vault

Set the project's vault policy (owner + step-up)

Owner + step-up (gitvault.policy.manage). The ONLY path to grandfathered — the state in which deploys activate WITHOUT a vaulted capture. Audited, and it leaves a persistent warning on the vault record (and in run402 doctor) until the policy is set back to required. Idempotent: setting the policy it already has returns changed: false and writes no audit row. This is also the documented second exit from 409 VAULT_CLIENT_UPGRADE_REQUIRED — the refusal a pre-vault client meets on POST /apply/v1/plans/{plan_id}/commit against a required project carries a grandfather_policy next_action pointing here (requires_approval: true).

patch/vaults/v1/{vault_id}/policy

Request

  • Base URL: https://api.run402.com
  • URL: https://api.run402.com/vaults/v1/{vault_id}/policy
  • Auth: one of:
    • API key in header SIGN-IN-WITH-X
    • HTTP bearer

Path parameters

vault_idstring required

The vault id (src_<32 hex>); the wire field is repo_id (protocol D185).

Headers

SIGN-IN-WITH-Xstring required

SIWX auth header — base64-encoded JSON payload containing a signed CAIP-122 (EIP-4361) message. See https://docs.x402.org/extensions/sign-in-with-x.

Request body

vault_policy'required' | 'grandfathered' required
reasonstring

Response

Policy state after the call

repo_idstring
project_idstring
vault_policy'required' | 'grandfathered'
vault_policy_versionstring
vault_policy_changed_atstring date-time nullable
changedboolean
warningsobject[]

Changes

No recorded changes to this operation across all 1 revision of this API.