Document MCP client editing and deletion

deploy-manage/app-connections.md

@@ -17,7 +17,7 @@ Application connections let users authorize external applications to act on thei
 
 Currently, only MCP clients for the [](/explore-analyze/ai-features/agent-builder/mcp-server.md) are supported. For that use case, OAuth 2.1 replaces static API keys when you need multi-user, delegated access. OAuth tokens are accepted only by the MCP server endpoint.
 
-The sections below describe tasks for registering MCP clients, connecting hosts, revoking access, and managing connections at the project or organization level.
+The sections below describe tasks for registering and editing MCP clients, connecting hosts, revoking access, deleting revoked clients and connections, and managing connections at the project or organization level.
 
 :::{note}
 Application connections are not the same as [{{kib}} connectors](/deploy-manage/manage-connectors.md) or [search connectors](elasticsearch://reference/search-connectors/index.md). {{kib}} connectors store credentials so {{kib}} can send actions to external systems. Search connectors sync data from third-party sources into {{es}}. Application connections allow external systems access to your {{serverless-short}} projects.
@@ -31,5 +31,5 @@ To choose between an application connection or API keys to authorize external ap
 
 Use the following pages to set up and manage application connections for MCP clients:
 
-- [](app-connections/oauth-clients.md): Set up and manage OAuth access for MCP clients, including registering clients, connecting hosts, and revoking access at the project level.
-- [](app-connections/manage-app-connections.md): Audit and revoke authorized connections across your organization's {{serverless-short}} projects in the {{ecloud}} Console.
+- [](app-connections/oauth-clients.md): Set up and manage OAuth access for MCP clients, including registering and editing clients, connecting hosts, revoking access, and deleting revoked clients and connections at the project level.
+- [](app-connections/manage-app-connections.md): Audit, revoke, and delete authorized connections across your organization's {{serverless-short}} projects in the {{ecloud}} Console.

deploy-manage/app-connections/create-oauth-client.md

@@ -1,6 +1,7 @@
 ---
-navigation_title: "Create an OAuth client"
-description: "Register an OAuth client in Agent Builder to get the credentials and server URL needed to connect an MCP host over OAuth."
+navigation_title: "Create or edit an OAuth client"
+description: "Register an OAuth client in Agent Builder to get the credentials and server URL needed to connect an MCP host over OAuth, or edit an existing client's name, logo, and redirect URIs."
+type: how-to
 applies_to:
   serverless: ga
 products:
@@ -11,7 +12,7 @@ products:
   - id: cloud-serverless
 ---
 
-# Create an OAuth client in {{agent-builder}}
+# Create or edit an OAuth client in {{agent-builder}}
 
 Register a new OAuth client in {{agent-builder}} to generate the credentials that an MCP host, such as Claude Desktop, needs to connect over OAuth 2.1. This is a one-time step you complete before connecting any host to {{agent-builder}}.
 
@@ -21,6 +22,8 @@ Each OAuth client is scoped to a single {{serverless-short}} project. Creating a
 In the {{kib}} UI, OAuth clients are labeled **MCP clients**. The button and menu labels in these steps, such as **Add MCP client**, refer to the OAuth client you're creating.
 :::
 
+You can also [edit an existing client](#edit-oauth-client) to change its name, logo, or redirect URIs without replacing its credentials.
+
 ## Before you begin [create-oauth-client-before-you-begin]
 
 Before you create an OAuth client:
@@ -98,9 +101,28 @@ The client ID and MCP server URL can be retrieved at any time from the **MCP cli
 
 :::::
 
+## Edit a client [edit-oauth-client]
+
+You can edit an active client's name, logo, and redirect URIs. You can't edit its client type, client ID, MCP server URL, or client secret. Revoked clients can't be edited.
+
+To edit a client:
+
+1. Find **Agents** in the navigation menu. You can also search for **Agent Builder** in the [global search bar](/explore-analyze/find-and-organize/find-apps-and-objects.md).
+2. In the secondary navigation, select **Tools**.
+3. In the **Tools** workspace, click **Manage all tools**.
+4. In the **Tools library** workspace, click **Manage MCP**, and then select **Manage MCP clients (OAuth)**.
+5. Find the client. Click **Actions**, and then click **Edit**.
+6. Edit any of the following fields:
+   - **Name**: Enter a name with no more than 128 characters.
+   - **Client logo (optional)**: Select a provided logo, upload a PNG, JPEG, or GIF of up to 192 KB, or remove the existing logo.
+   - **Redirect URI type**: Select **Local** or **Remote**, and then enter at least one redirect URI. Local clients support up to 20 redirect URIs. Remote clients support one HTTPS redirect URI. Each URI can contain up to 2,048 characters.
+7. Click **Update**.
+
+{{kib}} returns you to the **MCP clients** page and confirms that the client was updated.
+
 ## Next steps
 
-Now that you have the client ID and MCP server URL for your OAuth client, [configure your MCP host to use them](connect-mcp-host.md).
+After creating a client, [configure your MCP host](connect-mcp-host.md) with its client ID and MCP server URL.
 
 You can also share these values so that other people connect the same client in their own MCP hosts. Each person authorizes access separately and gets their own connection.
 

deploy-manage/app-connections/manage-app-connections.md

@@ -1,5 +1,5 @@
 ---
-description: "Audit and revoke OAuth client connections across an Elastic Cloud organization's serverless projects from a single organization-level view."
+description: "Audit, revoke, and delete OAuth client connections across an Elastic Cloud organization's serverless projects from a single organization-level view."
 type: how-to
 applies_to:
   serverless: ga
@@ -9,7 +9,7 @@ products:
 
 # Manage application connections
 
-The **Application connections** page in the {{ecloud}} Console gives organization administrators a single place to audit and revoke [OAuth client](oauth-clients.md) connections that members of your organization have authorized across their {{serverless-short}} projects.
+The **Application connections** page in the {{ecloud}} Console gives organization administrators a single place to audit, revoke, and delete [OAuth client](oauth-clients.md) connections that members of your organization have authorized across their {{serverless-short}} projects.
 
 To create an OAuth client or connect an MCP host such as Claude Desktop, refer to [](oauth-clients.md). This page covers organization-level management only.
 
@@ -18,7 +18,7 @@ To create an OAuth client or connect an MCP host such as Claude Desktop, refer t
 Before you manage application connections:
 
 * You have access to the {{ecloud}} Console for your organization. To open the page, go to **Organization** → **Security settings** → **Application connections**.
-* Your role determines what you can see and revoke:
+* Your role determines what you can view, revoke, and delete:
   * **Organization owners** see every application connection in the organization.
   * Other users see connections for the projects they administer, plus any connections they authorized themselves.
 
@@ -80,15 +80,29 @@ To revoke several connections at once:
 
 1. Select the checkbox for each connection you want to revoke. In grouped view, use **Select all connections for this client** to select every connection under a client, or **Clear selection** to start over.
 2. Click **Revoke *N* connections**.
-3. Review the connections in the confirmation dialog, then click **Revoke access**.
+3. Review the connections in the confirmation dialog, then click **Revoke**.
 
 You can revoke up to 100 connections at a time.
 
 :::{tip}
 Removing a user from your identity provider does **not** automatically revoke that user's connections. When a user leaves, revoke their connections here to cut off access.
 :::
 
-To revoke an entire OAuth client and all its connections, the client's creator removes it from the project's Agent Builder client management in Kibana. Refer to [](revoke-oauth-client.md).
+To revoke an entire OAuth client and all its connections, revoke it from the project's Agent Builder client management in {{kib}}. Refer to [](revoke-oauth-client.md).
+
+## Delete revoked connections
+
+Deleting a revoked connection permanently removes it immediately instead of waiting for the 90-day retention period. This action can't be undone.
+
+To delete a single revoked connection, click **Delete** in its row.
+
+To delete several revoked connections at once:
+
+1. Select the checkbox for each revoked connection you want to delete. In grouped view, use **Select all connections for this client** to select every revoked connection under a client, or **Clear selection** to start over.
+2. Click the bulk delete button, which displays the number of selected connections, for example: **Delete 9 connections**.
+3. Review the connections in the confirmation dialog, then click **Delete permanently**.
+
+You can delete up to 100 connections at a time.
 
 ## Next steps
 

deploy-manage/app-connections/oauth-clients.md

@@ -67,12 +67,12 @@ Access tokens are short-lived and refreshed automatically in the background, so
 
 Use the following pages to create and manage OAuth access for MCP clients:
 
-- [](create-oauth-client.md): Register a client in {{agent-builder}} and get the client ID and MCP server URL your MCP host needs.
+- [](create-oauth-client.md): Register a client in {{agent-builder}} and get the client ID and MCP server URL your MCP host needs, or edit an existing client's name, logo, or redirect URIs.
 - [](connect-mcp-host.md): Configure your MCP host with those values and complete browser authorization.
-- [](revoke-oauth-client.md): Remove access for a single connection or an entire client at the project level.
+- [](revoke-oauth-client.md): Revoke a connection or client to cut off access, or permanently delete a revoked connection or client.
 
 ## Related pages
 
-- [](manage-app-connections.md): Audit and revoke connections across your organization's {{serverless-short}} projects in the {{ecloud}} Console.
+- [](manage-app-connections.md): Audit, revoke, and delete connections across your organization's {{serverless-short}} projects in the {{ecloud}} Console.
 - [](/explore-analyze/ai-features/agent-builder/mcp-server.md): Configure the {{agent-builder}} MCP server and compare authentication methods.
 - [](/deploy-manage/api-keys.md): Authenticate to the MCP server with API keys instead of OAuth.

deploy-manage/app-connections/revoke-oauth-client.md

@@ -1,6 +1,6 @@
 ---
-navigation_title: "Revoke an OAuth client or connection"
-description: "Remove an individual connection or an entire OAuth client from Agent Builder to cut off OAuth access for a user or application."
+navigation_title: "Revoke or delete a client or connection"
+description: "Remove an individual connection or an entire OAuth client from Agent Builder to cut off OAuth access for a user or application, or permanently delete the retained record after revocation."
 type: how-to
 applies_to:
   serverless: ga
@@ -12,13 +12,15 @@ products:
   - id: cloud-serverless
 ---
 
-# Revoke an OAuth client or connection
+# Revoke or delete an OAuth client or connection
 
 Revoking OAuth access in {{agent-builder}} immediately cuts off an MCP host's ability to use the Agent Builder tools. You can revoke access at two levels:
 
 - **Revoke a connection**: Removes one user's authorized session for an OAuth client, while leaving the client registered. The user can reconnect by going through the authorization flow again.
 - **Revoke an OAuth client**: Revokes the entire client and all its connections. Users whose connections are removed can no longer connect until a new client is created.
 
+After revocation, you can permanently delete the retained [connection](#delete-a-connection) or [client](#delete-an-oauth-client) record. Deletion can't be undone.
+
 Organization owners and project administrators can revoke connections for projects they administer from the {{ecloud}} Console. Users can also revoke connections they created themselves from the {{ecloud}} Console. Refer to [](manage-app-connections.md).
 
 :::{warning}
@@ -27,7 +29,8 @@ Removing a user from your identity provider does **not** automatically revoke th
 
 ## Before you begin [revoke-oauth-client-before-you-begin]
 
-Revoking connections or clients from the **Application connections** page in {{kib}} requires the `manage_security` cluster privilege. A user with only `read_security` can view connections but can't revoke them.
+- Revoking or deleting connections from the **Application connections** page in {{kib}} requires the `manage_security` cluster privilege. A user with only `read_security` can view connections but can't revoke or delete them.
+- Revoking or deleting clients requires **Read** access to the {{agent-builder}} {{kib}} feature. To learn more, refer to [Permissions](/explore-analyze/ai-features/agent-builder/permissions.md#kib-privileges).
 
 ## Revoke a connection
 
@@ -42,24 +45,49 @@ To revoke a single connection:
 
 The connection is revoked immediately. The OAuth client stays registered and can accept new connections. Applications can be reconnected at any time by going through the authorization flow again.
 
+## Delete a connection
+
+Only revoked connections can be deleted. Deleting a connection permanently removes it immediately instead of waiting for the 90-day retention period.
+
+To delete one or more connections:
+
+1. In {{kib}}, go to **Admin and settings** → **Application connections**.
+2. Find a revoked connection. In **Group by client** view, expand a client row to see its connections. Switch to **List view** to see all connections in a flat list.
+3. Click **Delete** in the connection's row. Alternatively, select the checkbox next to each revoked connection you want to delete, then click the bulk delete button, which displays the number of selected connections, for example: **Delete 9 connections**.
+4. Review the connections in the confirmation dialog, then click **Delete permanently**.
+
+The deleted connections are removed from the list. This action can't be undone. The OAuth client stays registered and can accept new connections.
+
 ## Revoke an OAuth client
 
-Revoking a client immediately terminates all its connections. The client is no longer listed in Agent Builder, and existing OAuth tokens for those connections stop working at the next validation.
+Revoking a client immediately terminates all its connections. The client remains listed with a revoked status, and existing OAuth tokens for its connections stop working at the next validation.
 
 To revoke an OAuth client:
 
 1. In {{kib}}, go to **Agent Builder** → **Tools library**, click **Manage MCP**, and select **Manage MCP clients (OAuth)**.
-2. Find the client and click **Revoke** in its row.
+2. Find the client. Click **Actions**, and then click **Revoke**.
 3. In the **Revoke [client name]?** dialog, review the number of active connections that will be affected.
 4. In the **MCP client name** field, type the client name exactly as shown to confirm, then click **Revoke**.
 
 After revocation, users can no longer connect with that client until a new OAuth client is created.
 
 To restore access after revoking a client, you can [create a new OAuth client](create-oauth-client.md) and distribute the new credentials to users.
 
+## Delete an OAuth client
+
+Only revoked clients can be deleted. Deleting a client permanently removes it and can't be undone.
+
+To delete an OAuth client:
+
+1. In {{kib}}, go to **Agent Builder** → **Tools library**, click **Manage MCP**, and select **Manage MCP clients (OAuth)**.
+2. Find the revoked client. Click **Actions**, and then click **Delete**.
+3. In the **Delete [client name]?** dialog, review the warning, then click **Delete**.
+
+The client is permanently removed from the **MCP clients** page.
+
 ## Related pages
 
 - [](oauth-clients.md)
 - [](create-oauth-client.md)
 - [](connect-mcp-host.md)
-- [](manage-app-connections.md): Revoke connections at the organization level in the {{ecloud}} Console.
+- [](manage-app-connections.md): Revoke or delete connections at the organization level in the {{ecloud}} Console.