Save the workspace's engine rules
Replaces the whole rule set in one transaction. expected_revision is settings_revision as read (null when nothing was saved); another value answers 409 REVISION_CONFLICT. The rules are checked against every installed tool catalog before anything is locked: a rule the engine would drop without a word is 400 with the parser's reason_code (unknown_tool, too_many_rules, settings_too_large, mcp_rule_verdict, ...), and engine_settings_catalog_ambiguous when two catalogs would store a rule differently. While the installation's gate is shut the answer is 403 engine_settings_writes_closed; rules already saved keep applying. Restrictions (deny, ask, soft_deny, hard_deny) add to every agent's own; grants (allow, environment) reach an agent only where the agent's own list holds the same entry. Writes a set_workspace_engine_settings receipt with the rule counts and sizes before and after, never a rule's text; receipt_id is null when the workspace already held these rules. Workspace owners and admins with a web session only; API keys are refused.
Auth: cookie session only; no scope. Idempotency-Key: ignored.
cookieSession__Host-werft_session<token>For the web console: the browser session cookie set by POST /v1/auth/login. It holds the scopes of the user's workspace role (owner: all; admin and member: all but sessions:recover). Requests other than GET must also send X-Requested-With: werft-web.
id*stringThe workspace's id.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidX-Requested-With?"werft-web"Required with a cookie session: the literal werft-web.
"werft-web"application/json- body
expected_revision*|nullsettings*Saved.
application/json- response
settings_revision*integer0 < value <= 9007199254740991receipt_id*|nullcurl -X PUT 'https://example.com/v1/workspaces/497f6eca-6276-4993-bfeb-53cbbbba6f08/engine-settings' \ -H 'Content-Type: application/json' \ -d '{ "expected_revision": 2, "settings": { "permissions": { "deny": [ "Bash(rm:*)" ] }, "auto_mode": {} }}'{ "settings_revision": 3, "receipt_id": "c4a1e9d2-7b3f-4e8a-a6c5-1d2e3f4a5b6c"}