breakGlassSessions
Settings module · 4 operations
List break glass session rows
GET/break-glass-sessions
One hour of emergency full access for an Owner. Requires MFA and a reason; every Admin is notified. Returns a cursor page of break glass session rows the caller may see. The default order is `created_at` ascending. Supports sparse fieldsets and the filter grammar.
Create a break glass session
POST/break-glass-sessions
One hour of emergency full access for an Owner. Requires MFA and a reason; every Admin is notified. Creates a break glass session. Requires `Idempotency-Key`; a replay returns the original response. The organization is derived from the credential or the parent row, never from the body.
Get a break glass session
GET/break-glass-sessions/{id}
One hour of emergency full access for an Owner. Requires MFA and a reason; every Admin is notified. Returns one break glass session with its `ETag`. A break glass session the caller may not see returns 404.
End emergency access
POST/break-glass-sessions/{id}/end
Ends the caller's own open break-glass session before its hour is up, through `app.end_break_glass`. Another person's session is refused with 403; one that already ended with 422. Requires `Idempotency-Key`; a replay returns the original response. A rule that refuses the request returns 422 with `refusal` and `reason`.