> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usecobalt.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Lock Client

> Emergency stop: immediately invalidates every access token, EHR session, and your client_secret.

Break-glass endpoint for a broad compromise. Locking is immediate and affects all users under your client: all access tokens are deactivated, all EHR sessions are invalidated, and your `client_secret` is cleared. Only `client_id` and `client_secret` headers are required.

Locking is not self-serve reversible — contact support to unlock, after which users reconnect through [Cobalt Link](/docs/link/overview).

### Example Request

```bash theme={null}
curl -X POST https://api.usecobalt.com/v1/client/lock \
-H 'Content-Type: application/json' \
-H 'client_id: ci_live_198908HJDKJSH98789OHKJL' \
-H 'client_secret: cs_live_9827hofdsklOYYHJLJh'
```

### Example Response

```json theme={null}
{
  "success": true,
  "message": "Account has been locked. Contact support to unlock.",
  "data": {
    "cookies_invalidated": 12,
    "tokens_deactivated": 12,
    "users_deactivated": 12,
    "locked_at": "2026-07-20T19:45:00.000Z"
  }
}
```


## OpenAPI

````yaml POST /client/lock
openapi: 3.0.0
info:
  title: Cobalt API
  version: 1.0.1
  description: API for interacting with Cobalt's EHR integration services
servers:
  - url: https://api.usecobalt.com/v1
security:
  - ClientCredentials: []
    ClientSecret: []
    AccessToken: []
paths:
  /client/lock:
    post:
      summary: Lock Client
      description: >-
        Emergency stop: immediately invalidates every access token, EHR session,
        and your client_secret.
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  message:
                    type: string
                  data:
                    type: object
                    properties:
                      cookies_invalidated:
                        type: integer
                      tokens_deactivated:
                        type: integer
                      users_deactivated:
                        type: integer
                      locked_at:
                        type: string
components:
  securitySchemes:
    ClientCredentials:
      type: apiKey
      in: header
      name: client_id
    ClientSecret:
      type: apiKey
      in: header
      name: client_secret
    AccessToken:
      type: apiKey
      in: header
      name: access_token

````