Emergency Kill Switch API

The Kill Switch API provides instant, admin-controlled disabling and re-enabling of any provider or model without a service restart. Disabled state is persisted to the database and survives gateway restarts. Every action is written to the audit log with the actor identity, target, and reason.

All endpoints require admin authentication (Authorization: Bearer $ARBITEX_API_KEY).

Base URL: https://gateway.arbitex.ai

When to use the kill switch

Scenario	Recommended action
Planned maintenance — rotating provider credentials or reconfiguring a model	Disable the target before the window; re-enable after verification
Cost runaway — unexpected spend spike from a provider or model	Disable immediately to stop traffic; investigate, then re-enable
Security event — compromised provider credentials or a model producing harmful output	Disable immediately; do not re-enable until the incident is resolved
Provider outage — provider is returning consistent errors and the health monitor has not yet disengaged it	Disable manually to prevent retries consuming quota; re-enable when the provider confirms recovery

The kill switch acts independently of the automatic health monitor. A kill-switched provider is never re-enabled automatically — an admin must call the enable endpoint. See Kill switch vs health monitoring for details.

Endpoints summary

Provider-level

Method	Path	Description
`GET`	`/api/admin/kill-switch/providers`	List all providers with kill switch state
`POST`	`/api/admin/kill-switch/providers/{provider}/disable`	Disable all models for a provider
`POST`	`/api/admin/kill-switch/providers/{provider}/enable`	Re-enable all models for a provider

Model-level

Method	Path	Description
`GET`	`/api/admin/kill-switch/models/{model_config_id}`	Get kill switch state for a single model
`POST`	`/api/admin/kill-switch/models/{model_config_id}/disable`	Disable a single model
`POST`	`/api/admin/kill-switch/models/{model_config_id}/enable`	Re-enable a single model

KillSwitchStateResponse object

Returned by model-level endpoints and as entries in provider-level list responses.

Field	Type	Description
`id`	`UUID`	`ModelConfig` primary key
`provider`	`string`	Provider identifier (e.g. `anthropic`, `openai`, `google`)
`model_id`	`string`	Model identifier (e.g. `claude-sonnet-4-20250514`, `gpt-4o`)
`display_name`	`string`	Human-readable model name from the admin catalog
`is_active`	`bool`	Admin catalog active flag — whether the model is available for routing; independent of the kill switch
`kill_switch_active`	`bool`	`true` if the kill switch is currently engaged (model is disabled)
`kill_switch_disabled_at`	`datetime \| null`	Timestamp when the kill switch was last engaged, or `null` if currently enabled
`disabled_reason`	`string \| null`	The `DisabledReason` value provided at disable time, or `null` if currently enabled

DisabledReason values

Value	Description
`maintenance`	Planned maintenance window
`cost_runaway`	Unexpected cost spike
`security_event`	Security incident response
`other`	Unspecified reason

List providers

GET /api/admin/kill-switch/providers

Returns all configured providers with a summary of their kill switch state.

Request

curl -s https://gateway.arbitex.ai/api/admin/kill-switch/providers \
  -H "Authorization: Bearer $ARBITEX_API_KEY"

Response 200 OK

[
  {
    "provider": "anthropic",
    "kill_switch_active": false,
    "model_count": 4,
    "disabled_count": 0,
    "disabled_reason": null
  },
  {
    "provider": "openai",
    "kill_switch_active": true,
    "model_count": 6,
    "disabled_count": 6,
    "disabled_reason": "security_event"
  },
  {
    "provider": "google",
    "kill_switch_active": false,
    "model_count": 3,
    "disabled_count": 1,
    "disabled_reason": null
  }
]

kill_switch_active at the provider level is true when every model in the provider has the kill switch engaged. disabled_count is the number of individual models currently disabled.

Disable all models for a provider

POST /api/admin/kill-switch/providers/{provider}/disable

Immediately disables all models for the specified provider. Requests targeting any model under this provider return 503 provider_unavailable until re-enabled. The gateway writes one audit log entry per disabled model.

Path parameters

Parameter	Type	Description
`provider`	`string`	Provider identifier (`anthropic`, `openai`, `google`, etc.)

Request body

Field	Type	Required	Description
`reason`	`string`	yes	One of the `DisabledReason` values

Request — disable OpenAI due to security incident

curl -s -X POST \
  https://gateway.arbitex.ai/api/admin/kill-switch/providers/openai/disable \
  -H "Authorization: Bearer $ARBITEX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"reason": "security_event"}'

Response 200 OK

{
  "provider": "openai",
  "models_disabled": 6,
  "disabled_at": "2026-03-12T14:07:33Z"
}

Re-enable all models for a provider

POST /api/admin/kill-switch/providers/{provider}/enable

Re-enables all kill-switched models for the provider. Traffic resumes immediately. The gateway writes one audit log entry per re-enabled model.

Path parameters

Parameter	Type	Description
`provider`	`string`	Provider identifier

Request body

Field	Type	Required	Description
`reason`	`string`	no	Optional `DisabledReason` for the audit log — records why traffic was restored

Request — re-enable OpenAI after incident resolution

curl -s -X POST \
  https://gateway.arbitex.ai/api/admin/kill-switch/providers/openai/enable \
  -H "Authorization: Bearer $ARBITEX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"reason": "security_event"}'

Response 200 OK

{
  "provider": "openai",
  "models_enabled": 6,
  "enabled_at": "2026-03-12T16:45:10Z"
}

Get model kill switch state

GET /api/admin/kill-switch/models/{model_config_id}

Returns the current kill switch state for a single model.

Path parameters

Parameter	Type	Description
`model_config_id`	UUID	`ModelConfig` primary key

Request

curl -s \
  https://gateway.arbitex.ai/api/admin/kill-switch/models/3fa85f64-5717-4562-b3fc-2c963f66afa6 \
  -H "Authorization: Bearer $ARBITEX_API_KEY"

Response 200 OK

{
  "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "provider": "anthropic",
  "model_id": "claude-sonnet-4-20250514",
  "display_name": "Claude Sonnet 4",
  "is_active": true,
  "kill_switch_active": false,
  "kill_switch_disabled_at": null,
  "disabled_reason": null
}

Response 404 Not Found — model config ID does not exist within the tenant.

Disable a single model

POST /api/admin/kill-switch/models/{model_config_id}/disable

Disables a single model. Requests targeting this specific model return 503 provider_unavailable. Other models for the same provider are unaffected.

Path parameters

Parameter	Type	Description
`model_config_id`	UUID	`ModelConfig` primary key

Request body

Field	Type	Required	Description
`reason`	`string`	yes	One of the `DisabledReason` values

Request — disable a model for scheduled maintenance

curl -s -X POST \
  https://gateway.arbitex.ai/api/admin/kill-switch/models/3fa85f64-5717-4562-b3fc-2c963f66afa6/disable \
  -H "Authorization: Bearer $ARBITEX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"reason": "maintenance"}'

Response 200 OK — the updated KillSwitchStateResponse

{
  "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "provider": "anthropic",
  "model_id": "claude-sonnet-4-20250514",
  "display_name": "Claude Sonnet 4",
  "is_active": true,
  "kill_switch_active": true,
  "kill_switch_disabled_at": "2026-03-12T02:00:00Z",
  "disabled_reason": "maintenance"
}

Request — disable a model due to cost runaway

curl -s -X POST \
  https://gateway.arbitex.ai/api/admin/kill-switch/models/a1b2c3d4-e5f6-7890-abcd-ef1234567890/disable \
  -H "Authorization: Bearer $ARBITEX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"reason": "cost_runaway"}'

Response 200 OK

{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "provider": "openai",
  "model_id": "gpt-4o",
  "display_name": "GPT-4o",
  "is_active": true,
  "kill_switch_active": true,
  "kill_switch_disabled_at": "2026-03-12T09:22:15Z",
  "disabled_reason": "cost_runaway"
}

Response 404 Not Found — model config ID does not exist within the tenant.

Re-enable a single model

POST /api/admin/kill-switch/models/{model_config_id}/enable

Re-enables a single kill-switched model. Traffic to that model resumes immediately.

Path parameters

Parameter	Type	Description
`model_config_id`	UUID	`ModelConfig` primary key

Request

curl -s -X POST \
  https://gateway.arbitex.ai/api/admin/kill-switch/models/3fa85f64-5717-4562-b3fc-2c963f66afa6/enable \
  -H "Authorization: Bearer $ARBITEX_API_KEY"

Response 200 OK — the updated KillSwitchStateResponse

{
  "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "provider": "anthropic",
  "model_id": "claude-sonnet-4-20250514",
  "display_name": "Claude Sonnet 4",
  "is_active": true,
  "kill_switch_active": false,
  "kill_switch_disabled_at": null,
  "disabled_reason": null
}

Response 404 Not Found — model config ID does not exist within the tenant.

Audit log

Every enable and disable action is written to the audit log synchronously — the API response is not returned until the audit record is committed.

Field	Description
`action`	`kill_switch_disable` when a model is disabled; `kill_switch_enable` when re-enabled
`actor_id`	UUID of the admin who performed the action
`target_provider`	The affected provider identifier (e.g. `openai`)
`target_model`	The affected model identifier (e.g. `gpt-4o`), or `"*"` for provider-wide actions
`reason`	The `DisabledReason` value provided in the request body
`timestamp`	ISO 8601 timestamp of the action

For provider-level disable/enable calls, the gateway writes one audit entry per model affected. A provider with six models produces six audit records — one per model — allowing per-model audit trail queries.

Audit entries are forwarded to your SIEM alongside request audit entries. Query them in the audit log API using action=kill_switch_disable or action=kill_switch_enable.

Behavior when a model is kill-switched

Requests routed to a kill-switched model return 503 provider_unavailable immediately, before the request reaches the provider.
Fallback chains skip kill-switched entries automatically. If gpt-4o is disabled and listed as a secondary in a fallback chain, the gateway proceeds to the next entry.
If all entries in a fallback chain are kill-switched, the request returns 503 provider_unavailable with no further fallback attempts.
Requests already in flight when the switch is activated complete normally — the kill switch applies to new requests only.
The kill switch state is persisted to the database. It survives gateway restarts and pod recycling.

Error codes

Status	Condition
`400 Bad Request`	Missing or invalid `reason` value
`403 Forbidden`	Caller is not an admin
`404 Not Found`	Provider or model config ID does not exist within the tenant

Emergency Kill Switch API

When to use the kill switch

Endpoints summary

Provider-level

Model-level

KillSwitchStateResponse object

DisabledReason values

List providers

Disable all models for a provider

Re-enable all models for a provider

Get model kill switch state

Disable a single model

Re-enable a single model

Audit log

Behavior when a model is kill-switched

Error codes

See also