Emergency stop

Outcome

Stop all sending immediately: for one campaign (campaignId; creates the campaign's next policy version with emergencyStop on) or, without campaignId, for every campaign in the workspace. Nothing is sent while stopped, including already approved messages, which are held with emergency_stop and keep their approval. Approving and editing remain possible. Audited.

Before you start

• Verify the intended environment, signed-in credential, authorized organization and the action permission workspace:write.
• Discover and select an authorized canonical Engage workspace. Pass resourceType=workspace and resourceId separately from action input.
• Review the exact effects and obtain approval before CLI --confirm or MCP confirm:true. A local capture does not authorize a live mutation.

Discover the target

topolo whoami --json
topolo actions get app_topolo_engage.campaigns.emergency_stop --json
topolo workspaces list topolo-engage --json

Set ENGAGE_WORKSPACE_ID to the identifier of the selected authorized workspace.

Input contract

Validate, plan and execute

Build payload.json from the current schema and discovered identifiers. The action description above defines its behavior, limits, side effects and declared errors.

: "${ENGAGE_WORKSPACE_ID:?Set ENGAGE_WORKSPACE_ID to your selected workspace identifier}"
topolo actions validate app_topolo_engage.campaigns.emergency_stop --data @payload.json --json
topolo actions plan app_topolo_engage.campaigns.emergency_stop --resource-type workspace --resource-id "$ENGAGE_WORKSPACE_ID" --data @payload.json --confirm --json

Review the plan and approve its exact effects before executing the unchanged request.

: "${ENGAGE_WORKSPACE_ID:?Set ENGAGE_WORKSPACE_ID to your selected workspace identifier}"
topolo actions call app_topolo_engage.campaigns.emergency_stop --resource-type workspace --resource-id "$ENGAGE_WORKSPACE_ID" --data @payload.json --confirm --json

For MCP, use topolo_get_action, topolo_validate_action, topolo_plan_action and topolo_call_action. Pass resource context separately where required; confirm:true is required for mutations.

Captured successful requests and responses

Captured HTTP 200 · emergency stop and seat allowlist > the workspace stop holds every campaign until resumed

Action input

{
  "reason": "Incident"
}

Actual local response

{
  "scope": "workspace",
  "workspace": {
    "emergencyStop": true,
    "reason": "Incident",
    "updatedBy": "user_1",
    "updatedAt": "2026-10-06T08:30:00.000Z"
  }
}

Source test: emergency stop and seat allowlist > the workspace stop holds every campaign until resumed. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 200 · emergency stop and seat allowlist > keeps the audit trail append-only

Action input

{}

Actual local response

{
  "scope": "workspace",
  "workspace": {
    "emergencyStop": true,
    "reason": null,
    "updatedBy": "user_1",
    "updatedAt": "2026-10-06T08:30:00.000Z"
  }
}

Source test: emergency stop and seat allowlist > keeps the audit trail append-only. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 200 · emergency stop and seat allowlist > a campaign stop holds even approved messages immediately; resume releases them

Action input

{
  "campaignId": "eng_cmp_1",
  "reason": "Complaint"
}

Actual local response

{
  "scope": "campaign",
  "policy": {
    "campaignId": "eng_cmp_1",
    "version": 3,
    "approvalMode": "none",
    "allowedChannels": [
      "email"
    ],
    "dailyVolumeCap": null,
    "maxTouches": null,
    "seatAllowlist": [],
    "emergencyStop": true,
    "changeReason": "Complaint",
    "createdBy": "user_1",
    "createdAt": "2026-10-06T08:30:00.000Z"
  }
}

Source test: emergency stop and seat allowlist > a campaign stop holds even approved messages immediately; resume releases them. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 200 · the runner on a task step > holds while an emergency stop is on and creates nothing; resume releases it

Action input

{
  "campaignId": "eng_cmp_1"
}

Actual local response

{
  "scope": "campaign",
  "policy": {
    "campaignId": "eng_cmp_1",
    "version": 3,
    "approvalMode": "none",
    "allowedChannels": [
      "email"
    ],
    "dailyVolumeCap": null,
    "maxTouches": null,
    "seatAllowlist": [],
    "emergencyStop": true,
    "changeReason": null,
    "createdBy": "user_1",
    "createdAt": "2026-10-06T08:30:00.000Z"
  }
}

Source test: the runner on a task step > holds while an emergency stop is on and creates nothing; resume releases it. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Effects and response meaning

• Stop all sending immediately: for one campaign (campaignId; creates the campaign's next policy version with emergencyStop on) or, without campaignId, for every campaign in the workspace. Nothing is sent while stopped, including already approved messages, which are held with emergency_stop and keep their approval. Approving and editing remain possible. Audited.

Verify the outcome

• Check the response against the declared output schema and the requested operation. For mutations, use the action-specific read described in the action description before any dependent operation.

Recover

For an uncertain result, inspect current retained state with a read action before retrying. Do not replay a mutation unless its contract explicitly guarantees idempotency.

Refused requests

Captured HTTP 404 · emergency stop and seat allowlist > 404s a stop for an unknown campaign and 409s a concurrent policy change

Action input

{
  "campaignId": "eng_cmp_9"
}

Actual local response

{
  "error": {
    "code": "not_found",
    "message": "Campaign was not found in this workspace."
  }
}

Source test: emergency stop and seat allowlist > 404s a stop for an unknown campaign and 409s a concurrent policy change. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 409 · emergency stop and seat allowlist > 404s a stop for an unknown campaign and 409s a concurrent policy change

Action input

{
  "campaignId": "eng_cmp_1"
}

Actual local response

{
  "error": {
    "code": "state_conflict",
    "message": "The policy changed at the same time. Reload and try again."
  }
}

Source test: emergency stop and seat allowlist > 404s a stop for an unknown campaign and 409s a concurrent policy change. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Error recovery

• HTTP 404 not_found: Rediscover the identifier using the related list or get action in the same authorized resource. Do not guess identifiers or change organization context.
• HTTP 409 state_conflict: Read the current retained state and reconcile the requested transition before retrying. Do not blindly replay a non-idempotent mutation.

Related actions

• List outreach campaigns
• Create outreach campaign
• Get outreach campaign
• Update outreach campaign
• Change outreach campaign status
• Get campaign autonomy policy
• Update campaign autonomy policy
• Resume after emergency stop

Evidence and limits

• /api/emergency-stop

• Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

• Widget/bootstrap use actual app handler but mocked worker runtime and app identity.

• No gateway execution, live permissions, external delivery or deployed proof.

These are local route captures with synthetic identity and simulated dependencies. They do not prove live authorization, gateway execution, production state, or external delivery.