---
title: "Set the delegated verification-enforcement policy (master/solo)"
method: PUT
path: "/api/v1/governance/enforcement"
tags: ["Governance"]
---

# Set the delegated verification-enforcement policy (master/solo)

`PUT /api/v1/governance/enforcement`

## Request

- Base URL: `https://legal.nexusquantum.legal`
- URL: `https://legal.nexusquantum.legal/api/v1/governance/enforcement`
- Auth: HTTP bearer

Enable/disable delegated enforcement for a tenant/sub-key. **master/solo only** — a `child` key can never enable itself → `403 FORBIDDEN_CHILD_KEY` (the delegation is exercised by the platform operator).

Body `{ enabled, mode?, target? }`. Without `target`: a master defaults to `scope=organization`, a solo to `scope=user`. `scope=api_key` requires `target.api_key_id` belonging to the caller's organization (else `404` anti-enumeration). Each change bumps `version` and is written to the firm audit log.

When active, a blocked output returns `422 OUTPUT_WITHHELD_BY_POLICY` (type `policy_error`) with **no charge** (no debit, or refund), the failed citations, and a signed attestation.

## Request body

- object
  - `enabled` boolean, required: Turn enforcement on/off for the target.
  - `mode` 'block_any_broken': Only mode: block outputs with any real broken citation.
  - `target` object
    - `scope` 'organization' | 'user' | 'api_key': Delegation axis. Default: organization (master) / user (solo).
    - `api_key_id` string, uuid: Required for scope=api_key; must belong to the caller's organization.

## Response `200`

The saved policy.

- object
  - `policy` EnforcementPolicy: A delegated verification-enforcement policy row (Governance Phase 3). OFF by default; the most specific scope wins.
    - `id` string, uuid
    - `scope` 'api_key' | 'organization' | 'user': Delegation axis this row keys on.
    - `api_key_id` string, uuid, nullable: Set when scope=api_key.
    - `organization_id` string, uuid, nullable: Set when scope=organization.
    - `enabled` boolean: Whether enforcement is active for this axis.
    - `mode` 'block_any_broken'
    - `version` integer: Bumps on every change (audit trail).
    - `updated_at` string, date-time
  - `requestId` string

## Other responses

- `400`: VALIDATION_ERROR — invalid `enabled`/`mode`/`target`.
- `401`: INVALID_API_KEY.
- `403`: FORBIDDEN_CHILD_KEY — a child key cannot set enforcement.
- `404`: NOT_FOUND — target.api_key_id outside the caller's organization (anti-enumeration).
- `409`: SCOPE_CONFLICT / NO_ORGANIZATION — scope incompatible with the caller's identity.
- `429`: RATE_LIMITED.

---

[API](https://skmtc.dev/nexusquantum/apis/nexus-legal-api.md) · [All operations](https://skmtc.dev/nexusquantum/apis/nexus-legal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nexusquantum/apis/nexus-legal-api/revisions/4084d8d4eb0b?raw)