> ## Documentation Index > Fetch the complete documentation index at: https://docs.prisme.ai/llms.txt > Use this file to discover all available pages before exploring further. # Set an organization's decryptable labels > `labels` null inherits the platform's list; `immutable` true locks the list for every knowledge base of the organization and needs a list (400 `VALIDATION_ERROR` otherwise). Both are replaced: an omitted `immutable` is false, so a PUT of `labels` alone unlocks. A list is refused 409 when the platform locked its own; `null` is always accepted. Platform admins and organization admins only, a storage admin is not enough. Allowing a label does not bring back a document already refused under it: reindex its knowledge base. ## OpenAPI ````yaml /api-reference/storage/swagger.yml put /v1/orgs/{orgSlug}/decryptable_labels openapi: 3.0.3 info: version: 1.0.0 title: Knowledges API description: > Public REST API for the Prisme.ai Knowledges (storage) workspace: knowledge bases, documents (uploaded files, web pages, remote files, connector documents), recurring web-crawl sources, semantic search, access control, per-knowledge-base API keys, and skills. Resource identifiers use the physical prefixes emitted by the implementation (`vs_` knowledge base, `vsf_` document, `seed_` web source, `kb-` API-key slug). This spec documents the public REST surface only. Internal helpers (private automations prefixed with `_`) and admin/GDPR lifecycle operations are not part of the public contract, except the platform health probe listed under the Admin tag. Each knowledge base also exposes a Model Context Protocol endpoint (`POST /v1/knowledge_bases/{knowledgeBaseId}/mcp`, JSON-RPC 2.0) giving agents filesystem-style read access to its content. It is listed under the MCP tag for its URL and auth only; use an MCP client rather than calling it as a REST resource. contact: name: Prisme.ai url: https://prisme.ai servers: - url: https://{host}/v2/workspaces/slug:storage/webhooks description: Prisme.ai workspace webhooks variables: host: default: api.studio.prisme.ai description: API host (override for self-hosted or sandbox) security: - BearerAuth: [] - WorkspaceApiKeyAuth: [] tags: - name: Knowledge Bases description: >- Create, list, read, update, and delete knowledge bases (vector-backed document stores). - name: Documents description: >- Ingest and manage documents (uploaded files, web pages, remote files, connector documents) and their indexing. - name: Web Sources description: >- Recurring web crawl seeds that discover and index pages into a knowledge base. - name: Search description: Semantic search over a knowledge base. - name: MCP description: >- Per-knowledge-base Model Context Protocol endpoint for deterministic, filesystem-style access to content (kb_search, kb_ls, kb_find, kb_cat, kb_grep, kb_head, kb_tail, kb_sed, kb_source_url). - name: Access description: Per-knowledge-base access bindings (user, group, org, agent principals). - name: API Keys description: Per-knowledge-base API keys for connector authentication. - name: Files description: >- Files uploaded to the storage workspace, before or after they are attached to a knowledge base. - name: Stats description: Aggregate dashboard statistics. - name: Skills description: Prompt/instruction registry entries. - name: Organizations description: Organization-level settings of the knowledge bases. - name: Admin description: >- Platform health probe called by the AI Governance Infrastructure page. Requires elevated permissions, a platform administrator session (`platformRole` `superadmin` or `root`). paths: /v1/orgs/{orgSlug}/decryptable_labels: parameters: - name: orgSlug in: path required: true schema: type: string maxLength: 128 description: >- Organization slug. An organization admin may only name the session's organization (403 `FORBIDDEN` otherwise); a platform admin may name any. put: tags: - Organizations summary: Set an organization's decryptable labels description: > `labels` null inherits the platform's list; `immutable` true locks the list for every knowledge base of the organization and needs a list (400 `VALIDATION_ERROR` otherwise). Both are replaced: an omitted `immutable` is false, so a PUT of `labels` alone unlocks. A list is refused 409 when the platform locked its own; `null` is always accepted. Platform admins and organization admins only, a storage admin is not enough. Allowing a label does not bring back a document already refused under it: reindex its knowledge base. operationId: setOrgDecryptableLabels requestBody: required: true content: application/json: schema: type: object properties: labels: $ref: '#/components/schemas/DecryptableLabelList' immutable: type: boolean default: false responses: '200': description: The organization's decryptable labels, as stored. content: application/json: schema: $ref: '#/components/schemas/OrgDecryptableLabels' '400': $ref: '#/components/responses/Error400' '401': $ref: '#/components/responses/Error401' '403': $ref: '#/components/responses/Error403' '409': $ref: '#/components/responses/DecryptableLabelsLocked' security: - BearerAuth: [] components: schemas: DecryptableLabelList: type: array nullable: true description: | Sensitivity labels that may be decrypted: label GUIDs, and `sharepoint-library` for a SharePoint library's protection without a label. Trimmed, lower-cased and de-duplicated; anything else is refused 400 `VALIDATION_ERROR` (`error.details.invalid`). `null` inherits the level above, `[]` decrypts nothing. items: type: string example: - aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee - sharepoint-library OrgDecryptableLabels: type: object properties: object: type: string enum: - decryptable_labels org_slug: type: string value: type: object nullable: true description: >- The organization's own setting; null until it sets one, as a knowledge base that inherits. properties: labels: $ref: '#/components/schemas/DecryptableLabelList' immutable: type: boolean description: >- Locks the list for every knowledge base of the organization; takes effect only with a list. effective: $ref: '#/components/schemas/DecryptableLabelList' origin: type: string enum: - platform - org - none description: >- Where `effective` comes from for a knowledge base of the organization with no list of its own. locked_by: type: string enum: - platform - org nullable: true updated_by: type: string nullable: true updated_at: type: string nullable: true Error: type: object description: | Single error envelope shared by every non-2xx response. `code` is the stable machine-readable identifier; `message` is the human-readable text; `details` is optional structured context. properties: error: type: object required: - code - message properties: code: type: string example: VALIDATION_ERROR message: type: string details: type: object additionalProperties: true required: - error responses: Error400: description: Caller validation failure. content: application/json: schema: $ref: '#/components/schemas/Error' examples: missing_source: summary: No identifiable source value: error: code: MISSING_SOURCE message: Provide native_file_id, source_url, or fetch_url. conflicting_type: summary: source_type conflicts with native_file_id value: error: code: VALIDATION_ERROR message: >- source_type must be uploaded_file when native_file_id is provided details: field: source_type Error401: description: Authentication missing or invalid. content: application/json: schema: $ref: '#/components/schemas/Error' examples: unauthenticated: value: error: code: UNAUTHENTICATED message: Authentication required. Error403: description: Authentication present, authorization denied. content: application/json: schema: $ref: '#/components/schemas/Error' examples: forbidden: value: error: code: FORBIDDEN message: Caller is not allowed to access this resource. hook_rejected: summary: An external content hook blocked ingestion (sync) value: error: code: HOOK_REJECTED message: Rejected by policy. details: document_id: vsf_0123456789abcdef blocked_by: hook_pii_filter public_rejection_reason: '' DecryptableLabelsLocked: description: | `DECRYPTABLE_LABELS_LOCKED` - a list was sent while the platform or the organization locked the decryptable labels (`error.details.locked_by`). content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: DECRYPTABLE_LABELS_LOCKED message: The decryptable labels are locked by the org details: locked_by: org securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- User session JWT or instance API key (`iak_*`). Send as `Authorization: Bearer `. WorkspaceApiKeyAuth: type: apiKey in: header name: x-prismeai-api-key description: Workspace- or knowledge-base-scoped API key. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.