Release a lockdown

DELETE

/security/lockdown

Needs a fresh sign-in — a session opened within the last 15 minutes —
and, when the account has a second factor, its totp now; or a
recovery session, which needs neither. Ends the lockdown rule;
devices stay suspended until reinstated one by one
(POST /security/devices/{id}/reinstate). Audited at alert, and the
account is emailed.

Needs session:manage, checked in the route in every mode; not under
an assumed identity.

Capability: session:manage, checked in the route or controller in every mode. Session:manage, a fresh sign-in and MFA (or a recovery session).

Request

Body Params application/json

Examples

Responses

🟢200

application/json

Released

Bodyapplication/json

🟠400

🟠401

🟠403

🟠429

Request Example

Shell

JavaScript

Java

Swift

curl --location --request DELETE 'https://api.prod-orm.io/security/lockdown' \
--header 'Content-Type: application/json' \
--data '{
    "totp": "string",
    "password": "pa$$word"
}'

Response Example

200 - Example 1

{
    "lockedDown": false,
    "released": true
}

Modified at 2026-10-05 04:04:32

Lock the account down

Lock a member down