Suspend or reactivate an agent

Suspension is the right move when you want an agent off right now but expect to use it again. It preserves the agent ID, the keypair, the permission matrix, and the audit history — only the status flips.

Suspend

/agents/:id → Suspend.

The agent’s status changes from active to suspended immediately. The next call from that agent comes back denied — the proxy reads status on every request, so there’s no propagation delay.

While suspended:

Signed JWTs still verify (the keypair is still valid), but the permission check refuses the call with 403 agent_halted, reason agent_suspended
The audit log records the denial with reason agent_suspended
The agent’s MCP server can surface the denial to its user with the suggested next action

You can suspend any active agent from this surface. There’s no confirmation prompt — it’s a reversible action.

Reactivate

Same button location, label switches to Re-activate when the agent is currently suspended.

Status flips back to active. Re-activating does not touch the circuit breaker. The breaker never suspends an agent; it opens on its own after repeated failures and closes after a cooldown (see the circuit breaker). To clear it early, use Reset circuit breaker on the agent’s page.

When to suspend vs delete

Suspend — you might want this agent again. Audit history, permissions, keypair all preserved.
Delete — you never want this agent again. The keypair becomes useless, the audit history stays under the agent ID but the agent no longer appears in lists. See Delete an agent.

When to suspend vs revoke a single permission

Suspend — take the whole agent offline.
Revoke a permission — let the agent keep using the platforms/scopes it’s good at, but cut off the one going wrong. See Configure permissions.

What gets audited

Suspension writes agent_suspended to the audit log with you as the actor. Re-activation writes agent_reactivated.