Directives & cross-property bans

A directive imposes a policy on a user that must land everywhere, fast — a cross-property suspension, a read-only hold, or a forced logout. It revokes the user's sessions and emits webhooks so every property reacts in seconds.

Impose a directive

curl -X POST "https://<fapi>/v1/users/<user_id>/directives" \
  -H "Authorization: Bearer sk_…" -H "content-type: application/json" \
  -d '{"suspended_until":"2026-12-31T00:00:00Z","read_only":false,"forced_logout":true,"reason":"abuse review"}'

This: revokes the user's sessions (bumps sessions-version, so existing tokens stop verifying), places an Atlas-side hold, and emits `policy.imposed` + `user.suspended` webhooks. Any property consuming those events applies the ban immediately.

Fields: suspended_until (ISO, or omit for indefinite), read_only (allow read but block writes), forced_logout (kill sessions now), reason (audited).

Lift it

curl -X DELETE "https://<fapi>/v1/users/<user_id>/directives" -H "Authorization: Bearer sk_…"

Emits `user.unsuspended`. Subscribe to these three events (see Webhook event catalog) to keep a cross-property ban in sync.

Related

• POST /v1/users/:id/sessions/revoke — revoke all sessions without a policy hold ("sign out everywhere").

• Ban/unban a user for local moderation is user.banned / user.unbanned.