# Suspend an application

`POST /v1/applications/{application_id}:suspend` · permission `applications:write`

Sets the application's `status` to `suspended`. From then on the application cannot obtain new tokens: authorization, PAR, device authorization, the token endpoint (including refresh and `client_credentials`), introspection and revocation all refuse it as a client. The suspension also ends what the application already holds: KeenAuth revokes its active refresh token families opened before the suspension (reason `client_revoked`) and marks its `client_id`, so introspection and userinfo reject access tokens issued to it before that point. A resource server that only verifies the JWT signature keeps accepting such an access token until it expires. The application's client credentials are kept, so resuming it needs no new secret. The request has no body (empty or `{}`). Suspending an application that is already suspended changes nothing and returns the current application with the same version. The change is written to the management audit log as `application.updated` and published as `application_changed` and `application_status_changed` events.

## Request

**Headers**: `If-Match: "<version>"` (optional). With `If-Match` the change only applies to that version (`412` otherwise); without it, the latest version is used and the request is retried if another writer changes the application at the same time. Send an `Idempotency-Key` header to make retries safe.

| Parameter | In | Required | Description |
|---|---|---|---|
| `application_id` | path | yes | Application id, prefixed `app_`. |

## Response

`200 OK` with the application (`"status": "suspended"`) and its `ETag`.

## Errors

Every error is an `application/problem+json` body with a stable `code`.

| HTTP | `code` | When |
|---|---|---|
| 400 | `malformed_request`, `unknown_field` | A body was sent that is not valid JSON or has a field. |
| 401 | `unauthenticated` | The API key is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The key lacks the `applications:write` permission. |
| 404 | `not_found` | The application does not exist in this environment (or the id is malformed). |
| 412 | `precondition_failed` | The version in `If-Match` is stale. |
| 429 | `rate_limited` | The rate limit was exceeded; honor `Retry-After`. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry later. |

## Example

```bash
curl -X POST https://api.eu.keenauth.com/v1/applications/app_6f8d0cjgbmf0gtn2rg6pscp3cg:suspend \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)"
```

CLI: `keenauth applications suspend app_6f8d0cjgbmf0gtn2rg6pscp3cg --yes`