1. Organisations
Handwrite Admin
  • Handwrite Regular Accounts
    • Schemas
      • Error
      • Principal
      • Role
      • Access
      • ContentType
      • Language
      • FileRef
      • Document
      • Tombstone
      • DocumentPage
      • CreateDocument
      • UpdateDocument
      • FileInfo
      • CommitUpload
      • Upload
      • DownloadLink
      • Extracted
      • ExtractionFailed
      • CommittedDocument
      • ExtractedDocument
      • SearchHit
      • SearchPage
      • Export
      • Permission
      • Share
      • ChangeRole
      • Invitation
      • Permissions
      • ReceivedInvitation
      • AcceptedInvitation
      • Me
      • WebhookEventType
      • Webhook
      • CreateWebhook
      • CreatedWebhook
      • WebhookDelivery
      • AudioFormat
      • Speech
      • WordTiming
      • SpeechMarks
      • AudioLink
      • Voice
      • Quota
      • SettingEntry
      • Settings
      • SettingsPatch
      • PatchedSettings
      • OAuthToken
      • OAuthError
  • Handwrite Team
    • Schemas
      • Error
      • Principal
      • Access
      • ContentType
      • Language
      • FileRef
      • Document
      • Tombstone
      • DocumentPage
      • OrgKind
      • OrgRole
      • Organisation
      • CreateOrganisation
      • RenameOrganisation
      • Member
      • AddMember
      • ChangeMember
      • InviteMember
      • OrgInvitation
      • ReceivedOrgInvitation
  • Handwrite Classroom
    • Schemas
      • Error
      • Principal
      • Access
      • ContentType
      • Language
      • FileRef
      • Document
      • Tombstone
      • DocumentPage
      • OrgKind
      • OrgRole
      • Organisation
      • CreateOrganisation
      • RenameOrganisation
      • Member
      • AddMember
      • ChangeMember
      • InviteMember
      • OrgInvitation
      • ReceivedOrgInvitation
  • Handwrite Admin
    • Start here — staff console
    • Admin API specification notes
    • Admin socket specification notes
    • Staff role and permission matrix
    • Staff workflows and architecture
    • Admin source and validation status
    • Customer accounts
      • README — GET /api/admin/accounts/{sub}/billing
      • README — GET /api/admin/accounts/{sub}/cloud/documents/{id}
      • README — GET /api/admin/accounts/{sub}/cloud/documents
      • README — POST /api/admin/accounts/{sub}/cloud/keys/{keyId}/revoke
      • README — GET /api/admin/accounts/{sub}/cloud/keys
      • README — GET /api/admin/accounts/{sub}/cloud/oauth
      • README — GET /api/admin/accounts/{sub}/cloud/orgs
      • README — GET /api/admin/accounts/{sub}/cloud/settings
      • README — GET /api/admin/accounts/{sub}/cloud/usage
      • README — GET /api/admin/accounts/{sub}/cloud/webhooks
      • README — POST /api/admin/accounts/{sub}/delete
      • README — POST /api/admin/accounts/{sub}/disable
      • README — POST /api/admin/accounts/{sub}/enable
      • README — POST /api/admin/accounts/{sub}/mfa-reset
      • README — POST /api/admin/accounts/{sub}/password-reset
      • README — POST /api/admin/accounts/{sub}/purge
      • README — POST /api/admin/accounts/{sub}/restore
      • README — GET /api/admin/accounts/{sub}
      • README — PATCH /api/admin/accounts/{sub}
      • README — POST /api/admin/accounts/{sub}/sign-out
      • README — GET /api/admin/accounts
      • GET /api/admin/accounts/{sub}/billing
      • GET /api/admin/accounts/{sub}/cloud/documents/{id}
      • GET /api/admin/accounts/{sub}/cloud/documents
      • POST /api/admin/accounts/{sub}/cloud/keys/{keyId}/revoke
      • GET /api/admin/accounts/{sub}/cloud/keys
      • GET /api/admin/accounts/{sub}/cloud/oauth
      • GET /api/admin/accounts/{sub}/cloud/orgs
      • GET /api/admin/accounts/{sub}/cloud/settings
      • GET /api/admin/accounts/{sub}/cloud/usage
      • GET /api/admin/accounts/{sub}/cloud/webhooks
      • POST /api/admin/accounts/{sub}/delete
      • POST /api/admin/accounts/{sub}/disable
      • POST /api/admin/accounts/{sub}/enable
      • POST /api/admin/accounts/{sub}/mfa-reset
      • POST /api/admin/accounts/{sub}/password-reset
      • POST /api/admin/accounts/{sub}/purge
      • POST /api/admin/accounts/{sub}/restore
      • GET /api/admin/accounts/{sub}
      • PATCH /api/admin/accounts/{sub}
      • POST /api/admin/accounts/{sub}/sign-out
      • GET /api/admin/accounts
    • Staff administration
      • README — POST /api/admin/admins/{sub}/password-reset
      • README — PATCH /api/admin/admins/{sub}
      • README — DELETE /api/admin/admins/{sub}/sessions
      • README — GET /api/admin/admins
      • README — POST /api/admin/admins
      • POST /api/admin/admins/{sub}/password-reset
      • PATCH /api/admin/admins/{sub}
      • DELETE /api/admin/admins/{sub}/sessions
      • GET /api/admin/admins
      • POST /api/admin/admins
    • Operations
      • README — GET /api/admin/alarms
      • README — GET /api/admin/audit
      • README — GET /api/admin/billing
      • README — GET /api/admin/config
      • README — PUT /api/admin/config
      • README — GET /api/admin/deletions
      • README — GET /api/admin/icloud/probe
      • README — POST /api/admin/jobs/rollup
      • README — GET /api/admin/me
      • README — GET /api/admin/overview
      • README — GET /api/admin/usage/accounts/{sub}
      • README — GET /api/admin/usage/orgs/{id}
      • README — GET /api/admin/usage/rollup
      • GET /api/admin/alarms
      • GET /api/admin/audit
      • GET /api/admin/billing
      • GET /api/admin/config
      • PUT /api/admin/config
      • GET /api/admin/deletions
      • GET /api/admin/icloud/probe
      • POST /api/admin/jobs/rollup
      • GET /api/admin/me
      • GET /api/admin/overview
      • GET /api/admin/usage/accounts/{sub}
      • GET /api/admin/usage/orgs/{id}
      • GET /api/admin/usage/rollup
    • Authentication
      • README — POST /api/admin/auth/challenge
      • README — POST /api/admin/auth/sign-in
      • README — POST /api/admin/auth/sign-out-all
      • README — POST /api/admin/auth/sign-out
      • README — POST /api/admin/auth/step-up
      • POST /api/admin/auth/challenge
      • POST /api/admin/auth/sign-in
      • POST /api/admin/auth/sign-out-all
      • POST /api/admin/auth/sign-out
      • POST /api/admin/auth/step-up
    • Staff webhooks
      • README — DELETE /api/admin/hooks/{id}
      • README — POST /api/admin/hooks/{id}/test
      • README — GET /api/admin/hooks
      • README — POST /api/admin/hooks
      • README — staff webhook delivery
      • DELETE /api/admin/hooks/{id}
      • POST /api/admin/hooks/{id}/test
      • GET /api/admin/hooks
      • POST /api/admin/hooks
    • Organisations
      • README — POST /api/admin/orgs/{id}/api-access
      • README — GET /api/admin/orgs/{id}/audit
      • README — GET /api/admin/orgs/{id}/members
      • README — GET /api/admin/orgs/{id}
      • README — GET /api/admin/orgs/{id}/usage
      • POST /api/admin/orgs/{id}/api-access
        POST
      • GET /api/admin/orgs/{id}/audit
        GET
      • GET /api/admin/orgs/{id}/members
        GET
      • GET /api/admin/orgs/{id}
        GET
      • GET /api/admin/orgs/{id}/usage
        GET
    • Schools
      • README — POST /api/admin/schools/{orgId}/close
      • README — GET /api/admin/schools/{orgId}
      • README — PATCH /api/admin/schools/{orgId}
      • README — GET /api/admin/schools
      • POST /api/admin/schools/{orgId}/close
      • GET /api/admin/schools/{orgId}
      • PATCH /api/admin/schools/{orgId}
      • GET /api/admin/schools
    • Sessions
      • README — DELETE /api/admin/sessions/{id}
      • README — GET /api/admin/sessions
      • DELETE /api/admin/sessions/{id}
      • GET /api/admin/sessions
    • Support
      • README — GET /api/admin/support/canned/{id}
      • README — PUT /api/admin/support/canned/{id}
      • README — DELETE /api/admin/support/canned/{id}
      • README — GET /api/admin/support/canned
      • README — POST /api/admin/support/canned
      • README — GET /api/admin/support/tickets/{id}/attachments/{n}
      • README — GET /api/admin/support/tickets/{id}/link
      • README — POST /api/admin/support/tickets/{id}/link
      • README — POST /api/admin/support/tickets/{id}/note
      • README — POST /api/admin/support/tickets/{id}/reply
      • README — GET /api/admin/support/tickets/{id}
      • README — PATCH /api/admin/support/tickets/{id}
      • README — POST /api/admin/support/tickets/{id}/school
      • README — POST /api/admin/support/tickets/{id}/spam
      • README — GET /api/admin/support/tickets
      • GET /api/admin/support/canned/{id}
      • PUT /api/admin/support/canned/{id}
      • DELETE /api/admin/support/canned/{id}
      • GET /api/admin/support/canned
      • POST /api/admin/support/canned
      • GET /api/admin/support/tickets/{id}/attachments/{n}
      • GET /api/admin/support/tickets/{id}/link
      • POST /api/admin/support/tickets/{id}/link
      • POST /api/admin/support/tickets/{id}/note
      • POST /api/admin/support/tickets/{id}/reply
      • GET /api/admin/support/tickets/{id}
      • PATCH /api/admin/support/tickets/{id}
      • POST /api/admin/support/tickets/{id}/school
      • POST /api/admin/support/tickets/{id}/spam
      • GET /api/admin/support/tickets
    • Health
      • README — GET /api/health
      • GET /api/health
  1. Organisations

POST /api/admin/orgs/{id}/api-access

Developing
POST
/api/admin/orgs/{id}/api-access
POST /api/admin/orgs/:id/api-access {blocked} (orgs.api_access: owner/support, step-up, X-Admin-Reason; §8) → {orgId, apiBlocked, changed}.
Staff cookie session; permission orgs.api_access; fresh password + TOTP step-up (10 minutes); X-Admin-Reason required (3–300 characters). Write requests need same-origin JSON and X-Admin-CSRF from this session.
Source snapshot: admin/src/app/api/admin/orgs/[id]/api-access/route.ts. This reference describes the current working tree, not proof of deployment. The response service types and validators remain authoritative.
Current-source enforcement limitation (not live-verified): setting apiBlocked is not proof that every organisation-owned token stops authenticating. In the captured checkout, http.ts policyGate skips enforceCredential for caller.orgToken, and developer.ts orgTokenCaller does not check subscription.apiBlocked. During containment, inspect and revoke affected organisation-owned keys and verify denial separately; do not rely on the block flag alone.

Request

Authorization
API Key
Add parameter in cookie
__Host-hwa_session
Example:
__Host-hwa_session: ********************
or
Path Params

Header Params

Body Params application/jsonRequired

Examples

Responses

🟢200
application/json
POST /api/admin/orgs/:id/api-access {blocked} (orgs.api_access: owner/support, step-up, X-Admin-Reason; §8) → {orgId, apiBlocked, changed}.
Bodyapplication/json

🟠400
🟠401
🟠403
🟠429
⚪default
Request Request Example
Shell
JavaScript
Java
Swift
curl --location '/api/admin/orgs//api-access' \
--header 'X-Admin-CSRF;' \
--header 'X-Admin-Reason;' \
--header 'Content-Type: application/json' \
--data '{
    "blocked": true
}'
Response Response Example
200 - Example 1
{}
Modified at 2026-10-26 13:41:16
Previous
README — GET /api/admin/orgs/{id}/usage
Next
GET /api/admin/orgs/{id}/audit
Built with