---
title: "Verify revoked integration credentials recover without duplication"
description: "Test an owned sandbox connector after external credential revocation, checking visible interruption, supported reconnection, and catch-up of missed records."
canonical_url: "https://vostride.com/agent-library/integrations-sync/revoked-credentials-reconnect.md"
md_url: "https://vostride.com/agent-library/integrations-sync/revoked-credentials-reconnect.md"
content_kind: "recipe"
topic: "integrations-sync"
---

# Verify revoked integration credentials recover without duplication

Test an owned sandbox connector after external credential revocation, checking visible interruption, supported reconnection, and catch-up of missed records.

## Risk

A connector can retain a healthy status after losing authorization or restart its import from the beginning after reconnection. Independent source identities and destination counts reveal both stale health and duplicate backfill.

## Fixtures

- An owned sandbox connector with disposable source records A and B already synchronized and a test administrator.
- An external authorization fixture that revokes this sandbox connection and later permits the product-supported reconnect flow; credentials are never printed.
- A read-only source/destination manifest plus one new source record C created while access is revoked.

## Steps

1. Verify A and B exist once in the destination and the connector initially reports its documented healthy state.
2. Confirm external credential revocation, run the documented sync action, and verify the connector displays an authorization recovery state.
3. Complete the product-supported sandbox reconnect flow and verify the intended source account and workspace are still selected.
4. Run or await the documented catch-up cycle, then verify A, B, and C appear once; inspect the independent mapping oracle and verify existing destination identities were preserved.

## Expected results

- Revoked access produces a clear connection-health failure rather than a misleading success.
- Reconnection retains the intended source account and destination mapping.
- Catch-up adds C without duplicating or replacing A and B.

## False-pass traps

- A green Connected label alone cannot prove the next authorized data request succeeded.
- Clearing all destination data before reconnect hides duplicate-backfill and identity-preservation defects.

## Cleanup

- Remove the run-specific C record and retire or restore the sandbox credential fixture securely.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa first test](/docs/agent-qa/guides/first-test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa test](/docs/agent-qa/configuration/test.md)

- [Integration and synchronization QA recipes](/agent-library/integrations-sync.md)
- [Software factory QA library](/agent-library.md)