---
title: "Set a firm's security tier; confidential purges its research cards (operators only)"
method: PUT
path: "/v1/admin/tenants/{tenant}/tier"
tags: ["admin"]
---

# Set a firm's security tier; confidential purges its research cards (operators only)

`PUT /v1/admin/tenants/{tenant}/tier`

## Request

- Base URL: `https://api.sixminute.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sixminute.ai/v1/admin/tenants/{tenant}/tier`
- Auth: HTTP bearer

One statement changes `policy.security_tier` and nothing else, and commits. On `confidential` it then deletes the firm's stored research cards, irreversibly. `judged_text_purged` and `past_exports` are always null: no judged text is purged (D-249) and there is no research export. A purge that fails after the tier committed answers 500 `tier-purge-incomplete`; the same call again finishes it.

## Path parameters

- `tenant` string, required

## Request body

- object
  - `tier` 'standard' | 'confidential', required

## Response `200`

The tier as it now stands, and on confidential what was purged.

- object
  - `tenant` object, required
    - `id` string, required
    - `name` string, required
  - `security_tier` 'standard' | 'confidential', required
  - `cards_deleted` integer, nullable, required
  - `judged_text_purged` integer, nullable, required
  - `past_exports` object[], nullable, required
    - `id` string, required
    - `tenant_id` string, required
    - `operator` string, required
    - `from_at` string, required
    - `to_at` string, required
    - `created_at` string, required
    - `rows` integer, required
  - `past_exports_error` string, nullable, required

## Other responses

- `400`: The body, query or path did not validate; `errors` lists the fields.
- `401`: No bearer token, or one that does not verify or has expired.
- `403`: The token verified but may not do this: no organisation, not provisioned, wrong role, or a device problem.
- `404`: No such row for this tenant.
- `500`: HTTP 500
- `503`: A capability this service was not configured with, or a practice system that could not be reached; the `type` says which.

---

[API](https://skmtc.dev/sixminute/apis/sixminute-api.md) - [All operations](https://skmtc.dev/sixminute/apis/sixminute-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sixminute/apis/sixminute-api/revisions/605577eadc10?raw)