you want to delete, then click the bulk delete button, which displays the number of selected connections, for example: **Delete 9 connections**. 4. Review the connections in the confirmation dialog, then click **Delete permanently**. The deleted connections are removed from the list. This action can't be undone. The OAuth client stays registered and can accept new connections. From 0fbde883336000ef0b9e5f6c338c4e96c757881f Mon Sep 17 00:00:00 2001 From: Liam Thompson Date: Thu, 13 Aug 2026 18:16:48 +0200 Subject: [PATCH 3/5] docs: centralize MCP client field requirements --- .../app-connections/create-oauth-client.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/deploy-manage/app-connections/create-oauth-client.md b/deploy-manage/app-connections/create-oauth-client.md index 65d91c1024..05871591bb 100644 --- a/deploy-manage/app-connections/create-oauth-client.md +++ b/deploy-manage/app-connections/create-oauth-client.md @@ -49,11 +49,11 @@ You can also get to this page by searching for **Application connections** in th :::: ::::{step} Name the client -Enter a **Client name**. The name is visible to users during the authorization flow, so use something that clearly identifies the application (for example, `Claude Desktop — Engineering`). +Enter a **Client name** with no more than 128 characters. The name is visible to users during the authorization flow, so use something that clearly identifies the application (for example, `Claude Desktop — Engineering`). :::: ::::{step} Select a client logo -Optionally set a **Client logo** to identify the application in the list. Use **Select logo** to choose from provided options, or select **Upload logo** to use a custom image. +Optionally set a **Client logo** to identify the application in the list. Use **Select logo** to choose from provided options, or select **Upload logo** to use a PNG, JPEG, or GIF of up to 192 KB. Selecting a logo is cosmetic, and does not pre-configure any settings. :::: @@ -78,7 +78,7 @@ The redirect URI tells the authorization server where to return the user after t The ChatGPT callback URL is unique to each app. You must [start the app creation flow first](/deploy-manage/app-connections/connect-mcp-host.md) to get this URL, then return here to add it to your OAuth client. ::: -For local clients that need more than one redirect URI, click **Add local URL** to add additional URLs. +For local clients that need more than one redirect URI, click **Add local URL** to add up to 20 URLs. Each local or remote redirect URI can contain up to 2,048 characters. :::: ::::{step} Optional: Generate a client secret @@ -113,9 +113,11 @@ To edit a client: 4. In the **Tools library** workspace, click **Manage MCP**, and then select **Manage MCP clients (OAuth)**. 5. Find the client. Click **Actions**, and then click **Edit**. 6. Edit any of the following fields: - - **Name**: Enter a name with no more than 128 characters. - - **Client logo (optional)**: Select a provided logo, upload a PNG, JPEG, or GIF of up to 192 KB, or remove the existing logo. - - **Redirect URI type**: Select **Local** or **Remote**, and then enter at least one redirect URI. Local clients support up to 20 redirect URIs. Remote clients support one HTTPS redirect URI. Each URI can contain up to 2,048 characters. + - **Name** + - **Client logo (optional)**: Select a provided logo, upload a custom logo, or remove the existing logo. + - **Redirect URI type**: Select **Local** or **Remote**, then add, remove, or edit a redirect URI. + + The edited fields must meet the same requirements described in [Create the client](#create-the-client). 7. Click **Update**. {{kib}} returns you to the **MCP clients** page and confirms that the client was updated. From ab4f81b9dc31e03d15f90acc1dedb4b907bc6242 Mon Sep 17 00:00:00 2001 From: Liam Thompson Date: Thu, 13 Aug 2026 18:17:06 +0200 Subject: [PATCH 4/5] docs: clarify connection retention and bulk actions --- deploy-manage/app-connections/manage-app-connections.md | 6 +++--- deploy-manage/app-connections/revoke-oauth-client.md | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/deploy-manage/app-connections/manage-app-connections.md b/deploy-manage/app-connections/manage-app-connections.md index d1bb23c789..fcd08562ca 100644 --- a/deploy-manage/app-connections/manage-app-connections.md +++ b/deploy-manage/app-connections/manage-app-connections.md @@ -56,7 +56,7 @@ A connection has one of the following statuses: * **Expired**: The connection's refresh window lapsed after 30 days of inactivity. The user must re-authorize to use it again. * **Revoked**: The connection was revoked and can no longer be used. -Revoked connections remain visible for 3 months and revoked clients for 1 year. Expired connections remain visible until re-authorized or removed. +Revoked connections remain visible for 90 days and revoked clients for 1 year. Expired connections remain visible until re-authorized or removed. ## View OAuth client details @@ -79,7 +79,7 @@ To revoke a single connection, click **Revoke** in its row. To revoke several connections at once: 1. Select the checkbox for each connection you want to revoke. In grouped view, use **Select all connections for this client** to select every connection under a client, or **Clear selection** to start over. -2. Click **Revoke *N* connections**. +2. Click the bulk revoke button, which displays the number of selected connections, for example: **Revoke 9 connections**. 3. Review the connections in the confirmation dialog, then click **Revoke**. You can revoke up to 100 connections at a time. @@ -92,7 +92,7 @@ To revoke an entire OAuth client and all its connections, revoke it from the pro ## Delete revoked connections -Deleting a revoked connection permanently removes it immediately instead of waiting for the 90-day retention period. This action can't be undone. +Deleting a revoked connection permanently removes it before the end of the 90-day retention period. This action can't be undone. To delete a single revoked connection, click **Delete** in its row. diff --git a/deploy-manage/app-connections/revoke-oauth-client.md b/deploy-manage/app-connections/revoke-oauth-client.md index 73d4c50127..1535acd7fa 100644 --- a/deploy-manage/app-connections/revoke-oauth-client.md +++ b/deploy-manage/app-connections/revoke-oauth-client.md @@ -40,14 +40,14 @@ To revoke a single connection: You can also reach this page from **Agent Builder** → **Tools library** → **Manage MCP** → **Manage MCP clients (OAuth)** by clicking **Manage application connections**. 2. Find the connection. In **Group by client** view, expand a client row to see its connections. Switch to **List view** to see all connections in a flat list. -3. Click **Revoke** in the connection's row. Alternatively, select the checkbox next to each connection you want to revoke and click **Revoke *N* connections**. +3. Click **Revoke** in the connection's row. Alternatively, select the checkbox next to each connection you want to revoke, then click the bulk revoke button, which displays the number of selected connections, for example: **Revoke 9 connections**. 4. Review the details in the confirmation dialog, then click **Revoke**. The connection is revoked immediately. The OAuth client stays registered and can accept new connections. Applications can be reconnected at any time by going through the authorization flow again. ## Delete a connection -Only revoked connections can be deleted. Deleting a connection permanently removes it immediately instead of waiting for the 90-day retention period. +Only revoked connections can be deleted. Revoked connections otherwise remain visible for 90 days. Deleting a connection permanently removes it before the end of that retention period. To delete one or more connections: From 468d163fcb8415cff7b23e6e572e3858ff553224 Mon Sep 17 00:00:00 2001 From: Liam Thompson Date: Thu, 13 Aug 2026 18:28:42 +0200 Subject: [PATCH 5/5] docs: clarify revoked connection deletion --- deploy-manage/app-connections/manage-app-connections.md | 2 +- deploy-manage/app-connections/revoke-oauth-client.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/deploy-manage/app-connections/manage-app-connections.md b/deploy-manage/app-connections/manage-app-connections.md index fcd08562ca..268ed89c4c 100644 --- a/deploy-manage/app-connections/manage-app-connections.md +++ b/deploy-manage/app-connections/manage-app-connections.md @@ -92,7 +92,7 @@ To revoke an entire OAuth client and all its connections, revoke it from the pro ## Delete revoked connections -Deleting a revoked connection permanently removes it before the end of the 90-day retention period. This action can't be undone. +Deleting a revoked connection permanently removes it immediately instead of waiting for the 90-day retention period. This action can't be undone. To delete a single revoked connection, click **Delete** in its row. diff --git a/deploy-manage/app-connections/revoke-oauth-client.md b/deploy-manage/app-connections/revoke-oauth-client.md index 1535acd7fa..bf1aebe38c 100644 --- a/deploy-manage/app-connections/revoke-oauth-client.md +++ b/deploy-manage/app-connections/revoke-oauth-client.md @@ -47,7 +47,7 @@ The connection is revoked immediately. The OAuth client stays registered and can ## Delete a connection -Only revoked connections can be deleted. Revoked connections otherwise remain visible for 90 days. Deleting a connection permanently removes it before the end of that retention period. +Only revoked connections can be deleted. Revoked connections otherwise remain visible for 90 days. Deleting a connection permanently removes it immediately and can't be undone. To delete one or more connections: