APN Sync — Disconnect

How to disconnect

1. Go to Settings → Integrations → APN in FlowState.
2. Click Disconnect.
3. Confirm the action when prompted.

You need the tenant:integrations:apn:configure permission, which is granted to tenant owners and admins.

You can also disconnect via MCP: disable_apn_integration().

What happens when you disconnect

Immediate effects

• The APN integration record is marked disabled.
• features.apn is set to false for the tenant.
• APN outbound sync stops: no new messages are enqueued. In-flight messages in the SQS queue complete their current retry attempt and then drop.
• APN inbound event processing stops: new EventBridge events from Partner Central are received by FlowState’s shared handler but dropped after the tenant lookup confirms the integration is disabled.
• The stored ExternalId is invalidated (a new ExternalId is generated on reconnect). This ensures the existing FlowStateAPNConnector role in your AWS account cannot be used until you explicitly reconnect.
• apn_sync_status on all affected deals (those with a non-terminal sync state) is set to disconnected via a background sweep.

What is preserved

• APN sync state — your sync state is tracked per deal and is retained, along with its last-known state, timestamps, and conflict state. If you reconnect, the sync engine resumes from the recorded state without re-creating opportunities that already exist in Partner Central.
• HubSpot deal properties — the values already written to the flowstate_apn property group on deals remain unchanged in HubSpot. They are frozen at their last-written values.
• Audit events — the history of sync operations is preserved in the audit log.
• Field mapping overrides — per-tenant field mapping customizations are preserved.

What is not preserved

• The ExternalId. Reconnecting generates a new ExternalId. You must update the trust policy on the FlowStateAPNConnector role in your AWS account with the new ExternalId before reconnecting.

How to reconnect

1. Go to Settings → Integrations → APN.
2. Click Reconnect.
3. The wizard generates a new ExternalId and shows an updated trust policy snippet.
4. Update the trust policy on the FlowStateAPNConnector role in your AWS account. Use the same method you used originally (update the Tofu variable, update the CloudFormation stack parameter, or edit the trust policy JSON in the IAM console).
5. Paste the Role ARN (unchanged) and click Verify.
6. After verification succeeds, choose catalog (Sandbox or Production) and click Done.

Sync resumes from the last recorded state for each deal. Deals that were disconnected transition back to pending and are re-enqueued for sync.

What to do in your AWS account after permanent removal

If you are permanently removing the FlowState integration and want to clean up your AWS account:

1. Delete the FlowStateAPNConnector IAM role from the Partner-linked AWS account.
   • IAM console → Roles → FlowStateAPNConnector → Delete.
   • Or via the IaC tool you used to create it: tofu destroy or delete the CloudFormation stack.
2. The AWSPartnerCentralOpportunityManagement managed policy is AWS-managed and does not need cleanup.

Cleaning up the IAM role does not affect FlowState’s data (sync-state rows, HubSpot property values, or audit log). It only prevents FlowState from calling Partner Central on behalf of your account — which is what you want if you are permanently removing the integration.

Opportunities already created in Partner Central remain in Partner Central. FlowState does not delete Partner Central opportunities on disconnect.