# Turn on attack mode

`POST /v1/attack-protection/attack-mode:activate` · permission `attack-protection:write`

Puts the environment in attack mode for `duration_minutes` (15 to 1,440) from now, whatever `bot_protection.mode` and `credential_stuffing` say. Every password and one-time code step then asks for a harder bot challenge; passkey and social sign-in are not challenged. Use it when you see an attack before the automatic trigger does.

If your manual period is already open, its end moves to now plus `duration_minutes` when that is later; a shorter duration never ends it sooner (use [`deactivate`](deactivate-attack-mode.md)). Opening a period writes the `attack_mode_activated` event and a management audit record (`attack_mode.activated`); an extension writes the audit record `attack_mode.extended`. Your credential is the actor. Send an `Idempotency-Key` header to retry safely.

## Request

```json
{ "duration_minutes": 60 }
```

| Field | Type | Required | Description |
|---|---|---|---|
| `duration_minutes` | integer | yes | 15 to 1,440. |

## Response

`200 OK` with the current state, as [`GET /v1/attack-protection/attack-mode`](get-attack-mode.md) returns it.

## Errors

Every error is an `application/problem+json` body with a stable `code`.

| HTTP | `code` | When |
|---|---|---|
| 400 | `malformed_request` | The body is not a JSON object. |
| 400 | `unknown_field` | The body has a field other than `duration_minutes`. |
| 422 | `validation_failed` | `duration_minutes` is missing, not an integer, or outside 15 to 1,440 (`errors[].pointer` is `/duration_minutes`). |
| 401 | `unauthenticated` | The API key is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The key lacks the `attack-protection:write` permission. |
| 429 | `rate_limited` | The rate limit was exceeded; honor `Retry-After`. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry later. |

## Example

```bash
curl -X POST https://api.eu.keenauth.com/v1/attack-protection/attack-mode:activate \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 7b2f0c1e-attack-mode-1" \
  -d '{"duration_minutes": 60}'
```

CLI: `keenauth attack-protection attack-mode activate --duration-minutes 60`