Replace policies for one capability

PUT 
/v1/admin/clients/:slug/policies/:capabilityKey

Declarative replacement of the entire policy set for (client, capability). The body is the complete desired set; anything not in the body is closed.

Closes every open row for the pair and inserts the new set inside one atomic transaction — the platform never observes an empty target list during the swap.

Validates Gate-2 fact coverage: every admissible (factKey, value) declared by the capability catalog must be reachable either via an entry that pins that value or via the default entry (zero facts). Failure rejects the upload with CRT022001 and the uncovered (factKey, value) enumerated.

Request

Responses

200

Policies replaced successfully

400

Schema validation failed (GEN000000) or unknown capability key (CRT000002)

401

Missing or invalid authentication token (GEN001002) or Role unauthorized (GEN001006)

404

Slug does not resolve to a known client (CRT004004).

422

Gate-2 validation failure — duplicate fact-set, inadmissible value, or uncovered admissible value.

500

Internal server error (GEN100000)

503

Connector-routing datastore temporarily unavailable (CRT103002)