Citric acid soak: 5% solution, which is about 1 cup dry per 1 gallon tap water.
How long to leave it soaking is very subjective, and some people have strong opinions. You should take heart that thousands of people successfully use long and short soaks successfully. If you have more buildup you’ll likely need a longer soak, soaking overnight won’t hurt if you have to (or forget to take it out), and makes scrubbing trivially easy- the crud just falls off. If you are in more of a hurry especially if the pump serves an important function and needs to get back to work, you could soak as little as 30-60 min. I’ve noticed if there is a lot of buildup but I need to get the pump back into service, soaking for 30 min, then a good scrub, then continue to soak 30 min more, then thorough scrub under tap water works great but is a lot more scrubbing work.
The other good thing about short soaks if that’s all you have time for is that it will kill whatever the biological buildup is so that even if you can’t scrub everything off at least it won’t continue to grow when you put it back into service; it has to start over again.
The main problem with citric acid for those who like to reuse it like me is that it develops a bacterial film after about a week, which is gross. If you want to make up a larger amount and keep it longer, you can add 0.1% sodium benzoate (a common food preservative), which works out to about 5 ml (1 tsp) dry per gallon. It won’t dissolve in the citric acid solution, so you need to dissolve it first in tap water then add to the citric acid.
After the soak/scrub wash off under running tap water before going back into your tank. Citric acid is not harmful to the tank in small amounts (it’s a naturally occurring organic acid, and part of normal metabolism in coral and fish) but it’s easy enough to wash off just to be safe.