> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Emergency Stop: The Org-Wide Outbound Halt

> The owner/admin-only kill switch that halts all outbound dispatch for your organization — status, activation, deactivation, and the recovery path.

# Emergency Stop

The emergency stop is an **org-wide kill switch** — one flag, owned by
your organization, that halts every outbound dispatch path (SMS, MMS,
voice origination, dialer campaign activation) until you lift it. It
exists for the moment when throttling a channel or scrubbing a list is
not enough: a suspected breach, a runaway campaign, a litigator or
carrier exposure you need frozen *now*.

Only the **owner** or **admin** roles can read status, activate, and
deactivate the switch; developer and viewer roles receive 403. The
scope is your organization only — you operate the switch, Orbit
operates the platform.

<Warning>
  Activation halts outbound dispatch for the entire organization
  immediately. Blocked sends are rejected with
  `403 ORG_COMPLIANCE_EMERGENCY_STOP` before provider dispatch, so no
  balance is debited for them. Transactional **Verify/OTP** sends and
  **email** are **not** gated — those run on separate delivery paths.
  Deactivate as soon as the incident is resolved.
</Warning>

All endpoints below are rooted at
`https://api.orbit.devotel.io/api/v1/compliance`.

***

## The endpoints

Three endpoints, all owner/admin:

**Check status** — reads `active`, plus `activated_at`,
`activated_by`, and `reason`:

```bash theme={null}
curl https://api.orbit.devotel.io/api/v1/compliance/emergency-stop \
  -H "Authorization: Bearer $ORBIT_API_KEY"
```

**Activate** — flips the switch ON. An optional `reason` (up to 500
characters) is stored with the flag and written to the audit log
alongside the actor and timestamp, so a post-incident review can
rebuild the timeline:

```bash theme={null}
curl -X POST https://api.orbit.devotel.io/api/v1/compliance/emergency-stop/activate \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "reason": "Suspected list contamination — pausing all sends" }'
```

**Deactivate** — lifts the halt:

```bash theme={null}
curl -X POST https://api.orbit.devotel.io/api/v1/compliance/emergency-stop/deactivate \
  -H "Authorization: Bearer $ORBIT_API_KEY"
```

Both write paths are rate-limited to 5 requests per minute — one
decisive click plus a few retries, never a settings-thrash vector.
Activation and deactivation are audit-logged; deactivation clears
`activated_at` / `activated_by` / `reason` back to `null` while the
activation record stays in the audit log.

***

## When to use it

Reach for the emergency stop when the cost of one more outbound send
exceeds the cost of halting everything:

* **Suspected breach** — a compromised API key or sender behaving
  outside policy.
* **Runaway campaign** — a misconfigured campaign or content mistake
  dispatching at volume.
* **Litigator or carrier exposure** — a complaint spike, carrier block
  notice, or regulator inquiry mid-flight.

For narrower problems use a narrower control: a bad list is a
[DNC scrub](/compliance/dnc-scrub) case, a channel-specific pause is a
[channel rate override](/compliance/channel-rate-overrides), and
individual contacts belong on
[opt-out suppression](/compliance/opt-out-suppression).

***

## Interplay with send gates

[Send gates](/compliance/send-gates) (quiet hours, DNC, RND, RMD, DNO)
are tenant-owned, per-decision controls: each one evaluates a specific
regulatory signal before a send dispatches. The emergency stop layers
on top of them as the blunt instrument — when it is active, every
outbound dispatch is rejected with
`403 ORG_COMPLIANCE_EMERGENCY_STOP` before the individual gate chain
matters. Use the gates for posture; use the stop for an incident.

***

## Recovery path

1. Resolve the incident root cause — re-key credentials, halt the
   runaway campaign, scrub the bad list.
2. `POST /emergency-stop/deactivate` lifts the halt (owner/admin).
3. `GET /emergency-stop` confirms `active: false`; queued or blocked
   sends can then be re-dispatched.

The state is cached for at most 30 seconds, so plan for enforcement
(and lifting it) within half a minute of the POST. If the state lookup
ever fails, the gate treats the switch as OFF and logs — a transient
read failure cannot black-hole all outbound traffic.

***

## Full runbook

This page is the API reference for the control. For the full incident
operator's runbook — when to reach for it, the fail-safes that bound
it, and how to run it as a launch-day drill — see
[Emergency Stop Runbook](/guides/compliance-emergency-stop). The
summarized endpoint surface also lives inside
[Send Gates](/compliance/send-gates).