Docs menu

Auth API · mode

Pin an undecided organization in read-only mode

POST /api/auth/organizations/{organizationId}/read-only

Pin an undecided organization in read-only mode — one standing live only by the deployment's default: from here nothing leaves Manifold for it, while orders bridged in, imports and people's own work in Manifold carry on.

Going live is final, so an organization that has decided to go live is refused with 409 GoLiveIsFinal and nothing changes. 403 AdminRequired for anyone but an owner or admin, MembershipDeactivated for a caller whose own access has ended. Appends auth.org-set-read-only. Idempotent by state: an organization that is already read-only — a sandbox always is — is acknowledged and appends nothing.

Access

Requires a signed-in session: An active owner or admin of the organization, by their BetterAuth session or their own tenant JWT, checked against its membership by the route

How scopes come from roles: Scopes and roles. Getting a token: Authentication and app tokens.

Retries

Idempotent by state: an organization that is already read-only — a sandbox always is — is acknowledged and appends nothing.

Why every write carries a key: Idempotency and retries.

Facts appended

  • auth.org-set-read-only

What a fact is: Facts and the journal.

AI agent tool

No agent tool. Stopping everything Manifold sends outward is an owner's or admin's decision in Settings › General, never an agent's.

Connecting an agent: AI agents.

Example

curl 
curl -X POST 'https://auth.getmanifold.io/api/auth/organizations/org_01a156d2-8680-7738-ab2e-ff985e454887/read-only' \
  -H "Authorization: Bearer $MANIFOLD_TOKEN"
JavaScript (fetch) 
const response = await fetch("https://auth.getmanifold.io/api/auth/organizations/org_01a156d2-8680-7738-ab2e-ff985e454887/read-only", {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.MANIFOLD_TOKEN}` },
});
if (!response.ok) throw new Error(`${response.status}: ${await response.text()}`);
const answer = await response.json();
Response · 200 · application/json 
{
  "organizationId": "org_01a156d2-8680-7738-ab2e-ff985e454887",
  "mode": "read-only",
  "changedAt": "2026-10-20T01:00:02.000Z",
  "changedBy": "usr_01a15709-7582-7646-b491-261a138f0650"
}

The panel writes this call in other languages. It does not send it: Manifold's APIs do not take calls from a web page on another site, so run the call from your own code or terminal. The whole API as OpenAPI: auth-service.openapi.json. Base URL https://auth.getmanifold.io.

Errors

Every refusal is a status and a JSON body whose _tag names it. A refused call changes nothing.

401

RefusalWhat it meansWhat to do
Unauthorized reason The token is missing, expired or not one Manifold issued.Get a fresh token and send the call again.
TokenAlreadyUsed tokenId A single-use app token was already spent.Mint a new token for this call.

402

RefusalWhat it meansWhat to do
SubscriptionRequired status The organization's subscription has lapsed, so writes are refused.An owner settles billing. Reads still work meanwhile.

403

RefusalWhat it meansWhat to do
AdminRequired Only an owner or admin of the organization may do this.Ask an owner or admin.
MembershipDeactivated Your own access to this organization has ended.Ask an owner or admin to reactivate you.
TenantRequired userId The token names no organization.Choose the organization, then get a new token.
ScopeRequired required The token's roles do not grant the scope this call needs.Ask an owner or admin for a role that grants it.

409

RefusalWhat it meansWhat to do
GoLiveIsFinal The organization has gone live, and that cannot be undone.Nothing to do: it stays live.
MirroredFromSource source This area is fed by your source system until the organization goes live.Make the change in the source system, or go live first.

503

RefusalWhat it meansWhat to do
RequestLogUnavailable tokenId, reason The service could not record the request, so it did nothing.Send the same request again shortly.

How refusals work everywhere: Errors.

Used in