# /api/v1/instances/[instanceId]/services/disable (management)

Source-derived management endpoint contract, authentication, request validation, responses, and errors.

Source: https://docs.minds.sh/docs/api/platform/reference/management--api-v1-instances-instanceId-services-disable



This is the **management** service route. Its origin and authentication are described in [Platform API overview](/docs/api/platform) and [Authentication](/docs/api/platform/authentication). A path shared by another service is a different endpoint.

| Property                       | Contract                                                                       |
| ------------------------------ | ------------------------------------------------------------------------------ |
| Methods                        | POST                                                                           |
| Path                           | `/api/v1/instances/[instanceId]/services/disable`                              |
| Path parameters                | `instanceId`                                                                   |
| Query parameters read in route | None read directly; schema validation below may define additional fields       |
| Headers read in route          | No additional direct header reads; authentication helpers may read credentials |

## Authentication and access [#authentication-and-access]

Management auth context: validated x-api-key or configured session authentication; trusted gateway integration may select its auth pipeline. Organization/tenant checks are separate.

## Request and response definitions [#request-and-response-definitions]

The following named definitions are imported or declared by this route. Optional markers, defaults, bounds, and enum values are shown exactly as implemented. A response type is a source contract, not an example populated with real account data.

### DisableServiceRequest [#disableservicerequest]

```typescript
export interface DisableServiceRequest {
  services: ServiceName[];
}
```

Source: `minds-ui/apps/api-service/lib/services/hot-loading-service.ts:69`.

## Method behavior [#method-behavior]

The handler excerpt preserves field validation, response envelopes, cookie changes, and exception branches. Values returned by service helpers retain their named response type above; for passthrough routes, the upstream response is authoritative.

### POST [#post]

```typescript
export async function POST(
  request: NextRequest,
  { params }: { params: Promise<{ instanceId: string }> }
) {
  try {
    const authContext = await resolveAuthContext(request, {
      allowApiKey: true,
      allowSession: true,
    });

    const { instanceId } = await params;
    const body = await request.json();

    if (!body.services || !Array.isArray(body.services)) {
      throw new InvalidRequestError('services array required');
    }

    // Get instance to verify tenant access
    const instance = await prisma.serviceInstance.findUnique({
      where: { id: instanceId },
      include: { tenant: true },
    });

    if (!instance || !instance.tenant) {
      return NextResponse.json(
        { error: 'Instance not found' },
        { status: 404 }
      );
    }

    // Ensure tenant access
    await ensureTenantAccess(
      authContext,
      instance.tenant.orgId,
      instance.tenant.ownerId,
      {
        action: 'instance:manage',
        tenantId: instance.tenantId ?? undefined,
        resourceId: instance.id,
        attributes: { operation: 'disable-service' },
      }
      );

    const disableRequest: DisableServiceRequest = {
      services: body.services,
    };

    const result = await hotLoadingService.disableServiceOnInstance(
      instanceId,
      disableRequest,
      authContext.userId
    );

    return NextResponse.json(result);
  } catch (error) {
    if (error instanceof ApiError) {
      return NextResponse.json(
        { error: error.message },
        { status: error.statusCode }
      );
    }

    console.error('[API] Error disabling services:', error);
    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
  }
}
```

Source: `minds-ui/apps/api-service/app/api/v1/instances/[instanceId]/services/disable/route.ts:13`.

## Response and error branches [#response-and-error-branches]

Literal HTTP statuses in the route: 404, 500. Shared management error classes are defined in [Errors and responses](/docs/api/platform/errors).

```typescript
request.json()
```

Source: `minds-ui/apps/api-service/app/api/v1/instances/[instanceId]/services/disable/route.ts:24`.

```typescript
new InvalidRequestError('services array required')
```

Source: `minds-ui/apps/api-service/app/api/v1/instances/[instanceId]/services/disable/route.ts:27`.

```typescript
NextResponse.json(
        { error: 'Instance not found' },
        { status: 404 }
      )
```

Source: `minds-ui/apps/api-service/app/api/v1/instances/[instanceId]/services/disable/route.ts:37`.

```typescript
NextResponse.json(result)
```

Source: `minds-ui/apps/api-service/app/api/v1/instances/[instanceId]/services/disable/route.ts:66`.

```typescript
NextResponse.json(
        { error: error.message },
        { status: error.statusCode }
      )
```

Source: `minds-ui/apps/api-service/app/api/v1/instances/[instanceId]/services/disable/route.ts:69`.

```typescript
NextResponse.json({ error: 'Internal server error' }, { status: 500 })
```

Source: `minds-ui/apps/api-service/app/api/v1/instances/[instanceId]/services/disable/route.ts:76`.

## Service dependencies [#service-dependencies]

* `minds-ui/apps/api-service/lib/services/auth-context.ts`
* `minds-ui/apps/api-service/lib/services/hot-loading-service.ts`
* `minds-ui/apps/api-service/types/errors.ts`
* `minds-ui/apps/api-service/lib/db.ts`

## Evidence [#evidence]

Generated from the local source snapshot on 2026-09-12. This page documents implemented code and does not certify a deployed service, permissions configuration, or successful provider operation.

Source file: `minds-ui/apps/api-service/app/api/v1/instances/[instanceId]/services/disable/route.ts`. SHA-256: `35485b373d282dd553a850edfe0cb15394fcc7a327fdc60a2437106360848cf1`.