Create an account legal hold.

POST

/api/admin/users/{id}/legal-holds

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/api/admin/users/example/legal-holds \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: example' \
  --data '{ "reason_code": "example", "case_reference": "example", "expires_at": "2026-04-15T12:00:00Z" }'

Creates one active account-scoped hold and enqueues its non-PII Control projection. Omitted expiry means the hold remains active until an authorized audited transition.

Authorizations

• adminBearer
• adminSessionCookie

Parameters

Path Parameters

id

required

string

Header Parameters

X-Tenant-Id

string

Tenant selector for multi-tenant admin requests.

Idempotency-Key

required

string

>= 8 characters <= 128 characters

Request Body ^required

Media type application/json

object

reason_code

required

string

>= 1 characters <= 64 characters /^[a-z0-9][a-z0-9._-]{0,63}$/

case_reference

string

>= 1 characters <= 256 characters

expires_at

string format: date-time

key

additional properties

Example ^generated

{
  "reason_code": "example",
  "case_reference": "example",
  "expires_at": "2026-04-15T12:00:00Z"
}

Responses

201

Legal hold created, or the same idempotent result replayed.

Media type application/json

object

id

required

string

/^legal-hold:[a-f0-9]{64}$/

subject_type

required

string

Allowed values: account

account_id

required

string

state

required

string

Allowed values: active released expired

reason_code

required

string

>= 1 characters <= 64 characters /^[a-z0-9][a-z0-9._-]{0,63}$/

case_reference

required

string | null

<= 256 characters

expires_at

required

Unix epoch milliseconds; null means no automatic expiry.

integer | null

version

required

integer

>= 1

created_by

required

string

created_at

required

integer

released_by

required

string | null

released_at

required

integer | null

release_reason

required

string | null

updated_at

required

integer

key

additional properties

Example

{
  "subject_type": "account",
  "state": "active"
}

400

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

404

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

409

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

500

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}