Skip to Content
IntegrationsMarketplace OffersDisconnecting

Marketplace Offers — Disconnect

Disconnecting the Marketplace connector is an administrator action, done in FlowState’s web app.

How to disconnect

  1. Go to Settings → Integrations → Marketplace in FlowState.
  2. Click Disconnect.
  3. Confirm the action when prompted.

You need the tenant:marketplace:offers:write permission, which is granted to tenant owners and admins.

You can also disconnect via MCP: disconnect_marketplace_connector().

What happens when you disconnect

Disconnecting removes the connector record — role ARN, account id, and ExternalId — entirely. GET /v1/tenants/{id}/integrations/marketplace immediately reports {"connected": false}. Calling disconnect again on an already-disconnected tenant is a no-op, not an error.

Immediate effects

  • Any create, clone, release, availability, or replacement call made after disconnecting fails with a 409 (No Marketplace connector is configured for this tenant) until you reconnect.
  • The FlowStateMarketplaceConnector role in your AWS account is untouched — FlowState doesn’t delete it. It simply can no longer be used, since the ExternalId is gone along with the connector record. Reconnecting generates a new one; see Reconnecting.

What is preserved

  • Offers and agreements already created in AWS Marketplace. Disconnecting only removes FlowState’s ability to reach your account — it never touches Marketplace objects. A released offer keeps running, and keeps being billed (billing is read live from AWS — see Overview → Billing), exactly as before.
  • Uploaded EULA documents, stored in FlowState per tenant.
  • Job records for past create/clone/release calls. Polling an old job_id after disconnecting still works for a job that already finished. A job still in_progress at the moment you disconnect will show as failing until you reconnect, since finishing the poll needs a working connector.
  • Audit events — the history of connect/disconnect and every offer action.

What is not preserved

  • The ExternalId. Reconnecting always generates a new one.

Reconnecting

  1. Go to Settings → Integrations → Marketplace and start the connection flow again (or call GET /v1/tenants/{id}/integrations/marketplace, which generates a fresh ExternalId since none exists).
  2. Update the trust policy on your existing FlowStateMarketplaceConnector role — or create a new one — with the new ExternalId, using whichever method you used originally (edit the OpenTofu variable and re-apply, update the CloudFormation stack parameter, or edit the trust policy JSON directly in the IAM console). See Trust policy.
  3. Paste the Role ARN (unchanged, if you kept the same role) and connect again.

Any offers or agreements created before disconnecting are unaffected — Marketplace Offers never stored a copy of them, so there is nothing to resync.

What to do in your AWS account after permanent removal

If you are permanently removing the Marketplace Offers integration and want to clean up your AWS account:

  1. Delete the FlowStateMarketplaceConnector IAM role.
    • IAM console → Roles → FlowStateMarketplaceConnector → Delete.
    • Or via the IaC tool you used to create it: tofu destroy, or delete the CloudFormation stack.

Cleaning up the IAM role does not affect FlowState’s own data (job records, uploaded EULA documents, or the audit log). It only prevents FlowState from calling the AWS Marketplace Catalog API on behalf of your account. Offers and agreements already created in AWS Marketplace remain in AWS Marketplace — FlowState never deletes them.

Admin viewTroubleshooting