---
title: "Activate Agent Control Profile"
method: POST
path: "/v1/agent-control-profiles/activate"
tags: ["enterprise-agent-control"]
---

# Activate Agent Control Profile

`POST /v1/agent-control-profiles/activate`

## Request

- Base URL: `https://api.forgeorbital.com`
- URL: `https://api.forgeorbital.com/v1/agent-control-profiles/activate`
- Auth: HTTP bearer

Atomically create and activate the next tenant profile version.

## Request body

- union: The complete immutable configuration for one next active version.
  - object
    - `hard_constraints` string[], required
    - `schema_version` 'forge-agent-control-profile/v1' | 'forge-agent-control-profile/v2'
    - `profile_id` string, required
    - `version` integer, required
    - `decision_options` string[], required
    - `abstention_action` string, required
    - `required_approvals` string[], required
    - `permitted_attester_key_ids` string[]: Configured attester identifiers. New protected integrations use full Ed25519 public-key fingerprints; legacy label identifiers are retained for record compatibility but cannot verify a positive control.
    - `control_attester_grants` ControlAttesterGrant[]: Required by v2. Each configured constraint or approval label is assigned exactly once to a full Ed25519 public-key fingerprint; one key cannot serve both control kinds.
      - `key_id` string, required
      - `kind` 'constraint' | 'approval', required
      - `labels` string[], required
    - `permitted_outcome_authority_ids` string[]: Configured outcome-authority identifiers. Each signed decision labels these as configured_not_verified.
    - `prior_active_profile_sha256` string, nullable: Required from version 2 onward and must exactly match the current active digest. Version 1 must omit it.
  - object
    - `required_approvals` string[], required
    - `schema_version` 'forge-agent-control-profile/v1' | 'forge-agent-control-profile/v2'
    - `profile_id` string, required
    - `version` integer, required
    - `decision_options` string[], required
    - `abstention_action` string, required
    - `hard_constraints` string[], required
    - `permitted_attester_key_ids` string[]: Configured attester identifiers. New protected integrations use full Ed25519 public-key fingerprints; legacy label identifiers are retained for record compatibility but cannot verify a positive control.
    - `control_attester_grants` ControlAttesterGrant[]: Required by v2. Each configured constraint or approval label is assigned exactly once to a full Ed25519 public-key fingerprint; one key cannot serve both control kinds.
      - `key_id` string, required
      - `kind` 'constraint' | 'approval', required
      - `labels` string[], required
    - `permitted_outcome_authority_ids` string[]: Configured outcome-authority identifiers. Each signed decision labels these as configured_not_verified.
    - `prior_active_profile_sha256` string, nullable: Required from version 2 onward and must exactly match the current active digest. Version 1 must omit it.

## Response `200`

Exact replay of the already-active immutable version.

- AgentControlProfileResponse
  - `schema_version` 'forge-agent-control-profile/v1' | 'forge-agent-control-profile/v2', required
  - `tenant_id` string, required
  - `profile_id` string, required
  - `version` integer, required
  - `decision_options` string[], required
  - `abstention_action` string, required
  - `hard_constraints` string[], required
  - `required_approvals` string[], required
  - `permitted_attester_key_ids` string[], nullable
  - `control_attester_grants` ControlAttesterGrant[], nullable
    - `key_id` string, required
    - `kind` 'constraint' | 'approval', required
    - `labels` string[], required
  - `control_attestation_context` ControlAttestationContext: Server-owned replay boundary a customer signer must bind exactly.
    - `audience` 'forge-enterprise-decision-control', required
    - `environment` string, required
    - `deployment_id` string, required
  - `permitted_outcome_authority_ids` string[], required
  - `profile_sha256` string, required
  - `prior_active_profile_sha256` string, nullable
  - `created_by_principal_sha256` string, required
  - `created_at` string, required
  - `active` true, required
  - `idempotent_replay` boolean, required

## Other responses

- `201`: Successful Response
- `422`: Stable, sanitized product API error.
- `default`: Stable, sanitized product API error.

---

[API](https://skmtc.dev/forgeorbital/apis/forge-decision-records-api.md) · [All operations](https://skmtc.dev/forgeorbital/apis/forge-decision-records-api/llms.txt) · [OpenAPI document](https://skmtc.dev/forgeorbital/apis/forge-decision-records-api/revisions/4410e0e5c86a?raw)