Create or replace this tenant's policy/toggle settings

Upserts the tenant's policy override, persisting the REQUESTED scalars verbatim (the compliance floor clamp is applied at consume, never on write — so a below-floor request is stored as-is and clamped only when resolved) and a FULL-REPLACE feature-flag bag. Enforces optimistic concurrency on config_version — a stale or missing version against an existing row is rejected with 409 and no write. This is a NON-secret write: there is NO credential, no envelope, no overwrite gate. Caller must hold tenant.settings.write (NOT tenant.settings.secrets.write). Plan 2026-06-16-per-tenant-settings §2.3 / §2.7 / T301.

Authorization

bearerAuth

AuthorizationBearer <token>

JWT Bearer access token. Clock skew tolerance is ±60 seconds.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

rate_limit_per_min*integer

Requested per-minute request rate limit (stored verbatim; clamped to the floor at consume).

Range0 <= value

session_ttl_seconds*integer

Requested session TTL in seconds (stored verbatim; clamped to the floor at consume).

Range1 <= value

refresh_ttl_seconds?integer

OPTIONAL refresh-token lifetime in seconds. Omit or send null to CLEAR the override and inherit the platform-computed lifetime (ACCESS_TOKEN_TTL * 48) — this is a FULL-REPLACE write, so omitting it clears any previously stored value.

Unlike the other scalars (stored verbatim and clamped only at consume) an out-of-band value here is REJECTED with 400 validation_failed: below 3600 it would violate the column CHECK, and above the platform-computed lifetime it is unenforceable — the knob is SHORTEN-ONLY, a tenant may never extend a refresh family beyond what the platform grants. The rejection message names the applicable ceiling.

Range3600 <= value

feature_flags*

Full-replace feature-flag bag persisted as-is.

signup_enabled?boolean

OPTIONAL per-tenant public-signup kill-switch. Omit to leave the current tenants.signup_enabled untouched; set true/false to flip it in the same write. Not part of the config_version optimistic-concurrency check (it lives on a different table).

config_version?integer

Last-seen config_version for optimistic concurrency; omit/null for the first write.

Response Body

`application/json`

curl -X PUT "https://sandbox.505pay.link/v1/admin/settings/policy" \  -H "Content-Type: application/json" \  -d '{    "rate_limit_per_min": 120,    "session_ttl_seconds": 7200,    "refresh_ttl_seconds": 7200,    "feature_flags": {      "public_signup": true    },    "signup_enabled": true,    "config_version": 3  }'

{
  "status": "active",
  "config_version": 4,
  "source": "tenant"
}

{
  "error": "validation_failed",
  "message": "request body is invalid",
  "request_id": "req_01abc126"
}

{
  "error": "unauthenticated",
  "message": "missing or invalid bearer token",
  "request_id": "req_01abc123"
}

{
  "error": "permission_denied",
  "message": "caller does not hold the required permission",
  "request_id": "req_01abc124"
}

{
  "error": "conflict",
  "message": "resource already exists",
  "request_id": "req_01abc129"
}

{
  "error": "body_too_large",
  "message": "request body exceeds the 16384-byte limit",
  "request_id": "req_01abc413"
}

{
  "error": "rate_limit_exceeded",
  "message": "Too many requests to /v1/admin (per-tenant policy)",
  "request_id": "req_01abc132"
}

Was this page helpful?

Create or replace this tenant's policy/toggle settings

Authorization

Request Body

Response Body

200application/json

400application/json

401application/json

403application/json

409application/json

413application/json

429application/json

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`