Administration

List active emergency controls

Grant classes switched off realm-wide and the clients, identity providers, organizations, service principals, hooks and webhooks currently disabled (SEC-020). Each list holds at most 200 IDs.

Parameters

Responses

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

Operation getEmergencyControls · Schema definitions · OpenAPI contract

Disable or re-enable a client, provider, organization, extension or grant class

One audited emergency surface (SEC-020): the change takes effect at once, is recorded in the emergency audit category with the reason, and raises the emergency_action security signal. A disabled grant class is refused at the authorization, device authorization and token endpoints (unauthorized_client) and no refresh tokens are minted while refresh_token is disabled; the operator CLI client (proudauth-cli) is exempt so the control can always be reversed. Disabling a client suspends it and revokes its grants; disabling an organization suspends it. Signing keys use emergency rotation instead.

Parameters

Request body

application/json · required

{
  "type": "object",
  "additionalProperties": false,
  "required": [
    "target_type",
    "target_id",
    "action",
    "reason"
  ],
  "properties": {
    "target_type": {
      "type": "string",
      "enum": [
        "grant_type",
        "client",
        "identity_provider",
        "organization",
        "service_principal",
        "hook",
        "webhook"
      ]
    },
    "target_id": {
      "type": "string",
      "description": "The object ID, or for grant_type one of authorization_code, refresh_token, client_credentials, urn:ietf:params:oauth:grant-type:device_code, urn:ietf:params:oauth:grant-type:token-exchange."
    },
    "action": {
      "type": "string",
      "enum": [
        "disable",
        "enable"
      ]
    },
    "reason": {
      "type": "string",
      "maxLength": 500
    }
  }
}

Responses

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

Operation applyEmergencyControl · Schema definitions · OpenAPI contract