---
title: "Set the site notice"
method: PUT
path: "/banner"
tags: ["banner"]
---

# Set the site notice

`PUT /banner`

## Request

- Base URL: `/api` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/banner`
- Auth: API key in header `X-API-KEY`

Only available to administrators.

Guarded by ``admin:access`` rather than a notice-specific permission, and
that is deliberate. A new permission is created by the RBAC seed but not
added to any existing role -- roles keep their configured permission sets
unless the seed is run with ``reset``, which would discard an instance's
customisations. The endpoint would then be callable by nobody on precisely
the instances that have been running longest, and would be found out during
the incident someone was trying to announce.

## Headers

- `X-Fields` string, mask

## Request body

- object
  - `enabled` boolean, required: Whether a maintenance notice should be displayed.
  - `message` string: The notice to display (at most 2000 characters). Stored and returned verbatim; this instance's own pages render a small Markdown subset of it -- emphasis, code, lists and links -- and strip everything else.

## Response `200`

Success.

- Banner
  - `enabled` boolean: Whether a maintenance notice should be displayed.
  - `message` string: The notice to display, as the administrator wrote it. May contain Markdown emphasis and links; it is never HTML.

## Other responses

- `400`: Invalid banner.
- `401`: Authentication required.
- `403`: Admin permission required.

## Changes

- **2026-09-11** `81405840063e`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/changes/banner/put.md)

---

[API](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api.md) - [All operations](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vulnerability-lookup/apis/vulnerability-lookup-api/revisions/b4dedf027493?raw)