Suspend an agent

POST

/v1/agents/{id}/suspend

const url = 'http://127.0.0.1:8080/v1/agents/example/suspend';
const options = {
  method: 'POST',
  headers: {
    'Deedglass-Version': '2026-10-01',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: '{"reason":"Refund loop in staging"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url http://127.0.0.1:8080/v1/agents/example/suspend \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Deedglass-Version: 2026-10-01' \
  --data '{ "reason": "Refund loop in staging" }'

A planned pause. New calls are refused with 403 agent_suspended; resume undoes it. Seals agent.suspended. Idempotent: suspending a suspended agent returns 200 unchanged with deed: null. Suspending a stopped agent is 409 conflict. An admin+ Console session (with the Deedglass-CSRF header) or an org admin key; agent keys get 403 insufficient_scope.

Authorizations

bearerAuth
sessionCookie

Parameters

Path Parameters

required

string

The agent id (agt_…).

Header Parameters

Deedglass-Version

string

/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/

The API version (YYYY-MM-DD). Leave it out to use your org’s pinned version (public routes use the latest). An unknown version is 400 api_version_invalid.

Deedglass-CSRF

string

Needed when the request uses a Console session (it changes state); without it the answer is 403 csrf_failed. Not sent with an API key.

Idempotency-Key

string

>= 1 characters <= 255 characters

1 to 255 printable ASCII characters. A retry with the same key and body returns the stored response with Deedglass-Idempotent-Replayed: true for 24 hours.

Request Body

An optional reason. It goes into the deed and the Console; an agent never sees it.

application/json

object

reason

One line

string

<= 280 characters

Example

{
  "reason": "Refund loop in staging"
}

Responses

200

The agent, with the deed (null when it was already suspended).

application/json

object

object

required

string

Allowed value: agent

required

string

/^agt_[0-7][0-9a-hjkmnp-tv-z]{25}$/

name

required

Unique in the org and immutable.

string

/^[a-z0-9][a-z0-9-]{1,62}$/

description

required

string

<= 500 characters

labels

required

At most 32. Keys match ^[a-z0-9][a-z0-9._/-]{0,62}$; values are up to 128 printable characters. Policies match on labels, so every change seals a deed.

object

<= 32 properties

key

additional properties

string

<= 128 characters

budgets

required

An agent’s limits; a limit left out means none. Money is in minor units (cents for usd, paise for inr). Deedglass stores and checks them now; the Gate enforces them when it ships.

object

calls_per_minute

integer

>= 1 <= 1000000

calls_per_day

integer

>= 1 <= 100000000

spend_per_day

object

amount

required

Minor units.

integer

<= 9007199254740991

currency

required

Lowercase ISO 4217

string

/^[a-z]{3}$/

status

required

string

Allowed values: active suspended stopped

status_reason

required

string | null

<= 280 characters

status_changed_at

required

string | null format: date-time

status_changed_by

required

usr_…, key_… or operator.

string | null

owner

required

The person responsible (usr_…).

string | null

active_keys

required

integer

<= 10

last_used_at

required

string | null format: date-time

created_at

required

string format: date-time

updated_at

required

string format: date-time

intent_mode

required

Signed intents (S09): off (headers ignored), optional (checked when sent) or required (every call needs one).

string

Allowed values: off optional required

usage

With ?expand[]=usage only (S25). The agent’s standard usage counters (S11), in the windows its budgets use: calls this UTC minute, this UTC hour and this day in the org’s time zone, and spend today in the agent’s spend-budget currency (usd when it has none). spend_today is null when nothing was spent today and the agent has no spend budget.

object

calls_minute

required

integer

calls_hour

required

integer

calls_today

required

integer

spend_today

required

object

amount

required

Minor units.

integer

currency

required

string

/^[a-z]{3}$/

last_action_at

With ?expand[]=usage only. When the agent’s newest action was created.

string | null format: date-time

deed

required

The admin deed this change sealed; null when nothing changed.

string | null

Example

{
  "object": "agent",
  "id": "agt_01k633rrmh3bcz2p39gg4vp46q",
  "name": "support-bot",
  "description": "Answers refund tickets in Zendesk",
  "labels": {
    "env": "prod",
    "team": "support"
  },
  "budgets": {
    "calls_per_minute": 60,
    "calls_per_day": 5000,
    "spend_per_day": {
      "amount": 5000,
      "currency": "usd"
    }
  },
  "status": "active",
  "status_reason": null,
  "status_changed_at": null,
  "status_changed_by": null,
  "owner": "usr_01k6c9kb2zcjsyn7b8g2k1vqvp",
  "active_keys": 0,
  "last_used_at": null,
  "created_at": "2026-10-03T10:02:11.000Z",
  "updated_at": "2026-10-03T10:02:11.000Z",
  "intent_mode": "off",
  "deed": "deed_01k6vrddq2atgb2023qvhhct3g"
}

default

An error. Every error has this envelope; doc_url explains the code.

application/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error policy_error rate_limit_error api_error

code

required

string

Allowed values: invalid_api_key api_key_revoked api_key_expired agent_suspended agent_stopped org_stopped insufficient_scope policy_denied approval_required approval_expired budget_exceeded intent_required intent_invalid intent_replay tool_unknown connector_unavailable upstream_error timeout rate_limited idempotency_conflict validation_failed not_found conflict internal_error authentication_required method_not_allowed request_too_large unsupported_media_type invalid_json api_version_invalid idempotency_key_invalid idempotency_key_in_use service_unavailable session_expired csrf_failed insufficient_role login_link_invalid login_code_invalid last_owner policy_unavailable policy_invalid credentials_missing destination_blocked vault_unavailable upstream_auth_failed upstream_not_found upstream_rate_limited response_too_large statement_refused row_limit_exceeded database_role_unsafe database_not_ready witness_not_configured approval_decided already_countersigned approver_not_eligible self_approval approval_needs_person context_changed approval_unsatisfiable approval_link_invalid approval_link_review_only approver_unmapped stripe_live_key_refused stripe_livemode_detected upstream_approval_pending schedule_needs_approval action_executing from_denied undo_unavailable undo_plan_stale already_undone undo_conflict replay_too_large replay_window_invalid suggestion_stale shadow_slot_taken suggestion_decided observe_not_enabled pro_required

message

required

One or more calm sentences with the next step.

string

param

required

The request field, query parameter or header the error is about.

string | null

request_id

required

string

/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

doc_url

required

string format: uri

diagnostics

On policy_invalid only. Each problem with its line, code and hint.

Array<object>

One finding about a policy file, with its position and the next step. Codes are stable and listed in docs/POLICY_ERRORS.md. In the policy_invalid error envelope each diagnostic also carries object: policy_diagnostic. The full PolicyDiagnostic schema is in openapi.yaml.

object

action

One agent action. Its sections mirror the deed’s. status is the one field an agent needs; state is the exact lifecycle state (docs/GATE.md). The Gate’s own responses (POST /v1/actions and its result report) add execution.result and witness.reasons; lists leave both out. The full Action schema is in openapi.yaml.

object

checks

On undo_unavailable only. Every check of the undo, each with its fix. Additive (S23).

Array<object>

One of the twelve safety checks (S23 §3.3). Available means no check failed. The full UndoCheck schema is in openapi.yaml.

object

Example

{
  "error": {
    "type": "invalid_request_error",
    "code": "not_found",
    "message": "There's no endpoint at GET /v1/helth. Did you mean /v1/health?",
    "param": null,
    "request_id": "req_01j9zr3m5k8q2w7x4t6v0b1c9d",
    "doc_url": "https://docs.deedglass.com/errors/not_found"
  }
}

Headers

Deedglass-Request-Id

string

/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

Deedglass-Version

string

The API version this response follows.