> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudcruise.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Pausing

> Pause a workflow or vault credential so queued runs stop repeating a failure

A pause stops queued runs from repeating a failure that cannot succeed. CloudCruise can pause a whole workflow or a single vault credential, either from an [error code action](https://docs.cloudcruise.com/concepts/maintenance-agent/error-codes.md#error-code-actions) or from a login failure.

## Pause actions

| Action | What happens |
| - | - |
| `pause_workflow` | The run ends as `execution.stopped` and its workflow is paused. Queued runs of that workflow stay in `execution.paused` until you unpause the workflow in **Runs → Paused Resources**, or call [`POST /runs/unpause`](https://docs.cloudcruise.com/run-api/unpause-runs) with `pause_resource` set to `workflow`. If the workflow could not be paused, the run fails as with `alert` |
| `pause_credential` | The run ends as `execution.stopped` and the vault credential it used is paused. Only queued runs that use that credential stay in `execution.paused`; other workflows keep running. Unpause the credential in **Runs → Paused Resources**, or call [`POST /runs/unpause`](https://docs.cloudcruise.com/run-api/unpause-runs) with `pause_resource` set to `credential`. If no credential could be paused, the run fails as with `alert` |

`pause_workflow` and `pause_credential` always send a `run.stopped` notification through your notification rules. Rules that listen for `run.failed` receive it too, so existing rules keep working. It names the error code, what was paused, and how many workflows and queued runs were stopped or held, so a pause is never silent. A workflow with notifications turned off stays quiet.

## Pause the credential on login failure

Three login failures can pause the vault credential the run used, so queued runs stop retrying a login that cannot work and the account is not locked out. It is off by default and you opt in under **Settings → Error Handling → Pause credential on login failure**:

| Option | Pauses when |
| - | - |
| Invalid credentials | The site rejects the username or password |
| Password update required | The site demands a password change that cannot be skipped |
| Account locked | The site says the account is locked, suspended or disabled, and the page the run stopped on shows that wording. A plain access-denied page, an attempt limit or a CDN block never counts as a lock |

Turn on any of them. The run that hit the failure ends as `execution.stopped`. If the run used several vault credentials, only the one for the site it failed on is paused; when that site matches none of them, or more than one, nothing is paused. A workflow can use the workspace setting or override it on its own **Error Handling** tab, or through the Workflow API with `pause_on_invalid_credentials` and `pause_on_password_update`. Omit a field to leave it unchanged, send `null` to use the workspace setting, and send `false` to turn it off for that workflow even when the workspace has it on. The workspace-wide setting can only be changed in the dashboard. A skippable password prompt never pauses.

**Password update required** cannot be on while **Password Update Recovery** is on, because recovery changes the password itself. Turn one off to use the other. Unpause the credential in **Runs → Paused Resources**, or call [`POST /runs/unpause`](https://docs.cloudcruise.com/run-api/unpause-runs) with `pause_resource` set to `credential`.

An error code with its own action, such as `pause_workflow` or `pause_credential`, takes priority over this setting.

## Pause the workflow when the service is retired

When a run fails because the site says the application or service itself has been permanently retired, discontinued or decommissioned (`SERVICE_UNAVAILABLE` / `SERVICE_RETIRED`), the workflow can be paused so queued runs stop failing against a service that no longer exists. It is off by default and you opt in under **Settings → Error Handling → Pause Workflow on Retired Service**. A workflow can use the workspace setting or override it on its own **Error Handling** tab.

The run that hit the retirement notice ends as `execution.stopped`, queued runs of that workflow stay in `execution.paused`, and the pause shows in **Runs → Paused Resources** with the reason "Paused because the target service is retired". It never pauses a credential, because a retired service says nothing about the account. Scheduled maintenance, a temporary outage or a single unavailable item is not a retirement and never pauses. Unpause the workflow in **Runs → Paused Resources**, or call [`POST /runs/unpause`](https://docs.cloudcruise.com/run-api/unpause-runs) with `pause_resource` set to `workflow`.

Every pause from a pause setting sends a `run.stopped` notification that says why it paused, for example "Paused 1 workflow because the target service is retired". An error code with its own action takes priority over this setting.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.