---
title: Paused permissions
description: "What it means when ZevID or a product pauses one of your app's permissions, how you find out, and what to do."
---

ZevID, or the Zev product itself, can pause one permission without
disconnecting anybody. A pause applies at one of two levels:

- **One connection.** One user's connection loses that permission.
- **Your app on a product.** Every connection of your app on that product
  loses it, and new authorize requests that ask for it are refused.

A paused permission drops off every new token and out of `effectiveScopes`.
Everything else on the connection keeps working.

> **Note:**
> Only ZevAuth can lift a pause. A product can pause, but cannot undo its
> own pause. If you think a pause is a mistake, contact ZevAuth support.

## How you find out

| Where | What you see |
| --- | --- |
| Webhook | `delegated_access.connection.updated` with `scope_suspended` in `changes`, for a pause on one connection. `delegated_access.app.updated` for a pause across your app. See [Webhooks](/delegated-access/webhooks). |
| Token response | The permission is missing from `scope`. |
| Authorize | A redirect to your callback with `error=invalid_scope` and a description saying the permission "is paused for this app". |
| The product's API | `403 scope_paused`. Do not retry the call. |
| ZevAuth console | **Delegated access** shows the permission as "Paused by ZevID" or "Paused by" the product. |

## What to do

- **Stop requesting it.** Drop the paused permission from `scope` in new
  authorize requests until it is unpaused, or they are refused.
- **Degrade the feature.** Hide or disable what depends on it, and tell the
  user it is unavailable for now.
- **Do not retry a `scope_paused` 403.** It will keep failing until ZevID
  unpauses.

If a pause leaves a connection with no usable permission at all, refresh
fails with `invalid_grant`, and the description says no usable permissions
remain. Treat it like any other
`invalid_grant`: stop using the connection and offer the user a reconnect
once the permission is back.

When ZevID unpauses, you receive the same webhooks with
`scope_unsuspended`, and the permission returns on the next token.