Set an organization's decryptable labels

curl --request PUT \
  --url https://{host}/v2/workspaces/slug:storage/webhooks/v1/orgs/{orgSlug}/decryptable_labels \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "labels": [
    "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
    "sharepoint-library"
  ],
  "immutable": false
}
'

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    labels: ['aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee', 'sharepoint-library'],
    immutable: false
  })
};

fetch('https://{host}/v2/workspaces/slug:storage/webhooks/v1/orgs/{orgSlug}/decryptable_labels', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://{host}/v2/workspaces/slug:storage/webhooks/v1/orgs/{orgSlug}/decryptable_labels"

payload = {
    "labels": ["aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "sharepoint-library"],
    "immutable": False
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

{
  "object": "decryptable_labels",
  "org_slug": "<string>",
  "value": {
    "labels": [
      "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
      "sharepoint-library"
    ],
    "immutable": true
  },
  "effective": [
    "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
    "sharepoint-library"
  ],
  "origin": "platform",
  "locked_by": "platform",
  "updated_by": "<string>",
  "updated_at": "<string>"
}

Organizations

Set an organization's decryptable labels

labels null inherits the platform’s list; immutable true locks the list for every knowledge base of the organization and needs a list (400 VALIDATION_ERROR otherwise). Both are replaced: an omitted immutable is false, so a PUT of labels alone unlocks. A list is refused 409 when the platform locked its own; null is always accepted. Platform admins and organization admins only, a storage admin is not enough. Allowing a label does not bring back a document already refused under it: reindex its knowledge base.

PUT

/

v1

/

orgs

/

{orgSlug}

/

decryptable_labels

Set an organization's decryptable labels

curl --request PUT \
  --url https://{host}/v2/workspaces/slug:storage/webhooks/v1/orgs/{orgSlug}/decryptable_labels \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "labels": [
    "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
    "sharepoint-library"
  ],
  "immutable": false
}
'

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    labels: ['aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee', 'sharepoint-library'],
    immutable: false
  })
};

fetch('https://{host}/v2/workspaces/slug:storage/webhooks/v1/orgs/{orgSlug}/decryptable_labels', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://{host}/v2/workspaces/slug:storage/webhooks/v1/orgs/{orgSlug}/decryptable_labels"

payload = {
    "labels": ["aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "sharepoint-library"],
    "immutable": False
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

{
  "object": "decryptable_labels",
  "org_slug": "<string>",
  "value": {
    "labels": [
      "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
      "sharepoint-library"
    ],
    "immutable": true
  },
  "effective": [
    "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
    "sharepoint-library"
  ],
  "origin": "platform",
  "locked_by": "platform",
  "updated_by": "<string>",
  "updated_at": "<string>"
}

Authorizations

Authorization

string

header

required

User session JWT or instance API key (iak_*). Send as Authorization: Bearer <token>.

Path Parameters

orgSlug

string

required

Organization slug. An organization admin may only name the session's organization (403 FORBIDDEN otherwise); a platform admin may name any.

Maximum string length: 128

Body

application/json

labels

string[] | null

Sensitivity labels that may be decrypted: label GUIDs, and sharepoint-library for a SharePoint library's protection without a label. Trimmed, lower-cased and de-duplicated; anything else is refused 400 VALIDATION_ERROR (error.details.invalid). null inherits the level above, [] decrypts nothing.

Example:

[
  "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
  "sharepoint-library"
]

immutable

boolean

default:false

Response

The organization's decryptable labels, as stored.

object

enum<string>

Available options:

decryptable_labels

org_slug

string

value

object | null

The organization's own setting; null until it sets one, as a knowledge base that inherits.

Hide child attributes

value.labels

string[] | null

Sensitivity labels that may be decrypted: label GUIDs, and sharepoint-library for a SharePoint library's protection without a label. Trimmed, lower-cased and de-duplicated; anything else is refused 400 VALIDATION_ERROR (error.details.invalid). null inherits the level above, [] decrypts nothing.

Example:

[
  "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
  "sharepoint-library"
]

value.immutable

boolean

Locks the list for every knowledge base of the organization; takes effect only with a list.

effective

string[] | null

Sensitivity labels that may be decrypted: label GUIDs, and sharepoint-library for a SharePoint library's protection without a label. Trimmed, lower-cased and de-duplicated; anything else is refused 400 VALIDATION_ERROR (error.details.invalid). null inherits the level above, [] decrypts nothing.

Example:

[
  "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
  "sharepoint-library"
]

origin

enum<string>

Where effective comes from for a knowledge base of the organization with no list of its own.

Available options:

platform,

org,

none

locked_by

enum<string> | null

Available options:

platform,

org

updated_by

string | null

updated_at

string | null