Legal Hold is part of the Enterprise compliance suite. A held account is frozen against data loss: the retention sweep skips it entirely, and bulk-deletion paths refuse to purge its data (batch deletion refuses the whole request when a held account is in scope). This is the "litigation hold" primitive — once an account is under hold, its archived email cannot be removed by routine policy or by users.
Behavior
- Place or release a hold on single accounts or in batch
- Every hold is a case record: it carries an optional case/matter reference, a reason, the operator, and placement/release timestamps
- An account can carry more than one active case. The account stays frozen until the last active case is released
- Release is account-wide: it closes every active case on that account and lifts the flag. Releasing a hold therefore means "this account is no longer preserved for any active matter"
- Place/release actions emit audit events; releases additionally require attention under dual control (
legal_hold.releaseis one of the gated operations) - Holds placed before case records existed are shown as a synthesized legacy case, so the console and evidence pack never imply an empty history over a held account
- WebUI console at
/legal-hold
API
Requires the legal:hold permission and an Enterprise license.
| Method | Path | Description |
|---|---|---|
GET | /api/v1/legal-hold | List active hold cases (an account can appear more than once) |
POST | /api/v1/legal-hold/{account_id} | Place a hold case on one account |
DELETE | /api/v1/legal-hold/{account_id} | Release every active case on one account |
POST | /api/v1/legal-hold/batch | Place hold cases in batch |
DELETE | /api/v1/legal-hold/batch | Release every active case on each account |
Single-account bodies are:
{ "reason": "Pending litigation", "case_ref": "2026-014" }A reason is required when placing a hold; case_ref is optional. Batch bodies use the same fields with account_ids:
{ "account_ids": [12, 27], "reason": "Case 2026-014", "case_ref": "2026-014" }The batch response reports ok, error, and — when a release was queued under dual control — pending and request_id per account, so a partially successful batch is visible account by account. Listing holds is also allowed to a compliance officer holding compliance:audit; placing and releasing still require legal:hold.
Note: In the Community and Pro editions, the
legal_holdflag exists in the schema but is alwaysfalse— holds simply do not engage.