Replace a project's controls
Replaces the project’s override with exactly the fields you send; omit a field to inherit it. A management key may only TIGHTEN the organization’s controls (narrow an allowlist, add to a denylist, turn ZDR on); anything that loosens them is rejected with 403 scoped_controls_loosening_forbidden. Loosening is available in the dashboard, which requires the organization-settings permission. Requires the manage_projects scope.
Authentication
A management key (prefixed mgmt_), created on the dashboard’s API keys page under Management keys. Distinct from a regular gateway API key, and never used to call models.
Path parameters
Request
Tri-state: omit to inherit the organization’s setting, send false to turn organization-wide ZDR OFF for this scope, true to turn it on.
When non-empty, the only vendors this scope may route to
Soft ordering hint among the vendors that remain; never excludes a vendor
Region tokens (ISO country code or coarse region such as EU, NA) this scope may never route to
When non-empty, the only region tokens this scope may route to. Vendors with no known region are excluded.
Response
Exactly what this scope stores, unit-wrapped: zero_data_retention, vendors {ignored_vendors, allowed_vendors, vendor_routing_preference}, regions {ignored_regions, allowed_regions}. Empty means it inherits everything.
The controls actually in force for the scope: the organization’s with this scope’s units applied. For a customer, a project is not folded in; at request time a customer override still wins over a project’s.
Per unit (zero_data_retention, vendors, regions), which scope supplied the effective value: org or this scope