# Freezes & Quarantines

Stop a user's account or a wallet at once, on every server, and hold one pending operation before it is signed — until someone lifts it.

## Overview

- **A freeze** stops a user of your tenant, one of its wallets, or the wallets of one of its [accounts](https://docs.aureahub.com/docs/guide-accounts.md), until it is lifted or until the time you set. **A quarantine** holds one operation that is waiting for something — a signature, a deposit, an approval — before anything of it is signed or sent.
- **In force when the call answers.** Freezing and lifting answer about a second after they are written, so that by then every server of the API knows: the very next request is refused, or allowed again.
- Nothing is frozen until someone freezes it: with nothing frozen, every route answers as before.
- Each freeze and quarantine keeps its reason, who placed it, when, and — once lifted — who lifted it, when and why. Lifted ones stay listed.
- Your tenant's administrators act on its users, wallets, accounts and operations, never on the tenant itself: only Aurea freezes a whole tenant, and only Aurea lifts what Aurea placed.

## What a Freeze Stops

| Frozen | Refused | details.code |
| --- | --- | --- |
| user | Every request made with the user's access token — reads included —, the user's sign-in (once the password is checked), token refresh and Google or Apple sign-in, every signature of the user's wallets, and the MPC relay of the user's sessions. | USER_FROZEN |
| wallet | Every route that would sign or send with it — sends and broadcasts, swaps and approvals, gasless sends, dApp signatures and broadcasts, Earn, MPC signing and auxiliary ceremonies, and the MPC relay of its sessions. Its owner still reads it. A wallet is its address in your tenant: freezing one freezes every wallet of the tenant with that address, on every chain. | WALLET_FROZEN |
| account | What a frozen wallet stops, for every wallet the account holds — every wallet of the tenant at the address of one of them, on every chain. Reads go on, and the user's wallets outside the account still sign. A user's default account is frozen by the user's id. | ACCOUNT_FROZEN |
| tenant (Aurea only) | Every request of the tenant's users and administrators, its API key and its server tokens, its sign-ins, registrations and refreshes, and every signature of its wallets. | TENANT_FROZEN |

Public routes called without a token are not affected.

## The 423 Answer

A frozen account, wallet or tenant, and a quarantined operation, answer `423 Locked`:

```json
{
  "statusCode": 423,
  "error": "LockedError",
  "message": "This wallet is frozen: it cannot sign until the freeze is lifted.",
  "details": { "code": "WALLET_FROZEN" }
}
```

| details.code | message |
| --- | --- |
| TENANT_FROZEN | `This tenant is frozen: nothing can be done for it until it is lifted.` |
| USER_FROZEN | `This account is frozen: nothing can be done with it until it is lifted.` |
| ACCOUNT_FROZEN | `This wallet's account is frozen: its wallets cannot sign until the freeze is lifted.` |
| WALLET_FROZEN | `This wallet is frozen: it cannot sign until the freeze is lifted.` |
| OPERATION_QUARANTINED | `This operation is quarantined: it will not be signed or sent until the quarantine is lifted.` |

- When more than one applies, the widest is answered: the tenant, then the user, then the account, then the wallet.
- Don't retry a `423`: it answers the same until the freeze or the quarantine is lifted, or a freeze's `until` passes.
- Where a wallet is about to sign and Aurea cannot read whether it is frozen, nothing is signed: `503` with `details.code` `FREEZE_STATUS_UNREAD` (`Whether this wallet may sign could not be checked. Nothing was signed; try again.`). That one can be retried.

## Freeze and Lift

```bash
# Freeze a user until lifted
curl -X POST https://api.aureahub.com/v1/admin/tenants/$TENANT_ID/freezes \
  -H "Authorization: Bearer $TENANT_ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "target": "user", "id": "'$USER_ID'", "reason": "Account takeover reported by the customer" }'

# Lift it
curl -X POST https://api.aureahub.com/v1/admin/tenants/$TENANT_ID/freezes/$FREEZE_ID/lift \
  -H "Authorization: Bearer $TENANT_ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "reason": "Identity confirmed, password reset" }'
```

- `target`: `user`, `wallet` or `account`; `id`: the user's, the wallet's or the account's id — for a user's default account, the user's id; `reason`: 1 to 500 characters; `until` (optional): a time in the future when the freeze ends by itself.
- One freeze at a time per user, wallet or account: a second answers `409` `ALREADY_FROZEN`. A freeze whose `until` passed is closed when the next one is placed.
- Nobody freezes their own user, nor lifts a freeze of their own user, of one of their wallets, or of an account they own — their own default account included (`403` `FREEZE_SELF`). Freezing one of your own wallets or accounts is allowed.
- [List Freezes](https://docs.aureahub.com/docs/freezes-list.md) shows the active ones by default; `status=lifted` or `all` shows the rest — a freeze past its `until` counts as lifted.

## Quarantine an Operation

A quarantine holds one operation that is still waiting, at the one place it would be signed or sent; the rest of the wallet works as usual. Lifted, the operation goes on from where it waited — its own deadline is not extended.

| operation | Waiting when | Held at |
| --- | --- | --- |
| earn_operation | An [Earn operation](https://docs.aureahub.com/docs/earn-operation-get.md) that is `submitted` and waits for the user's signatures (client-side or MPC wallet). | [Send Signatures](https://docs.aureahub.com/docs/earn-broadcast.md), and the MPC signing of its steps. |
| bank_payout | A [payout paid from a wallet](https://docs.aureahub.com/docs/payout-wallet-get.md) that is `pending` its deposit from one of the user's Aurea wallets. | Every route that would send the deposit from that wallet to the payout's deposit address. |
| agent_execution | An [agent payment](https://docs.aureahub.com/docs/agentic-api.md) waiting for an approval (`approval_required`). | Its approval: nothing runs; it can still be rejected. |

- Anything not waiting answers `409` `OPERATION_NOT_PENDING`, with its `details.state`. A payout Aurea signs nothing for answers `409` `OPERATION_NOT_QUARANTINABLE`, with `details.reason` `hosted_payout` (paid on the bank ramp's page) or `external_source` (deposited from an address outside Aurea).
- One quarantine at a time per operation: `409` `ALREADY_QUARANTINED`.
- **Quarantines a screening places**, where screening is enforced for your tenant [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md) ([Screening & AML Cases](https://docs.aureahub.com/docs/guide-screening.md)): `operation` `operation` — an operation held for your compliance review — and `inbound_transfer` — a received transfer whose sender matched, which stops its wallet from signing anything. Listed with the others (`quarantinedByRole` `screening`, no person), placed and lifted by the AML case that decides them: while the case is open, [Lift a Quarantine](https://docs.aureahub.com/docs/quarantine-lift.md) answers `409` `QUARANTINE_HELD_BY_CASE` (`This quarantine is held by an open AML case: its decision lifts it.`). A received transfer's quarantine that its case confirmed stays until one of you lifts it.

## Who May

- **Freeze, lift and quarantine**: the tenant roles `owner`, `tenantadmin`, `non_signing_admin` and `security_admin`, on their own tenant ([Roles](https://docs.aureahub.com/docs/authentication.md)). A freeze protects and moves nothing, so the Non-signing Admin may place one.
- **Read** the freezes and quarantines: those four and `auditor` and `security_auditor`.
- What an Aurea administrator placed, only Aurea lifts (`403` `FREEZE_LIFT_PLATFORM_ONLY`); a freeze of your tenant itself too. Your tenant's users never reach an Aurea account: `404` `FREEZE_TARGET_NOT_FOUND`.
- A frozen tenant's own administrators are frozen with it.

---

Web version: https://docs.aureahub.com/#guide-freezes