Skip to main content
PUT
Publish or replace the protection manifest

Authorizations

Authorization
string
header
required

Supabase JWT token in Authorization: Bearer header

Headers

Idempotency-Key
string
required

Client-supplied idempotency token. Replays within 24 hours return the stored result. See ADR-023.

Required string length: 1 - 128

Path Parameters

scope_id
enum<string>
required

Always default — the platform scope is a singleton; any other value returns 400 with care-framed guidance pointing at default.

Available options:
default

Body

Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.

card_version
string
required
agent_id
string
required
mode
enum<string>
required

Strictest-wins composition: enforce > nudge > observe > off.

Available options:
off,
observe,
nudge,
enforce
thresholds
object
required

Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].

screen_surfaces
object
required

Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).

trusted_sources
object
required

Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.

card_id
string
issued_at
string<date-time>
expires_at
string<date-time> | null
extensions
object

Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.

_composition
object

System-managed block describing which scope sources merged into the canonical card. Only returned when ?include_composition=true.

Response

Composed canonical card after the write.

Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.

card_version
string
required
agent_id
string
required
mode
enum<string>
required

Strictest-wins composition: enforce > nudge > observe > off.

Available options:
off,
observe,
nudge,
enforce
thresholds
object
required

Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].

screen_surfaces
object
required

Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).

trusted_sources
object
required

Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.

card_id
string
issued_at
string<date-time>
expires_at
string<date-time> | null
extensions
object

Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.

_composition
object

System-managed block describing which scope sources merged into the canonical card. Only returned when ?include_composition=true.