---
title: "Stop audit events being deleted: everything, or named workspaces or people."
method: POST
path: "/v1/organizations/current/audit/holds"
tags: ["organizations"]
---

# Stop audit events being deleted: everything, or named workspaces or people.

`POST /v1/organizations/current/audit/holds`

## Request

- Base URL: `https://api.50heads.com`
- URL: `https://api.50heads.com/v1/organizations/current/audit/holds`
- Auth: HTTP bearer

Organization admins only (403 `organization_admin_required`), on a browser session with a fresh proof in the `x-50h-reauth` header (401 `reauth_required`). It needs a person: API keys, connected apps and service accounts get 403 `session_required`. Every change is written to the organization's audit. Up to 50 open holds (409 `too_many_holds`). A workspace must be one of the organization's (404 `workspace_not_found`).

## Request body

- OrganizationLegalHoldCreateRequest
  - `reason` string, required
  - `scope` object, required
    - `all` boolean
    - `workspaceIds` string[]
    - `actorIds` string[]

## Response `201`

OK

- OrganizationLegalHoldCreateResponse
  - `hold` object, required
    - `id` string, required
    - `scope` object, required
      - `all` boolean, required
      - `workspaceIds` string[], required
      - `actorIds` string[], required
    - `reason` string, required
    - `active` boolean, required
    - `createdBy` object, required
      - `id` string, required
      - `name` string, nullable, required
    - `createdAt` string, required
    - `releasedBy` object, nullable, required
      - `id` string, required
      - `name` string, nullable, required
    - `releasedAt` string, nullable, required

## Other responses

- `400`: The request is not valid; `error.details.validation` lists the fixes.
- `401`: No key or token, or it expired or was revoked.
- `403`: The key or token lacks the scope (`insufficient_scope`), or the action is not allowed.
- `429`: Too many requests; wait for Retry-After.

---

[API](https://skmtc.dev/50heads/apis/50heads-api.md) · [All operations](https://skmtc.dev/50heads/apis/50heads-api/llms.txt) · [OpenAPI document](https://skmtc.dev/50heads/apis/50heads-api/revisions/20175e8b00e3?raw)