Consumer Organization Actions
Endpoints
| Method | Path | Description |
|---|---|---|
POST | /consumer-organizations/{code}/actions/suspend | Stop the traffic of the organization and the organizations below it; reversible |
POST | /consumer-organizations/{code}/actions/resume | Lift the suspension and re-enable exactly the consumers the suspend disabled |
POST | /consumer-organizations/{code}/actions/revoke-credentials | Permanently revoke the organization's consumers and every token issued before the call |
All three are under /apiops/projects/{projectName}, take no request body, require a Personal API Access Token (Authorization: Bearer YOUR_TOKEN) and answer 200 OK with the organization, in the shape of Get Consumer Organization.
Suspend and resume
Both actions are idempotent: suspending a suspended organization, or resuming an active one, repeats safely and needs no Idempotency-Key header. The organization's suspended field is true after a suspend and false after a resume.
While the organization is suspended, the gateway refuses every consumer of it and of the organizations below it, and their API clients. Suspend also disables and redeploys the enabled consumers of the organization's applications. A consumer that was already disabled before the suspend stays disabled after the resume, because resume re-enables exactly the consumers the suspend disabled.
Revoke credentials
revoke-credentials is one-way. Each consumer it revokes answers 409 lifecycleConflict (params.reason = consumerRevoked) to a later enable, resume or update. There is no undo and no resume.
The action revokes the consumers filed under the organization and the consumers of its applications, also those already disabled. A consumer of an organization below it is not revoked: tokens issued to the API clients below the organization before the call stop working, and those clients can take new tokens. The applications stay; their API clients can take new tokens too.
The answer carries one extra field:
| Field | Type | Description |
|---|---|---|
revokedCredentialCount | integer | How many consumers this call revoked; a repeated call counts 0. Present on the answer of revoke-credentials only |
Administration project and portal roles
Unlike the rest of this API, these actions are also accepted on the administration project's path (/apiops/projects/admin/consumer-organizations/{code}/actions/...), where portal organizations live. Who passes depends on the organization and on everything below it, because the actions reach the consumers, applications and API clients of the organizations below it too:
| Caller | Organization of the project, with no portal application and no record of another project below it | Any other organization |
|---|---|---|
| System Administrator, Portal Business, Portal Manager | Passes, for any organization, on the project path or on admin, without project membership | Passes, same as the left column |
Project Identity MANAGE | Passes, on the organization of that project, organizations below it included | 403 permissionDenied (params.reason = portalRoleRequired); nothing is changed |
| Any other caller | 404 resourceNotFound | 404 resourceNotFound |
Errors
| Status | Error key | Cause |
|---|---|---|
| 403 | permissionDenied | The caller passes only through the project's IDENTITY + MANAGE permission, and the organization or an organization below it holds a portal application or a record filed under another project (params.reason = portalRoleRequired); nothing is changed |
| 404 | resourceNotFound | The code is unknown, or the project is outside the scope of the caller |
cURL Example
curl -X POST \
"https://demo.apinizer.com/apiops/projects/MyProject/consumer-organizations/acme-partners/actions/suspend" \
-H "Authorization: Bearer YOUR_TOKEN"
curl -X POST \
"https://demo.apinizer.com/apiops/projects/MyProject/consumer-organizations/acme-partners/actions/revoke-credentials" \
-H "Authorization: Bearer YOUR_TOKEN"
Permissions
- User must have
IDENTITY+MANAGEpermission in the project, or hold the System Administrator, Portal Business or Portal Manager role - A project outside the scope of the caller answers
404 resourceNotFound, never403; the403above is the only one these actions return