---
title: "Update a running Dojo sim session's live config (mode / security posture / judge)."
method: POST
path: "/sim/{session_id}/config"
tags: ["Dojo"]
---

# Update a running Dojo sim session's live config (mode / security posture / judge).

`POST /sim/{session_id}/config`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/sim/{session_id}/config`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-Mnemom-Api-Key`

Lets the operator change three run controls WHILE a sim is actively running (previously fixed at Begin-Sim): `mode` (auto/manual), `security_posture_in_prompt` (the A/B prompt toggle), and `reviewer_kind` (builtin_opus/human — the Judge). A partial update — every field is optional; only changed fields need be present. `security_posture_in_prompt` takes effect on the NEXT turn. Switching `reviewer_kind` re-homes the sim agent's team-scope review policy (remove from the old team, assign to the new); a real change is only available for the db-shepherd scenario and 502s if the reassignment fails (the session's reviewer_kind is left unchanged). Switching `mode` from manual to auto resumes the auto-tick loop immediately; auto to manual halts it after the in-flight turn. 404 if the session doesn't exist; 409 if it has already reached a terminal state. MNE-531 (dojo live-config).

## Path parameters

- `session_id` string, uuid, required

## Request body

- object
  - `mode` 'auto' | 'manual': Switch between Auto (server-paced) and Manual (human-attack) mode.
  - `security_posture_in_prompt` boolean: A/B toggle for whether the agent's system prompt is security-aware. Takes effect on the next turn.
  - `reviewer_kind` 'builtin_opus' | 'human': The Judge for this run's review holds. Only available for the db-shepherd scenario.

## Response `200`

Config updated; returns the resulting effective config.

- object
  - `mode` 'auto' | 'manual'
  - `security_posture_in_prompt` boolean
  - `reviewer_kind` 'builtin_opus' | 'human'

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Forbidden
- `404`: Resource not found
- `409`: Resource conflict — the request cannot proceed because of a current state conflict (e.g., resource already exists, version mismatch, in-flight idempotency key with a different body).
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.
- `502`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)