Suspend a team (opens a suspension case)

POST

/api/v1/admin/teams/{id}/suspend

curl --request POST \
  --url https://api.deploybase.eu/api/v1/api/v1/admin/teams/example/suspend \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --data '{ "class": "phishing", "confirmed_transferee_ids": [ "example" ], "reason": "Phishing kit imitating a bank login at /secure/login", "subject_user_ids": [ "example" ] }'

Opens a suspension case and takes the team offline: sign-in, the API and API keys are refused, every site, preview, share link, custom domain, serverless function and form endpoint stops serving, and the team is emailed a statement of reasons carrying the reason verbatim. Nothing is deleted, so unsuspend restores the account as it was.

class is required. The cascade classes (phishing, malware, spam_network, illegal_content) need subject_user_ids: members of this team held responsible. Every other team a subject owns is suspended too, with a notice that never names this team, unless it has other owners, a paid or comped plan, or the subject became owner of this team by transfer in the last 90 days: those teams are held (they keep serving, deploys are paused) for review. A transferee listed in confirmed_transferee_ids is confirmed responsible and classified like any other subject (recorded on the case). The subjects cannot open new accounts while the case is open. copyright, payment and other suspend this team only and refuse subject_user_ids.

When the team already has an open case (case_created false): with the same class, new subjects are merged and their teams cascade, failed rows are retried and a team unsuspend of this team is undone; a single-team case given a cascade class is escalated in place (case_escalated, the original reason stays); any other class is 409 CASE_ALREADY_OPEN. The flat fields are this team’s suspend outcome: check complete, and when false hostnames_still_online. A team that could not be suspended is never a 200 (500 ORIGIN_NOT_SUSPENDED).

Authorizations

• BearerAuth

Parameters

Path Parameters

id

required

string

Team ID (UUID)

Request Body

Class, reason (sent to the team verbatim) and responsible people

Media type application/json

object

class

string

Example

phishing

confirmed_transferee_ids

Array<string>

reason

string

Example

Phishing kit imitating a bank login at /secure/login

subject_user_ids

Array<string>

Responses

200

OK

Media type application/json

object

data

meta

object

request_id

string

timestamp

string

trace_id

string

data

object

case

object

cascades

boolean

class

string

Allowed values: phishing malware spam_network illegal_content copyright payment other

closed_at

string

closed_by

string

escalated_at

string

escalated_by

string

escalated_from

Escalation evidence: set when an open single-team case was escalated in place to a cascade class. Class/Cascades are the new values; EscalatedFrom is the class it had, Reason stays the original statement and EscalationReason is the escalating admin’s.

string

Allowed values: phishing malware spam_network illegal_content copyright payment other

escalation_reason

string

id

string

opened_at

string

opened_by

string

opened_by_email

OpenedByEmail is resolved at read time for the admin view; never stored.

string

origin_team_id

string

origin_team_name

string

reason

string

subjects

Array<object>

object

case_id

string

confirmed_transferee

ConfirmedTransferee: the person became owner of the origin by a recent transfer (T1) and the admin confirmed them responsible anyway; their teams were classified like any subject’s.

boolean

confirmed_transferee_by

string

email

Email is resolved at read time from the person’s memberships for the admin view; the case stores only the hash.

string

frozen_at

string

id

string

released_at

string

released_by

string

zitadel_user_id

string

teams

Array<object>

object

case_id

string

decided_at

string

hold_reason

string

id

string

last_error

string

owner_count

integer

plan_at_decision

string

resolved_at

string

resolved_by

string

role

string

state

string

suspended_by_case

boolean

team_id

string

team_name

string

via_user_id

string

case_created

CaseCreated is false when the origin already had an open case: the request was applied to it (new subjects merged, failed rows retried, a lifted origin re-armed).

boolean

case_escalated

CaseEscalated is true when that open case was single-team and this request escalated it to the cascade class (case.escalated_from holds the class it had).

boolean

complete

Complete is true only when every step above succeeded: no error field set, no project error or unprocessed project, no failed purge. The admin UI shows a success toast only then; anything else is a red “incomplete” report and a Re-run button (DEP-774). The handler always answers 200 with the outcome, so this flag is the one thing to check.

boolean

functions_error

string

functions_reconciled

boolean

hostnames_purged

integer

hostnames_still_online

HostnamesStillOnline gathers every hostname, across projects and the final purge, that may still be serving: its pointer survived, its zone could not be purged, or its cache could not be evicted. Suspend only. Re-running the suspension retries all of them.

Array<string>

notification_error

string

notification_sent

boolean

projects

Array<object>

object

domains_processed

integer

errors

Array<string>

hostnames_still_online

HostnamesStillOnline are this project’s hostnames whose take-down step still failed after its retries. Suspend only.

Array<string>

previews_processed

integer

production

Production is one of: “disabled”, “restored”, “no_rule” (the project has no production Edge Rule to touch), “no_live_deployment” (nothing to restore it to), “not_processed: …” (the context budget ran out first), or “error: …”.

string

project_id

string

project_slug

string

shares_processed

integer

purge_errors

Array<string>

ssr_functions_error

string

ssr_functions_reconciled

boolean

suspended

Suspended is the team’s state AFTER the call.

boolean

transitioned_now

TransitionedNow is whether THIS call moved the flag. False on a re-run, which is also what keeps the statement of reasons from being sent twice.

boolean

zitadel_error

string

zitadel_org_deactivated

boolean

Example

{
  "data": {
    "case": {
      "class": "phishing",
      "escalated_from": "phishing"
    }
  }
}

400

Malformed body or ID

Media type application/json

object

code

string

details

error

string

meta

object

request_id

string

timestamp

string

trace_id

string

Example ^generated

{
  "code": "example",
  "details": "example",
  "error": "example",
  "meta": {
    "request_id": "example",
    "timestamp": "example",
    "trace_id": "example"
  }
}

401

Unauthorized

Media type application/json

object

code

string

details

error

string

meta

object

request_id

string

timestamp

string

trace_id

string

Example ^generated

{
  "code": "example",
  "details": "example",
  "error": "example",
  "meta": {
    "request_id": "example",
    "timestamp": "example",
    "trace_id": "example"
  }
}

403

Forbidden

Media type application/json

object

code

string

details

error

string

meta

object

request_id

string

timestamp

string

trace_id

string

Example ^generated

{
  "code": "example",
  "details": "example",
  "error": "example",
  "meta": {
    "request_id": "example",
    "timestamp": "example",
    "trace_id": "example"
  }
}

404

Not Found

Media type application/json

object

code

string

details

error

string

meta

object

request_id

string

timestamp

string

trace_id

string

Example ^generated

{
  "code": "example",
  "details": "example",
  "error": "example",
  "meta": {
    "request_id": "example",
    "timestamp": "example",
    "trace_id": "example"
  }
}

409

CASE_ALREADY_OPEN (details.case_id) or CASE_CLOSED

Media type application/json

object

code

string

details

error

string

meta

object

request_id

string

timestamp

string

trace_id

string

Example ^generated

{
  "code": "example",
  "details": "example",
  "error": "example",
  "meta": {
    "request_id": "example",
    "timestamp": "example",
    "trace_id": "example"
  }
}

422

CLASS_REQUIRED, INVALID_CLASS, INVALID_REASON, TOO_MANY_SUBJECTS, SUBJECTS_REQUIRED, SUBJECTS_FORBIDDEN, SUBJECT_NOT_IN_ORIGIN or INVALID_TRANSFEREE_CONFIRMATION

Media type application/json

object

code

string

details

error

string

meta

object

request_id

string

timestamp

string

trace_id

string

Example ^generated

{
  "code": "example",
  "details": "example",
  "error": "example",
  "meta": {
    "request_id": "example",
    "timestamp": "example",
    "trace_id": "example"
  }
}

500

ORIGIN_NOT_SUSPENDED (details.case_id, details.state) or INTERNAL_ERROR

Media type application/json

object

code

string

details

error

string

meta

object

request_id

string

timestamp

string

trace_id

string

Example ^generated

{
  "code": "example",
  "details": "example",
  "error": "example",
  "meta": {
    "request_id": "example",
    "timestamp": "example",
    "trace_id": "example"
  }
}

503

Service Unavailable

Media type application/json

object

code

string

details

error

string

meta

object

request_id

string

timestamp

string

trace_id

string

Example ^generated

{
  "code": "example",
  "details": "example",
  "error": "example",
  "meta": {
    "request_id": "example",
    "timestamp": "example",
    "trace_id": "example"
  }
}