POST /api/admin/schools/{orgId}/close

Developing

POST

/api/admin/schools/{orgId}/close

POST /api/admin/schools/:orgId/close {name, cursor?} (schools.close: owners, step-up, X-Admin-Reason; §16) →
{closed, cursor?}. Erases every student account and then the school's org; name must be the school's. A cursor
back means students remain: send it back (with the same name) until closed is true. Each call is audited.

Staff cookie session; permission schools.close; fresh password + TOTP step-up (10 minutes); X-Admin-Reason required (3–300 characters). Write requests need same-origin JSON and X-Admin-CSRF from this session.

Source snapshot: admin/src/app/api/admin/schools/[orgId]/close/route.ts. This reference describes the current working tree, not proof of deployment. The response service types and validators remain authoritative.

Request

Authorization

API Key

Add parameter in cookie

__Host-hwa_session

Example:

__Host-hwa_session: ********************

Path Params

Header Params

Body Params application/jsonRequired

Examples

Responses

🟢200

application/json

Bodyapplication/json

🟠400

🟠401

🟠403

🟠429

⚪default

Request Example

Shell

JavaScript

Java

Swift

curl --location '/api/admin/schools//close' \
--header 'X-Admin-CSRF;' \
--header 'X-Admin-Reason;' \
--header 'Content-Type: application/json' \
--data '{
    "name": "string",
    "cursor": "string"
}'

Response Example

200 - Example 1

{}

Modified at 2026-10-26 13:41:16

README — GET /api/admin/schools

GET /api/admin/schools/{orgId}