---
title: "Configure exact browser origins and a per-collection request rate. Origins are browser policy, not authentication."
method: PUT
path: "/v1/collections/{id}/security"
---

# Configure exact browser origins and a per-collection request rate. Origins are browser policy, not authentication.

`PUT /v1/collections/{id}/security`

## Request

- Base URL: `http://127.0.0.1:8080`
- URL: `http://127.0.0.1:8080/v1/collections/{id}/security`
- Auth: HTTP bearer

## Path parameters

- `id` string, uuid, required

## Headers

- `X-Likerts-Workspace` string

## Request body

- CollectionSecurityInput
  - `allowedOrigins` string[], required
  - `requestsPerMinute` integer, required

## Response `200`

Applied policy.

- CollectionSecurity
  - `collectionId` string, uuid, required
  - `allowedOrigins` string[], required
  - `requestsPerMinute` integer, required

## Other responses

- `400`: Invalid origin or limit.
- `401`: Unauthorized.
- `403`: The credential scope, membership or role does not permit this operation.
- `404`: Collection not found.
- `413`: JSON request body exceeds 65536 bytes.
- `415`: Content-Type must be application/json.
- `429`: Admission or collection rate limit reached. Honor Retry-After in seconds; admission usually returns1, the collection minute window returns60.
- `500`: Internal failure; do not assume a write failed. Retry only with its original idempotency key and payload.
- `503`: Distributed request admission is temporarily unavailable. No protected handler ran; honor Retry-After.

---

[API](https://skmtc.dev/likerts/apis/likerts-development-api.md) · [All operations](https://skmtc.dev/likerts/apis/likerts-development-api/llms.txt) · [OpenAPI document](https://skmtc.dev/likerts/apis/likerts-development-api/revisions/c583fa096c07?raw)