Deactivate a directory

POST /v1/directories/{directory_id}:deactivate · permission directories:write

Deactivates the directory (state becomes inactive). Its tokens stay valid, but the directory answers every SCIM request with the same 401 as an invalid token, and a directory that was never used no longer activates on its first request. Users and groups already synced are kept. Undo it with POST /v1/directories/{directory_id}:activate. The operation is idempotent: when the directory is already deactivated nothing is written, the version stays and the directory is returned with 200. The write is audited as directory.deactivated.

Request

Field Type Required Description
directory_id path yes SCIM directory ID (dir_…).
Idempotency-Key header no Replays the first response for a retried request.

The body is optional and has no fields ({}). If-Match is not used.

Response

200 OK with the directory and its ETag.

{
  "id": "dir_01j9xm2n4p6q8r0s2t4v6w8y0z",
  "organization_id": "org_01j9xk3m7q8r2s4t6v8w0y2z4a",
  "type": "scim",
  "name": "Okta",
  "state": "inactive",
  "base_url": "https://acme.eu.keenauth.app/scim/v2/dir_01j9xm2n4p6q8r0s2t4v6w8y0z",
  "created_at": "2026-10-19T09:31:00.123456Z",
  "last_request_at": null,
  "provisioning_mode": "user_store",
  "attribute_allowlist": ["title", "urn:ietf:params:scim:schemas:extension:enterprise:2.0:user:department"],
  "unverified_domain_action": "invite",
  "delete_action": "remove_membership",
  "on_delete_memberships": "keep",
  "mass_deprovision_guard": {"enabled": true, "percent": 20, "absolute_min": 25},
  "send_welcome_email": false
}

Errors

HTTP code When
400 unknown_field The body contains a field.
404 not_found The directory does not exist in this environment.
409 conflict The directory is being deleted.
422 idempotency_key_reuse The Idempotency-Key was used for a different request.
401 unauthenticated The credential is missing, invalid or revoked.
403 insufficient_permissions The credential lacks the required permission.
429 rate_limited The rate limit was exceeded; retry after the Retry-After period.
503 service_unavailable Directory sync is temporarily unavailable or not configured in this deployment; retry after the Retry-After period.

Example

curl -i -X POST "https://api.eu.keenauth.com/v1/directories/dir_01j9xm2n4p6q8r0s2t4v6w8y0z:deactivate" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"