Sentinel User Management

Sentinel acts as a native Identity Provider (IDP) for your SaaS applications. In this section, you can monitor and manage the security profile of every registered user.

User Security Status

For every user, the table provides:

• CustomerID: The external identifier linked to your user.
• Status: Account state (Active or Suspended).
• OTP (One-Time Password): Indicates if the user has correctly configured 2FA (T-OTP).
• Backup Codes: Shows whether emergency recovery codes have been generated.

Administrative Actions

As an administrator, you can manage the user lifecycle:

1. Suspend Access: If you detect compromised activity, you can instantly block new IDP authentication attempts for the user.
2. Restore Access: Allows you to reactivate a previously suspended user once the threat is resolved.
3. Delete: Permanently removes the user from the Sentinel system.

Note: Suspending a user blocks OTP and passkey authentication at the IDP level. Your application remains responsible for invalidating any session it has already issued.

Public API

Server-side integrations can manage the same lifecycle through the Public API. All three endpoints use the user external_id, are scoped to the company associated with the bearer token, and require sentinel:write.

Suspend and reactivate are idempotent. Delete permanently removes the identity, OTP secrets, backup codes, passkeys, and its stored access log; it cannot be undone. A user outside the authenticated company is returned as not found.

curl --request POST \
  'https://api.hub.donutwork.com/2026-02-01/sentinel/users/ORG_USR_9921_AFG/suspend.json' \
  --header 'Authorization: Bearer YOUR_API_KEY'

See the IDP & Sentinel API reference for response schemas and error details.