Identity actions

Sentinel's identity endpoints let you take immediate action on compromised or high-risk accounts, disabling accounts, revoking all sessions, and enforcing MFA re-challenge across connected identity providers.

Disable an account

bash

POST /v1/sentinel/identity/:userId/disable

Name	Type	Required	Description
reason	string	Yes	Why the account is being disabled. Logged permanently.
incident_id	string	No	Associate with an open incident.

bash

curl -X POST https://api.hldgroup.org/v1/sentinel/identity/idn_01hxyz/disable \
  -H "Authorization: Bearer hld_live_xxxx" \
  -H "Content-Type: application/json" \
  -d '{"reason": "Account compromise confirmed. Disabling pending investigation.", "incident_id": "inc_01hxyz"}'

Warning:Disabling an account immediately revokes access through your tenant's configured identity provider — Entra ID, Okta, or Supabase Auth (these are the only three providers Sentinel currently integrates with). Notify the user via out-of-band communication before disabling in non-incident scenarios.

Revoke all sessions

bash

POST /v1/sentinel/identity/:userId/revoke-sessions

Name	Type	Required	Description
reason	string	No	Optional reason for the audit trail.
incident_id	string	No	Associate with an open incident.

Invalidates all active sessions immediately across all devices and applications. The user must re-authenticate from scratch.

Force MFA re-challenge

bash

POST /v1/sentinel/identity/:userId/force-mfa

Warning:Provider support for this action varies significantly and none of the three providers offers a true "require MFA on the very next request" call: Okta resets the user's enrolled MFA factors (forcing re-enrollment), and only actually re-enforces MFA if your Okta sign-on policy already requires it for that user — real, but caveated. Entra ID and Supabase Auth have no equivalent per-user action at all; a request against either of those providers returns an error, not a fabricated success. Check the response for which outcome you got — do not assume this action succeeded uniformly across providers.

json

{
  "data": {
    "action": { /* action object — params.provider names which provider actually handled this */ },
    "mfa_challenge_required_from": "2025-06-01T03:14:00Z"
  }
}

Combining actions

For high-severity identity compromise, combine actions for maximum containment, disable the account AND revoke sessions:

typescript

const userId = 'idn_01hxyz'
const incidentId = 'inc_01hxyz'
const reason = 'Active credential attack confirmed.'

await Promise.all([
  fetch(`/v1/sentinel/identity/${userId}/disable`, {
    method: 'POST',
    body: JSON.stringify({ reason, incident_id: incidentId }),
  }),
  fetch(`/v1/sentinel/identity/${userId}/revoke-sessions`, {
    method: 'POST',
    body: JSON.stringify({ reason, incident_id: incidentId }),
  }),
])

Playbooks Response actions