Update the approved provider policy

PUT/v1/trust/policy

Update the approved provider policy.

Changes the approved provider list, turns enforcement on or off, and sets where change alerts go. A field left out is unchanged. While the policy is on, a call to a provider outside approved_providers is refused before it is made. Setting or changing webhook_url, or rotate_webhook_secret: true, issues a new webhook signing secret, returned once in webhook_secret of this response; store it then, it is not shown again. Removing the webhook URL deletes its secret.

Requires an organization owner or admin. Turning the policy on, setting a webhook URL or rotating the secret needs the Trust Pack controls in the plan; turning things off or clearing them never does.

Errors: 400 for an unknown provider id, for turning the policy on with no approved provider, or for a webhook URL that is not allowed (it must be a public https address); 402 when the change needs the Trust Pack controls and the plan does not include them; 403 for a caller who is not an organization owner or admin.

Authorization

AuthorizationBearer va_
A platform API key (va_...), created under Settings > API keys. Scoped to an organization or one workspace, with an admin or member role. Used by the management API.

Query parameters

organizationstringrequired
the organization slug

Request body application/json

the fields to change

approved_providers_enabledboolean
Turn the policy on (true) or off (false). While it is on, a call to a provider not in approved_providers is refused before it is made. Turning it on needs at least one approved provider and the Trust Pack controls in the plan.
approved_providersstring[]
Provider ids, as GET /v1/providers lists them (for example OPENAI, ANTHROPIC, VERTEX_AI); case and dashes are normalised. Replaces the whole list. At most 200; an unknown id is a 400.
At most 200 items
notify_emailboolean
Email the organization's owners and admins when a sub-processor change is found (a new model is not emailed).
webhook_urlstring
An https URL on the public internet that receives every sub-processor change as a signed POST. At most 2048 characters; an empty string removes the webhook and its secret. Setting or changing it issues a new signing secret.
At least 0 characters · At most 2048 characters
rotate_webhook_secretboolean
True issues a new webhook signing secret, returned once in the response; the old one stops working. Ignored when no webhook URL is set.

Responses

200application/json

organizationstring
The organization slug.
entitledboolean
Whether the organization's plan includes the Trust Pack controls, needed to turn the policy or alerts on.
approved_providers_enabledboolean
Whether the policy is on: calls to a provider not in approved_providers are refused before they are made.
approved_providersstring[]
The approved provider ids (for example OPENAI, ANTHROPIC); empty when none is set.
notify_emailboolean
Whether the organization's owners and admins are emailed about sub-processor changes.
webhook_urlstring
The URL that receives every sub-processor change as a signed POST; absent when no webhook is set.
webhook_secret_setboolean
Whether a webhook signing secret exists.
webhook_secretstring
The webhook signing secret (whsec_...), only in the response that created or rotated it; store it then. Each delivery carries X-VectorAxis-Timestamp (Unix seconds) and X-VectorAxis-Signature: sha256={hex}, the HMAC-SHA256 of "{timestamp}.{body}" keyed with this secret.
updated_bystring
Who last changed the policy: the user id, or api-key:{key id} for a platform API key; absent before the first change.
updated_atstring<date-time>
When the policy was last changed (ISO 8601 date-time); absent before the first change.

Request

curl -X PUT "https://api.vectoraxis.ai/v1/trust/policy?organization=string" \
  -H "Authorization: Bearer $VECTORAXIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "approved_providers_enabled": true,
  "approved_providers": [
    "string"
  ],
  "notify_email": true,
  "webhook_url": "string",
  "rotate_webhook_secret": true
}'

VectorAxis is built by GK Labs, a member of NVIDIA Inception.