# Managing and revoking

> What the Connections screen shows, how to rotate a credential without touching approvals, and what revoking a connection does across every agent.

Source: https://docs.getgraft.ai/graft/connections/managing-and-revoking

**Connections** lists every vendor account you have given Graft, one card each. A card shows the connection's name, its vendor slug, its scheme and its status; the hosts the proxy pins its calls to; its scheme parameters; the tools authored against its vendor, each with its read-only, write or destructive badge; and, folded away, its recent vendor calls. When the credential was set is shown. The credential is not.

## Status

- **connected**, with when the credential was set (or, for OAuth, when you consented and when the token was last refreshed).
- **connected**, marked **via pipedream**, for a connection made with one click on Graft Cloud: the card says the account's token is held at Pipedream, never in Graft, and that every call relays through it. There is no credential to re-enter, so the card has no credential button.
- **awaiting credential**: registered, no secret entered yet. Its tools cannot run.
- **awaiting consent** and **needs re-consent**, for an OAuth connection. See [OAuth with your own client](https://docs.getgraft.ai/graft/connections/oauth-with-your-own-client.md).
- **revoked**, with **awaiting reconnection** beside it.

## Rotating a credential

When a key has been rotated at the vendor, choose **Re-enter credential** on the card. The dialog shows the scheme and the hosts the credential is sent to, renders the scheme's secret fields, and **Save credential** replaces the old credential with the new one. Nothing else about the connection changes, and no approval is touched: your standing answers about the vendor's tools are about the tools, and the credential changing is not a reason to ask again.

The agent can start this for you. After a vendor `401` or `403` it calls `request_credential` with the connection and what the vendor said, and relays a link. The card under **Pending actions** reads *your agent asks to re-enter the credential for \<name\>*, quotes the vendor's answer in the agent's words, and takes the new credential. Once you save it, the agent's waiting call answers `connected` and it calls the vendor again.

## Revoking a connection

**Revoke** on the card, then **Revoke connection** in the dialog. Because a connection is yours and not any agent's, a revoke reaches every agent at once:

- The credential is cleared, and for an OAuth connection the client secret and the tokens with it.
- Every agent's approvals for the vendor's tools are deleted, and every build approval for this connection.
- Every open ask about this connection is closed.
- For a connection made through Pipedream, Graft asks Pipedream to delete the account link, then forgets the account id. If Pipedream cannot be reached, everything in Graft is still revoked and the card says **pipedream still holds this account**, with **Retry release**; the account id is kept until the retry succeeds, so the retry knows what to release.

The tools themselves stay in the toolbox, marked **awaiting reconnection** on the card. Nothing is deleted. The confirmation names what was removed: so many tool approvals, so many build approvals, so many open asks.

## Reconnecting

A revoked connection is still listed, and **Reconnect** is the way back: the same dialog as re-entering a credential, with a new credential (or, for OAuth, the client secret and then the consent). Once reconnected, its tools are usable again and ask again on their own terms: reads pass, any other tool asks once, and any **Ask every time** setting went with the withdrawn approvals. The build approval is asked once more before an agent acquires against it.

An agent can start the reconnection too. `request_credential` on a revoked connection produces a card marked **revoked**, and the re-entry is the reconnection.

A revoked connection made through Pipedream has nothing to re-enter. When an agent next asks to connect that vendor, the one-click card comes back, and completing it reconnects the same connection, so the agents that had it in scope keep it.

## Scope is on the agent's page

Which agents may use a connection is not decided here. Open an agent under **Agents**, tick or untick the connection under **Scope**, and **Save scope**; it is in effect on the agent's next call. A connection an agent proposed is already in that agent's scope; every other agent gets it when you add it.

## Try it

```text
The Unleashed key was rotated this morning. Ask me for the new one.
```

```text
Which of your tools would stop working if I revoked the GitHub connection?
```

```text
Do you have access to the Notion connection, or do I need to add it to your scope?
```