---
title: "Suspend OAuth app"
method: POST
path: "/oauth-clients/{appId}/suspend"
tags: ["OAuth Apps"]
---

# Suspend OAuth app

`POST /oauth-clients/{appId}/suspend`

Moves an OAuth app to `status: "suspended"`, blocking new token issuance at `POST /oauth2/token` and the authorization-code consent flow. Tokens that have already been issued remain valid until their natural expiry — call `POST /oauth-clients/{appId}/revoke-all-tokens` immediately afterwards if you need an immediate lockout.

Use this for temporary suspensions where you intend to reactivate later. For permanent removal, use `DELETE /oauth-clients/{appId}`. Suspending an app that is already suspended returns `400`.

Creator-only.

## Path parameters

- `appId` string, required

## Response `200`

OAuth app suspended

- SuspendOAuthAppResponse — Response body for `POST /oauth-clients/{appId}/suspend` (`oauth.app.controller.ts` `suspendApp`). Suspended app (never includes `clientSecret`) is nested under `app`.
  - `message` string, required
  - `app` OAuthAppResponse, required — OAuth app details (without secret). Fields under `required:` always appear in `toAppResponse` (`oauth.app.service.ts`); optional URL/description fields are only present when set by the caller.
    - `id` string, required — App ID
    - `slug` string, required — URL-friendly app slug
    - `clientId` string, required — OAuth client ID
    - `name` string, required — App name
    - `description` string — App description
    - `redirectUris` string[], required — Allowed redirect URIs (always returned; may be empty)
    - `allowedGrantTypes` string[], required — Allowed grant types
    - `allowedScopes` string[], required — Allowed scopes
    - `status` 'active' | 'suspended' | 'revoked', required — App status
    - `homepageUrl` string, uri — App homepage
    - `privacyPolicyUrl` string, uri — Privacy policy URL
    - `termsOfServiceUrl` string, uri — Terms of service URL
    - `isConfidential` boolean, required — Whether app is a confidential client
    - `accessTokenLifetime` integer, required — Access token lifetime in seconds
    - `refreshTokenLifetime` integer, required — Refresh token lifetime in seconds
    - `createdAt` string, date-time, required — Creation timestamp
    - `updatedAt` string, date-time, required — Last update timestamp

## Other responses

- `400` — Bad request — e.g. OAuth app is already suspended
- `401` — Unauthorized
- `403` — Forbidden — caller cannot access this OAuth app (creator-only; see OAuth Apps tag).
- `404` — OAuth app not found or not visible to this caller (each user only sees apps they created)
- `429` — Rate limit exceeded

---

[API](https://skmtc.net/pipeshub-ai/apis/pipeshub-api.md) · [All operations](https://skmtc.net/pipeshub-ai/apis/pipeshub-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pipeshub-ai/pipeshub-api/versions/abd27cfefc73/schema)