Response actions

A response action changes something outside Squasher to contain a problem: suspend an Okta user, remove a GitHub collaborator, or deactivate an AWS access key. Squasher, an investigation, or a person proposes the action. The policy below decides if it runs at once or waits for a person.

The policy

Nothing runs on its own by default. Every proposal waits for an owner or admin.
Reversible actions can run on their own. An owner or admin can turn on auto-run for the project. Then a reversible action runs as soon as it is proposed.
Irreversible actions always need a person. No setting changes this. An owner or admin approves an irreversible action in the dashboard. API keys and OAuth tokens (MCP clients and the CLI) cannot approve one.

Every proposal, approval, run, and undo is written to the audit log and to the incident timeline, with who approved it: a person, or the project’s auto-run policy.

Actions

Provider	Action	Effect	Undo
Okta	`user.suspend`	Reversible	`user.unsuspend`
Okta	`user.unsuspend`	Reversible	`user.suspend`
Okta	`user.clear_sessions`	Irreversible	None
GitHub	`repo.remove_collaborator`	Reversible	`repo.add_collaborator`
GitHub	`repo.add_collaborator`	Reversible	`repo.remove_collaborator`
AWS	`iam.deactivate_access_key`	Reversible	`iam.activate_access_key`
AWS	`iam.activate_access_key`	Reversible	`iam.deactivate_access_key`
AWS	`iam.delete_access_key`	Irreversible	None

Earlier actions (fix pull request, Railway redeploy and restart, status page update) are irreversible: they always wait for a person. An action uses the credentials of the project’s connection to the provider. Squasher sends the change one time. If Squasher cannot see the result, it reads the provider again; it never sends the change again.

Preview an action

Every action has a dry run. It shows the change, reads the current state from the provider (for example, that the user is active), and tells you if the action would run on its own. A dry run stores nothing and changes nothing.

Undo an action

A reversible action that succeeded can be undone. The undo is a new proposal of the undo action on the same target, linked to the first one. The same policy applies to it.

Use the API and the CLI

See Response actions API.

squasher actions propose --project <project_id> --provider okta --action user.suspend \
  --target-kind okta_user --target-id <user_id> --title "Contain a compromised user" --dry-run
squasher actions undo --project <project_id> <action_id>
squasher actions policy get --project <project_id>
squasher actions policy set --project <project_id> --auto-reversible true

Get started

Guides

The policy

Actions

Preview an action

Undo an action

Use the API and the CLI

​The policy

​Actions

​Preview an action

​Undo an action

​Use the API and the CLI

The policy

Actions

Preview an action

Undo an action

Use the API and the CLI