---
title: "Set the code-sync policy"
method: PATCH
path: "/api/v1/manage/project/code-sync"
tags: ["Workspace"]
---

# Set the code-sync policy

`PATCH /api/v1/manage/project/code-sync`

## Request

- Base URL: `https://fillo.so`
- URL: `https://fillo.so/api/v1/manage/project/code-sync`
- Auth: HTTP bearer

Choose who may stage code-defined schemas for this project: `publishable_key` lets the browser key stage from an allowed origin, `trusted_only` requires an authenticated sync token. This changes who can act, so it is outward-facing (Tier B). The write takes the project's code-sync lock, so it is serialized against in-flight syncs. Scope: workspace:manage.

## Request body

- object
  - `policy` 'publishable_key' | 'trusted_only', required

## Response `200`

The policy now in force.

- object
  - `policy` 'publishable_key' | 'trusted_only', required

## Other responses

- `400`: Invalid request (e.g. a body on a GET/DELETE, or a missing required query parameter).
- `401`: Missing, malformed, unknown, revoked, or expired key.
- `403`: The key is valid but lacks the required scope.
- `404`: No such resource in this project (returned instead of 403 for ids in other projects).
- `413`: The request body exceeded the 16 KiB management cap.
- `429`: Per-key (120/min), per-workspace (240/min), or per-IP (300/min) rate limit exceeded. Retry after the Retry-After header.

---

[API](https://skmtc.dev/fillo/apis/fillo-management-api.md) · [All operations](https://skmtc.dev/fillo/apis/fillo-management-api/llms.txt) · [OpenAPI document](https://skmtc.dev/fillo/apis/fillo-management-api/revisions/867f943f04f5?raw)