---
title: "Get this layer's protection manifest"
method: GET
path: "/protection/org/{org_id}"
tags: ["Protection"]
---

# Get this layer's protection manifest

`GET /protection/org/{org_id}`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/protection/org/{org_id}`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-Mnemom-Api-Key`
  - API key in cookie `mnemom_session`

Returns the org-scope protection spec as authored. Response is content-negotiated — YAML by default, or JSON with `Accept: application/json`. Pass `?include_composition=true` to include the `_composition` metadata block describing which scopes were merged. Pass `?include=sources` (see ADR-053) for the scope-resolution envelope — the contributing layers plus the composed result; the envelope shape is scope-specific. ETag is computed from `content_hash` (cards-as-primitive Phase 1); `If-None-Match` returns 304. For the composed view across scopes, use the `/effective` sub-resource (Wave 2). Authorization: the caller must be a member (any role) of the organization named by `org_id`; a non-member (or an org id that does not exist) receives 403, so the response never reveals whether another tenant's org exists and never returns its data.

## Path parameters

- `org_id` string, required

## Query parameters

- `include_composition` boolean
- `include` 'sources'

## Headers

- `Accept` 'text/yaml' | 'application/yaml' | 'application/json'

## Response `200`

Protection manifest at this scope.

- object
  - `org_id` string, uuid
  - `name` string, nullable
  - `template` unknown
  - `enabled` boolean

## Other responses

- `304`: Not Modified — the client's `If-None-Match` matches the current ETag.
- `400`: Bad request
- `401`: Authentication required
- `403`: Forbidden
- `404`: Resource not found
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)