Suspend an application
POST /v1/applications/{application_id}:suspend · permission applications:write
Sets the application's status to suspended. From then on the application cannot obtain new tokens: authorization, PAR, device authorization, the token endpoint (including refresh and client_credentials), introspection and revocation all refuse it as a client. The suspension also ends what the application already holds: KeenAuth revokes its active refresh token families opened before the suspension (reason client_revoked) and marks its client_id, so introspection and userinfo reject access tokens issued to it before that point. A resource server that only verifies the JWT signature keeps accepting such an access token until it expires. The application's client credentials are kept, so resuming it needs no new secret. The request has no body (empty or {}). Suspending an application that is already suspended changes nothing and returns the current application with the same version. The change is written to the management audit log as application.updated and published as application_changed and application_status_changed events.
Request
Headers: If-Match: "<version>" (optional). With If-Match the change only applies to that version (412 otherwise); without it, the latest version is used and the request is retried if another writer changes the application at the same time. Send an Idempotency-Key header to make retries safe.
| Parameter | In | Required | Description |
|---|---|---|---|
application_id |
path | yes | Application id, prefixed app_. |
Response
200 OK with the application ("status": "suspended") and its ETag.
Errors
Every error is an application/problem+json body with a stable code.
| HTTP | code |
When |
|---|---|---|
| 400 | malformed_request, unknown_field |
A body was sent that is not valid JSON or has a field. |
| 401 | unauthenticated |
The API key is missing, invalid or revoked. |
| 403 | insufficient_permissions |
The key lacks the applications:write permission. |
| 404 | not_found |
The application does not exist in this environment (or the id is malformed). |
| 412 | precondition_failed |
The version in If-Match is stale. |
| 429 | rate_limited |
The rate limit was exceeded; honor Retry-After. |
| 503 | service_unavailable |
A dependency is temporarily unavailable; retry later. |
Example
curl -X POST https://api.eu.keenauth.com/v1/applications/app_6f8d0cjgbmf0gtn2rg6pscp3cg:suspend \
-H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
-H "Idempotency-Key: $(uuidgen)"
CLI: keenauth applications suspend app_6f8d0cjgbmf0gtn2rg6pscp3cg --yes