Disconnect and reconnect social accounts
Stop future access, preserve audit context, and guide users through a clean authorization refresh.
Use POST /v1/social-accounts/:id/disconnect to mark the account disconnected and revoke or clear stored authorization where supported. Preserve sanitized account and historical post records, then create a new authorization URL when the user chooses to reconnect.
What this means in practice
Use POST /v1/social-accounts/:id/disconnect to mark the account disconnected and revoke or clear stored authorization where supported. Preserve sanitized account and historical post records, then create a new authorization URL when the user chooses to reconnect.
Use the documented brand and account boundaries consistently across the scheduler, REST API, SDK, MCP tools, SSE consumers, and webhooks. That makes the same social operation explainable to an operator and reproducible by an integration.
Implementation checklist
Warn users which future posts, syncs, inbox actions, and analytics will be affected.
Cancel or surface scheduled targets that can no longer dispatch.
Call disconnect with an owner or admin role and accounts:write scope.
Preserve historical delivery results and provider links for audit.
Run capability discovery again after reconnection.
Example request
This example uses a server-side API key and an explicit brand selection. Replace placeholder values and keep credentials out of browser bundles, client logs, and source control.
curl --request POST \
--url 'https://postapi.app9.co/v1/social-accounts/ACCOUNT_ID/disconnect' \
--header 'Authorization: Bearer APP9_POST_API_KEY' \
--header 'X-App9-Post-Brand: BRAND_ID' \
--header 'Content-Type: application/json' \
--data '{}'Operational details
Disconnecting access is different from deleting historical brand records.
Provider-side revocation behavior can vary; App9 Post still fails closed after local disconnect.
A reconnected account can have different scopes and capabilities than before.
Common mistakes to avoid
- Do not erase delivery history just because credentials were removed.
- Do not keep dispatching with cached tokens after a disconnect request.
- Do not promise reconnection will restore permissions the provider no longer grants.