---
title: "Activate Safe mode"
method: POST
path: "/auth/v3/customers/safemode/activate"
tags: ["Administration"]
---

# Activate Safe mode

`POST /auth/v3/customers/safemode/activate`

This API initiates Safe Mode on your Cloud Console, imposing critical restrictions to mitigate active threats. It enables granular control by restricting administrator logins, blocking specified API credentials, and halting all backup operations, restores, and downloads.
 * This operation requires API credentials with the Druva Cloud Administrator role.
 * Safe Mode is activated immediately upon successful API call.

## Headers

- `Content-Type` 'application/json', required

## Request body

- object
  - `activationInfo` object, required — Configuration details for activating Safe Mode.
    - `activationFor` object, required — Defines the specific restrictions to enforce when Safe Mode is activated. At least one restriction must be set to 'true'.
      - `restrictAdminLogin` boolean, required — If 'true', restricts administrator login access to the Cloud Console. Only administrators specified in allowedAdminIds will be permitted to log in.
      - `restrictApiCredentials` boolean, required — If 'true', restricts all API credential access. Only client credentials specified in allowedClientCredentialIds will be able to authenticate.
      - `stopBackup` boolean, required — If 'true', halts all scheduled backup operations across the customer environment.
      - `stopRestoreDownload` boolean, required — If 'true', prevents all data restore and download operations.
    - `allowedAdminIds` string[], required — List of administrator global IDs that will retain login access when restrictAdminLogin is 'true'. * Get the global Admin ID of the administrator using the [List all administrators](/reference/listadminsrequest) API. * This parameter is required only if restrictAdminLogin is 'true'.
    - `allowedClientCredentialIds` string[], required — List of client credential IDs that will retain API access when restrictApiCredentials is 'true'. * You can get the Client Credential ID from Integration Center > API Credentials > Client ID column. * This parameter is required only if restrictApiCredentials is 'true'.
    - `notificationEmailRecipients` string[], required — A list of email addresses to notify about Safe Mode activation. Druva Cloud Administrator emails are included by default (no need to provide in input). Maximum of 20 recipients allowed.

## Response `200`

Success

- CreateSafeModeActivationSettingsResponse — Response returned after safe mode activation request
  - `operationId` string, required — A unique identifier for this specific Safe Mode activation operation. Used by Support to track the request internally if a case is raised.
  - `status` 'SUCCESS', required — Status of the safe mode activation operation.
  - `warning` string — An optional warning message indicating any non-critical issues encountered during activation. For example, some specified allowedAdminIds or allowedClientCredentialIds may be disabled or deleted, but the activation proceeded successfully for the valid entries.

## Other responses

- `403` — User is not authorized to access this resource with an explicit deny
- `404` — The requested resource was not found.
- `422` — Could be one of: - Password does not match password policy. Please check password policy. - Incorrect current password.
- `500` — The request was not processed due to an internal error.

---

[API](https://skmtc.net/druva/apis/authentication.md) · [All operations](https://skmtc.net/druva/apis/authentication/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/druva/authentication/revisions/2af2bf148b25/schema)