PUT /api/policy-parameters

Write one or more of the four policy parameters.

Writes a batch of {key, value} pairs. Every OTHER parameter is refused BY NAME; the accepted four are listed in the 400 body under accepts.

WARNING: A KEY SERVER RESTART IS REQUIRED before either policy takes effect. Both are read ONCE, at policy initialisation, and the running server goes on behaving exactly as it did until it is restarted. A 200 here means the value is stored, not that it is in force.

WARNING: the gate is atomic and the wire is not. Nothing is sent until every key validates and passes the writers check -- but the write itself is one operation per key, with no batch and no rollback. So on a 409, a key listed under applied really is written even though the response is a failure.

WARNING: if you set these same parameters from the Java thick client instead, the stored value will be silently wrong. That client writes both role-assignment parameters as a bare comma list, while the engine reads the FIRST number as an element count -- so a stored single role id is read as "that many elements, none of them", losing the role entirely, and a list has its first entry dropped and a zero invented. This route writes the count-first form the engine actually reads.

saved is computed from a fresh read, never from the call returning: the write resolves void, and the key server saves the value uninspected after authorizing it.

Authentication

Send the session id as Authorization: Bearer <session id>, and an RFC 9449 DPoP proof in the DPoP header if your session is bound to a key. The two are required together, not as alternatives — see Authenticating and Proving you hold your key.

This surface sets no cookie

There is no session cookie on any response and none is read on any request. Do not set credentials: "include" on a browser fetch.

Request

Field	Type	Required	Description
writes	array of object	yes

writes[] object

Field	Type	Required	Description
key	string	yes	One of the four accepted policy keys. Any other is refused by name.
value	string	yes	A string. For a boolean-grammar key that is "1" or "0"; for a role-list key it is validated against that grammar before anything is sent.

Example

{
  "writes": [
    {
      "key": "...",
      "value": "..."
    }
  ]
}

Responses

200

Every requested value is present in a fresh read taken after the write.

Field	Type	Required	Description
code	string	no	Absent on success; NOT_VERIFIED otherwise.
saved	boolean	no
applied	array of object	no	Keys the write reached. On a 409 these really were written -- the gate is atomic, the wire is not.
notApplied	array of object	no
detail	string	no

Example

{
  "code": "...",
  "saved": true,
  "applied": [
    {}
  ],
  "notApplied": [
    {}
  ],
  "detail": "..."
}

400

BAD_REQUEST -- writes absent, not an array or empty; an entry malformed or duplicated; a key outside the accepted four (the body carries accepts); or a value that fails its key's grammar. Nothing was sent.

401

No live session, or a DPoP proof that did not verify.

SESSION_NOT_FOUND -- the credential names no session this Gateway holds. SESSION_EXPIRED -- it aged out. Both carry reauth: true; obtain a new credential rather than retrying.

PROOF_* -- the sender constraint refused. See the DPoP section of this document for the full table; PROOF_MALFORMED is a 400 and PROOF_REPLAY_CACHE_FULL a 503, and the rest are here.

SCOPED_CREDENTIAL_EXPIRED -- a scoped browser credential passed its fixed lifetime. Use does not extend it: an idle timeout would be refreshed by exactly the traffic a stolen handle produces.

403

NOT_WRITABLE -- one or more keys are not writable by any role you hold, and NOTHING was sent. See the split-writers warning on the GET: no single identity can necessarily satisfy one request that sets both an auto-create key and a role list.

409

NOT_VERIFIED -- the read-back does not show every requested value. Note that keys under applied really were written; see the atomicity warning.

500

A fault rather than a refusal.

OP_FAILED is the catch-all: the key server refused in words that match no classified pattern, so the Gateway cannot say more than that the operation did not happen. Some key server refusals that are conceptually a caller error arrive here rather than as a 4xx, because the wire carries no distinguishing code -- where a route can recognise one from its message it maps it, and each such mapping is documented on the operation.

503

A capacity ceiling or a missing deployment prerequisite. retryable says which.

A scope of session or process names the ceiling that was hit, and the response carries Retry-After.

Error handling

Every failure answers JSON carrying at least code and detail. Match on code — detail is written for a human debugging the call and its wording is not part of the contract. See the error model.

Status	Meaning
400	BAD_REQUEST -- writes absent, not an array or empty; an entry malformed or duplicated; a key outside the accepted four (the body carries accepts); or a value that fails its key's grammar. Nothing was sent.
401	No live session, or a DPoP proof that did not verify. SESSION_NOT_FOUND -- the credential names no session this Gateway holds. SESSION_EXPIRED -- it aged out. Both carry reauth: true; obtain a new credential rather than retrying. PROOF_* -- the sender constraint refused. See the DPoP section of this document for the full table; PROOF_MALFORMED is a 400 and PROOF_REPLAY_CACHE_FULL a 503, and the rest are here. SCOPED_CREDENTIAL_EXPIRED -- a scoped browser credential passed its fixed lifetime. Use does not extend it: an idle timeout would be refreshed by exactly the traffic a stolen handle produces.
403	NOT_WRITABLE -- one or more keys are not writable by any role you hold, and NOTHING was sent. See the split-writers warning on the GET: no single identity can necessarily satisfy one request that sets both an auto-create key and a role list.
409	NOT_VERIFIED -- the read-back does not show every requested value. Note that keys under applied really were written; see the atomicity warning.
500	A fault rather than a refusal. OP_FAILED is the catch-all: the key server refused in words that match no classified pattern, so the Gateway cannot say more than that the operation did not happen. Some key server refusals that are conceptually a caller error arrive here rather than as a 4xx, because the wire carries no distinguishing code -- where a route can recognise one from its message it maps it, and each such mapping is documented on the operation.
503	A capacity ceiling or a missing deployment prerequisite. retryable says which. A scope of session or process names the ceiling that was hit, and the response carries Retry-After.