Review and revoke organization apps

An OAuth application and an organization authorization are different records. A developer creates a custom application once in Developer Settings; each organization creates its own authorization only after an eligible administrator approves the application’s consent request. The backend lifecycle record formerly exposed as an OAuth installation appears once in the selected organization's Apps inventory.

When an app appears in the list

Select the organization and open Apps. The inventory contains active or suspended applications that completed OAuth consent for the selected organization. Each row identifies the organization access boundary and the user who connected the app. Owners use Manage organization apps to continue to the protected settings where a grant can be changed or revoked.

An empty list is expected when no administrator has completed consent. Creating an app under Developer Settings is not enough. The third-party application must start Authorization Code with PKCE, include the target organization_id, and redirect the administrator to RIIW. After Allow access succeeds, the authorization becomes active and appears here.

Draft applications can be installed only when the signed-in developer also owns the target organization. Approved applications can be installed by eligible administrators in customer organizations. Submitted, rejected, suspended, and revoked applications cannot start a new installation.

Review an installation

For each row, verify:

the application name and lifecycle status;
the scopes approved during consent;
whether the access still serves a known business purpose;
whether the application owner and support contact are still trusted;
whether related webhook endpoints are expected.

Scopes describe the maximum Public API access of that installation. Organization boundaries, project rules, plans, quotas, rate limits, workflow transitions, and channel consent continue to apply.

Revoke an installation

Identify the application in the organization's Apps area.
Select Disconnect and read the confirmation carefully.
Confirm only after the team using the integration is prepared for immediate loss of access.
Verify the third-party product reports a disconnected or authorization-required state.

Revocation immediately deactivates the installation principal and its access and refresh tokens. Webhook endpoints belonging to that installation are revoked, signing secrets are removed, and pending deliveries for those endpoints are cancelled. The action is audited and is not the same as a temporary operational pause.

If a user later reconnects a previously revoked app, RIIW reuses the installation relationship safely and creates a new active grant after consent. Old tokens and secrets do not become valid again.

Suspended and paused states

A platform review can suspend an OAuth app, which suspends its installations and tokens until the app is approved again. Separately, a platform administrator can temporarily pause Public API processing globally or for a selected organization or principal. A pause does not revoke credentials; retry only after the temporary service-unavailable response indicates the integration is available again.

Troubleshooting

The app is not listed: complete consent in the same organization and confirm the app is draft-and-owner-tested or approved.
Consent returns plan unavailable: the organization plan does not include OAuth.
Consent says admin access is required: an owner, admin, or role with OAuth approval capability must authorize it.
The app requests unexpected scopes: deny consent and contact the application developer.
A revoked app still has a local session: sign out of the third-party product and remove any locally cached tokens; RIIW already rejects them server-side.

For the complete app-management workflow, read Manage organization apps. Developers should follow Build an OAuth application for PKCE and application review requirements.