Lock the account down

POST

/security/lockdown

The emergency switch. Signs out every interactive, device, delegated,
browser and CLI session of the account — this one too — and, with
includeServices, its service sessions (databases, CI, agents); asks
the klock service to suspend every device; and engages an
account-scope rule that refuses every request for 15 minutes (423
lockdown), so a sign-in made with stolen credentials in that window
gets a token it cannot use. Only a recovery session gets through. It
is audited at alert and the account is emailed.

Needs session:manage and a step-up, checked in the route in every
mode: a fresh one, or a totp (or from the browser a password) in
the body. A klock session on an account with no second factor needs
neither — its device signature is the proof. Not under an assumed
identity.

Capability: session:manage, checked in the route or controller in every mode. Session:manage and a step-up, checked in the route.

Request

Body Params application/json

Examples

Responses

🟢200

application/json

Locked down

Bodyapplication/json

🟠400

🟠401

🟠403

🟠429

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://api.prod-orm.io/security/lockdown' \
--header 'Content-Type: application/json' \
--data '{
    "totp": "string",
    "password": "pa$$word",
    "includeServices": false
}'

Response Example

200 - Example 1

{
    "lockedDown": true,
    "revoked": 0,
    "suspended": 0,
    "devices": [
        "string"
    ],
    "lockdownUntil": "2019-08-24T14:15:22.123Z"
}

Modified at 2026-10-05 04:04:32

Is the account locked down

Release a lockdown