Capability-gated endpoints that flip the account's status, stamp the time and reason, and write an audit entry naming the actor. Suspension is enforced where the request first resolves an account — the subdomain lookup returns nothing for a suspended account, and branding resolution treats it as no tenant.
Also called: suspend account · cut off access · reactivate · turn an account back on
- 1The caller must hold the tenants.manage capability; anything less returns a 403 naming the missing capability.
- 2The account row records status, suspended-at time and the reason.
- 3An audit row is written with the action, the account, the reason and the actor.
- 4The subdomain resolution cache is short (five minutes) so the suspension lands quickly.
- 5A suspended account's branding stops being served, so the platform default returns.
The suspend endpoint's comment is explicit about the point of the audit row: it flips status 'and writes an audit_log row so we can prove who did it and why.' The five-minute cache TTL in the subdomain resolver is chosen for the same reason it is documented there — 'so org renames/suspensions take effect quickly.' Branding refusal is a judgement recorded in tenantBranding: 'a frozen org shouldn't keep branding the platform that turned them off.'
- Access removal with no record of who did it or why.
- A suspension that takes effect only after a deploy or cache expiry.
- A suspended account continuing to look like a live branded product.
See it on your own jobs
Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.
or keep browsing features →