# End manual attack mode

`POST /v1/attack-protection/attack-mode:deactivate` · permission `attack-protection:write`

Ends the attack mode period you turned on with [`activate`](activate-attack-mode.md), now. It writes the `attack_mode_deactivated` event and a management audit record (`attack_mode.deactivated`), with your credential as the actor.

Only your manual period ends. A period opened by the automatic trigger or by KeenAuth operations cannot be ended early: while one is open, the response still says `active: true`. When you have no open manual period, nothing is written and the current state is returned, so the call is safe to repeat.

## Request

No body.

## Response

`200 OK` with the current state, as [`GET /v1/attack-protection/attack-mode`](get-attack-mode.md) returns it.

## Errors

Every error is an `application/problem+json` body with a stable `code`.

| HTTP | `code` | When |
|---|---|---|
| 401 | `unauthenticated` | The API key is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The key lacks the `attack-protection:write` permission. |
| 429 | `rate_limited` | The rate limit was exceeded; honor `Retry-After`. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry later. |

## Example

```bash
curl -X POST https://api.eu.keenauth.com/v1/attack-protection/attack-mode:deactivate \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

CLI: `keenauth attack-protection attack-mode deactivate`