Update Organization PI Settings
Replace the organization’s prompt injection policy as a whole: a field you omit takes its default.
Authentication
A management key (mgmt_...), sent as Authorization: Bearer <key>. Reading /v1/routing-policies also accepts the organization’s gateway API keys; writing there needs a management key.
Request
Regular expressions whose matching prompt segments skip screening. A project’s patterns add to the organization’s, never replacing them. A pattern that matches ordinary text, such as .*, is ignored.
Direct injection: a prompt segment is blocked when its score, from 0 to 1, reaches this value. At least the organization’s pi_pass_threshold.
Reject requests, with code: "sidecar_error", when screening is unavailable. false lets them through unscreened.
Indirect injection, in tool results and documents: off, alert or block. A separate axis from pi_mode.
Reserved: requests are screened as pi_mode says.
Direct injection, in the prompt a user sends: off, alert (score and record, never block) or block.
What the response-side check does with a leaked credential, such as an API key: redact replaces it with a placeholder, observe only records it. Other values behave like observe.
Reserved: no effect on screening yet. At most pi_block_threshold.
Reserved for a future route action.
Indirect injection: the score, from 0 to 1, at which the heuristic signal fires.
Indirect injection: the score, from 0 to 1, at which the similarity-to-known-attacks signal fires.
Response
Regular expressions whose matching prompt segments skip screening. A project’s patterns add to the organization’s, never replacing them. A pattern that matches ordinary text, such as .*, is ignored.
Direct injection: a prompt segment is blocked when its score, from 0 to 1, reaches this value. At least the organization’s pi_pass_threshold.
Reject requests, with code: "sidecar_error", when screening is unavailable. false lets them through unscreened.
Indirect injection, in tool results and documents: off, alert or block. A separate axis from pi_mode.
Reserved: requests are screened as pi_mode says.
Direct injection, in the prompt a user sends: off, alert (score and record, never block) or block.
What the response-side check does with a leaked credential, such as an API key: redact replaces it with a placeholder, observe only records it. Other values behave like observe.
Reserved: no effect on screening yet. At most pi_block_threshold.
Reserved for a future route action.
Indirect injection: the score, from 0 to 1, at which the heuristic signal fires.
Indirect injection: the score, from 0 to 1, at which the similarity-to-known-attacks signal fires.