Most APIs document the happy path for connecting a credential. Fewer document the exit path. That becomes a real problem during offboarding, incident response, or vendor reviews, because “disconnect” can mean anything from “stop refreshing this token” to “delete every stored secret right now.
Source: [Dev.to](https://dev.to/anakin_writers/design-api-access-revocation-so-users-know-what-actually-gets-deleted-31cg)