---
id: WF-PFM-INT-007
title: 'Move bindings, then disconnect or discard a connection'
trigger: The initiating integration administrator starts this flow.
product_area: platform
module: integrations
revision: 1
status: draft
design_intent: confirmed
implementation_evidence: observed
origin: >-
  docs/milestones/INTG-M1-find-install-connect.md#Decisions D7, D9, D10;
  docs/milestones/INTG-M2-calls-through-the-gateway.md#Decisions M2-D9
inference: []
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
implements:
  - CAP-PFM-INT-004
  - CAP-PFM-INT-007
moves:
  - STATE-PFM-INT-003
  - STATE-PFM-INT-004
  - STATE-PFM-INT-005
  - STATE-PFM-INT-006
crosses: []
idempotency: Already moved bindings no longer match the source; disconnection rejects an already disconnected account.
concurrency: Binding moves commit one scope at a time; disconnection checks remaining current references again.
hops:
  - 'n': 1
    actor_or_service: Integration administrator
    action: Request disconnection with the optional reason.
    anchor: 'services-platform:modules/integrations/services/connections/transition.ts:disconnectConnection'
    seam: sync
    on_failure: Display the service’s lifecycle refusal.
    left_inconsistent: The account remains open on refusal.
    observer: The administrator
    provenance: observed
    source: 'services-platform:modules/integrations/services/connections/transition.ts:disconnectConnection'
  - 'n': 2
    actor_or_service: Integrations service
    action: Refuse any current binding reference and return the bindings that block removal.
    anchor: 'services-platform:modules/integrations/services/state-refusals.ts:connectionHasBindings'
    seam: sync
    on_failure: Return actionable binding details with the conflict.
    left_inconsistent: No binding is silently removed.
    observer: The administrator
    provenance: observed
    source: 'services-platform:modules/integrations/services/state-refusals.ts:connectionHasBindings'
  - 'n': 3
    actor_or_service: Integration administrator
    action: Choose an active replacement account and optionally preview moving active bindings.
    anchor: 'services-platform:modules/integrations/services/bindings/binding-operations.ts:moveBindings'
    seam: sync
    on_failure: Report each validation failure.
    left_inconsistent: Bindings that fail validation remain on their original account.
    observer: The administrator
    provenance: observed
    source: 'services-platform:modules/integrations/services/bindings/binding-operations.ts:moveBindings'
  - 'n': 4
    actor_or_service: Integrations service
    action: >-
      Replace no more than two hundred active bindings through ordinary put validation, committing each
      separately.
    anchor: 'services-platform:modules/integrations/services/bindings/binding-operations.ts:moveBindings'
    seam: sync
    on_failure: Return refusals alongside successful moves.
    left_inconsistent: 'Partial movement is possible, and invalid bindings remain unmoved.'
    observer: The administrator and binding history
    provenance: observed
    source: 'services-platform:modules/integrations/services/bindings/binding-operations.ts:moveBindings'
  - 'n': 5
    actor_or_service: Integration administrator
    action: Request disconnection again after reviewing remaining references.
    anchor: 'services-platform:modules/integrations/services/connections/transition.ts:disconnectConnection'
    seam: sync
    on_failure: Reject any binding added or still present since the move.
    left_inconsistent: The account stays open until references are resolved.
    observer: The administrator
    provenance: observed
    source: 'services-platform:modules/integrations/services/connections/transition.ts:disconnectConnection'
  - 'n': 6
    actor_or_service: Integrations service
    action: >-
      Commit final disconnection or unfinished-link discard with endpoint disabling, credential revocation,
      notice clearing and both audits.
    anchor: 'services-platform:modules/integrations/services/connections/transition.ts:disconnectConnection'
    seam: sync
    on_failure: A database error rolls back the database transition.
    left_inconsistent: Secret deletion is an external follow-up and does not share database rollback.
    observer: Integration history
    provenance: observed
    source: 'services-platform:modules/integrations/services/connections/transition.ts:disconnectConnection'
evidence:
  - >-
    services-platform at ad3f6a65: modules/integrations/services/connections/transition.ts;
    services/bindings/binding-operations.ts; services/state-refusals.ts;
    docs/milestones/INTG-M1-find-install-connect.md (D7, D9, D10);
    docs/milestones/INTG-M2-calls-through-the-gateway.md (M2-D9)
  - >-
    react-console at baf6dae3: components/integrations/connection-detail.tsx;
    lib/integrations/move-bindings.ts
  - >-
    services-platform:modules/integrations/tests/e2e/disconnect-and-uninstall.e2e.spec.js#answers a
    disconnection of a bound connection 409, code connection_has_bindings, naming each binding
  - >-
    services-platform:modules/integrations/tests/e2e/disconnect-and-uninstall.e2e.spec.js#answers a
    disconnection of a bound connection 409, code connection_has_bindings, naming each binding
  - >-
    services-platform:modules/integrations/tests/integration/services/bindings/binding-move.integration.spec.js#replaces
    every active binding of the source with one choosing the target, at the same scope, policy and note
  - >-
    services-platform:modules/integrations/tests/integration/services/bindings/binding-move.integration.spec.js#replaces
    every active binding of the source with one choosing the target, at the same scope, policy and note
  - >-
    services-platform:modules/integrations/tests/e2e/disconnect-and-uninstall.e2e.spec.js#answers a
    disconnection of a bound connection 409, code connection_has_bindings, naming each binding
  - >-
    services-platform:modules/integrations/tests/integration/services/connections/transition.integration.spec.js#disables
    the connection’s webhook endpoints
controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CHG-007, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-002, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-SEC-001, TC-SEC-002, TC-SEC-003, TC-SEC-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Move bindings, then disconnect or discard a connection

## What It Does

Closing an account requires resolving every current routing reference first. Administrators can move active bindings individually, then request final disconnection. An unfinished first setup can instead be discarded through the same endpoint.

## The Flow

```mermaid
sequenceDiagram
  participant P0 as Integration administrator
  participant P1 as Integrations service
  P0->>P0: 1. Request disconnection with the optional reason.
  P1->>P1: 2. Refuse any current binding reference and return the bindings that block removal.
  P0->>P0: 3. Choose an active replacement account and optionally preview moving active bindings.
  P1->>P1: 4. Replace no more than two hundred active bindings through ordinary put validation
  P0->>P0: 5. Request disconnection again after reviewing remaining references.
  P1->>P1: 6. Commit final disconnection or unfinished-link discard with endpoint disabling
```

## When Something Fails

Display the service’s lifecycle refusal. The account remains open on refusal. Return actionable binding details with the conflict. No binding is silently removed. Report each validation failure. Bindings that fail validation remain on their original account. Return refusals alongside successful moves. Partial movement is possible, and invalid bindings remain unmoved. Reject any binding added or still present since the move. The account stays open until references are resolved. A database error rolls back the database transition. Secret deletion is an external follow-up and does not share database rollback.

## Open Design Questions

Invalid current bindings block disconnection but do not participate in the active-binding move. The account-closing journey must make that remaining work clear.