---
title: "Set Enforcement"
method: POST
path: "/authz/enforcement/{topic}"
---

# Set Enforcement

`POST /authz/enforcement/{topic}`

## Request

- Base URL: `https://api-docs.session-exchange.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api-docs.session-exchange.com/authz/enforcement/{topic}`
- Auth: none declared

Flip a topic's emit-enforcement mode (admin-only). ``enforced`` makes a
would-deny emit on that topic actually 403 (forbidden_emit); ``shadow``
rolls it back to record-only. Idempotent last-write-wins.

Break-glass #5 pre-flight: refuse to flip a topic to ``enforced`` if there
is NO working admin path (would risk locking authz changes out). Flipping
BACK to ``shadow`` is always allowed — it can only ever relax enforcement,
so it must never be blocked (it's the rollback lever).

## Path parameters

- `topic` string, required

## Request body

- AuthzEnforcementRequest
  - `mode` 'shadow' | 'enforced', required

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/session-exchange/apis/a4sx.md) · [All operations](https://skmtc.dev/session-exchange/apis/a4sx/llms.txt) · [OpenAPI document](https://skmtc.dev/session-exchange/apis/a4sx/revisions/abaefc33dfc7?raw)