Delegated access to Zev products
Paused permissions
What it means when ZevID or a product pauses one of your app's permissions, how you find out, and what to do.
ZevID, or the Zev product itself, can pause one permission without disconnecting anybody. A pause applies at one of two levels:
- One connection. One user’s connection loses that permission.
- Your app on a product. Every connection of your app on that product loses it, and new authorize requests that ask for it are refused.
A paused permission drops off every new token and out of effectiveScopes.
Everything else on the connection keeps working.
How you find out
| Where | What you see |
|---|---|
| Webhook | delegated_access.connection.updated with scope_suspended in changes, for a pause on one connection. delegated_access.app.updated for a pause across your app. See Webhooks. |
| Token response | The permission is missing from scope. |
| Authorize | A redirect to your callback with error=invalid_scope and a description saying the permission “is paused for this app”. |
| The product’s API | 403 scope_paused. Do not retry the call. |
| ZevAuth console | Delegated access shows the permission as “Paused by ZevID” or “Paused by” the product. |
What to do
- Stop requesting it. Drop the paused permission from
scopein new authorize requests until it is unpaused, or they are refused. - Degrade the feature. Hide or disable what depends on it, and tell the user it is unavailable for now.
- Do not retry a
scope_paused403. It will keep failing until ZevID unpauses.
If a pause leaves a connection with no usable permission at all, refresh
fails with invalid_grant, and the description says no usable permissions
remain. Treat it like any other
invalid_grant: stop using the connection and offer the user a reconnect
once the permission is back.
When ZevID unpauses, you receive the same webhooks with
scope_unsuspended, and the permission returns on the next token.
Updated at, Wednesday, October 21, 2026