Replace a project's prompt injection settings

{
  "override": {
    "pi_mode": "off",
    "pi_block_threshold": 0.5,
    "pi_indirect_mode": "off",
    "pi_tier2a_block_threshold": 0.5,
    "pi_tier2b_block_threshold": 0.5,
    "pi_output_action": "observe",
    "pi_fail_closed": true,
    "pi_allowlist_patterns": [
      "string"
    ]
  },
  "effective": {
    "pi_mode": "string",
    "pi_block_threshold": 1.1,
    "pi_pass_threshold": 1.1,
    "pi_input_action": "string",
    "pi_output_action": "string",
    "pi_allowlist_patterns": [
      "string"
    ],
    "pi_safer_vendor_route": "string",
    "pi_fail_closed": true,
    "pi_log_full_text_on_block": true,
    "pi_indirect_mode": "string",
    "pi_tier2a_block_threshold": 1.1,
    "pi_tier2b_block_threshold": 1.1
  },
  "inherited_fields": [
    "string"
  ]
}

Replaces the override as a whole. Fields you omit inherit the organization value; send a field as null to clear it back to inheritance. An empty body means inherit everything, the same as DELETE. A project pinned to an API key uses this policy as written. A project named per request (project_id body field or X-Project-Id header) may only tighten the organization policy; anything that loosens it is ignored at request time.

Authentication

AuthorizationBearer

A management key (prefixed mgmt_), created in the dashboard under Settings, API keys, Management keys. Distinct from a regular gateway API key, and never used to call models.

Path parameters

project_idstringRequiredformat: "uuid"

Request

This endpoint expects an object.

pi_modeenum or nullOptional

Direct-injection enforcement mode: off, alert, or block

pi_block_thresholddouble or nullOptional0-1

Direct-injection block threshold. Must be at least the organization’s pi_pass_threshold, which is not overridable per project

pi_indirect_modeenum or nullOptional

Indirect-injection enforcement mode, a separate axis from pi_mode

pi_tier2a_block_thresholddouble or nullOptional0-1

Indirect-injection heuristic-confidence threshold

pi_tier2b_block_thresholddouble or nullOptional0-1

Indirect-injection embedding-similarity threshold

pi_output_actionenum or nullOptional

What to do when the response-side check fires

pi_fail_closedboolean or nullOptional

Whether to reject requests when the detection service is unavailable. Defaults to failing open

pi_allowlist_patternslist of strings or nullOptional

Regexes whose matching segments skip scanning. Unioned with the organization's list, never replacing it. A pattern broad enough to match ordinary prose disables enforcement rather than narrowing it

Response

The project's settings, with the effective policy resolved.

overrideobjectOptional

What this project sets. Fields it does not set are null here

effectiveobjectOptional

The policy a request to this project runs under, assuming the project is pinned to an API key

inherited_fieldslist of stringsOptional

Fields taken from the organization policy because the project does not set them

Errors

403

Forbidden Error

404

Not Found Error

422

Unprocessable Entity Error