How to stop oauth subscriptions

Developer Programs
1

A number of users on https://www.constantgraph.com have integrated into SmartThings using oauth tokens. Over time some of these users have stopped using the site and the tokens have expired. However, the events continue to come in. Without a valid oauth token, how is it possible to issue an API command to delete the subscriptions?

Also I am migrating some old servers to a new location and still have a number of subscription events coming to the old server address. I have no idea what the source of these subscriptions are and they probably date back years to old test subscriptions. I could try deleting the entire app they belong to from the SmartThings CLI but I don’t know if that will work or whether it will make the situation worse.

Does anyone know how to stop these events coming in?

Many thanks.

Simon

2

Hi @constantgraph

For those old ones you mentioned, do you still have the installedAppId of the subscription you created?

3

Hi @Itati

Yes the events coming into the old server have an installedAppId of af27730f-381e-4d7e-bd2b-18955ebd8c16.

Are you able to stop them from your end?

thanks

Simon

4

The engineering team recommends starting by deleting the app. This should help stop the events, but please let us know if it doesn’t work or if any issues arise.

5

Hi @constantgraph

Do you know if the main app associated with that InstalledAppId is being used by other users?
Deleting the entire app record should remove the InstalledAppId you mentioned, but it would also delete any other InstalledAppIds under it, which could impact other users.
You mentioned it might have been for testing, but it’s not clear whether you were referring to the entire app or just that specific InstalledApp.

6

Hi @Itati
I was pretty sure the events coming in were from a test account so no big deal to delete it. I deleted the app using the cli which was slightly scary as there was no confirmation and I wanted to be absolutely sure I wasn’t deleting my production app! I was watching the server logs and after continuing for 30 seconds or so they eventually stopped coming in which is all good.

The only issue now is how to stop events coming into my production site that were created from subscriptions via oauth codes that have now expired and the users have left the site. Ideally there should be an API call that deletes a subscription of another user if you provide OAuth Client Secret.

Simon