Connected Apps

Which application is connected.

Scope-bound access: agent:read for context/project tools, plus separately granted Time Management scopes for confirmed entries, timers, submission, and eligible approval decisions.

The management page shows the real identity-level state (verified, needs recovery, disconnected, or not connected). The Supported Clients list below shows which clients currently use that one shared identity — it is not a list of independently-connected apps.

Disconnecting one specific Connected App is not available — and can't be, on the current data model. federated_identities has unique(issuer, subject) with no client/application id in the key, so any disconnect revokes the caller's whole delegated identity — shared by every Connected App using the same identity provider — not one app's grant. Per-Connected-App revocation needs a client/grant-scoped identity model that doesn't exist yet, a blocking prerequisite once more than one app is simultaneously connectable. A real self-service control for the identity-wide disconnect does exist today (see 'Delegated access disconnect' below).

Self-service "Disconnect DigitalStack access" on the management page revokes your whole delegated identity (every Connected App using it) in one action. A self-initiated disconnect is reconnect-eligible afterward through the normal connect flow, with no administrator needed.

You can see that you authorized your own delegated access, when, and its current status, on the management page.

A broader, admin/team-facing management view of who on the team authorized each connection — distinct from seeing your own authorization (see Self-authorization visibility, which is real today).

Per-resource restrictions beyond scopes.

When your delegated identity last successfully authenticated a request, shown on the management page (approximate, throttled to roughly every 10 minutes). This reflects successful authentication, not a confirmed, fully-authorized API call — per-route scope/capability checks still happen afterward — and it is never an exact request log.