Write updates one policy scope and returns the policy in force after the write.

PUT /v1/gateway/config

Gateway → · All API references → · Six flows, four surfaces →


Address	`https://api.hanzo.ai/v1/gateway/config`
Method	`PUT`
Operation	`put_gateway_config`
Auth	`Authorization: Bearer $HANZO_API_KEY`

Write updates one policy scope and returns the policy in force after the write. A body carrying any PLATFORM field (cors_origins, per_ip_rpm, window_sec) is a platform write and requires SuperAdmin; otherwise it is a per-org write (org_rpm, cache_ttl_sec, cache_paths, methods) scoped to the caller's own org — or, for a SuperAdmin, the tenant named by ?org=<slug>. A body that sets nothing is a 400. The abuse gate's mode is an OPERATOR field: setting it requires SuperAdmin, whichever organization it lands on. updated_at and updated_by are server-stamped; a client-supplied value is ignored.

Request

11 fields, body application/json (required).

Field	In	Type	Required	Description
`cache_paths`	body	object	—	CachePaths overrides CacheTTLSec per path PREFIX (key "/v1/models" → seconds).
`cache_paths.*`	body	integer	—
`cache_ttl_sec`	body	integer	—	CacheTTLSec is the org's default edge-cache TTL for its responses, in seconds; 0 means no caching.
`cors_origins`	body	string[]	—	CORSOrigins is the PLATFORM-scope CORS allowlist EdgeCORS admits: an exact origin, a bare host, or a "*.host" wildcard.
`methods`	body	string[]	—	Methods is the allowlist of HTTP methods the edge accepts for this org.
`mode`	body	string	—	Mode is the abuse gate's posture for THIS scope: "shadow" scores traffic and records the verdict without acting on it, "live" enforces it. Unset means shadow.
`org_rpm`	body	integer	—	OrgRPM is the org's OWN authenticated rate ceiling, requests per minute, as ScopeRateLimit enforces it.
`per_ip_rpm`	body	integer	—	PerIPRPM is the PLATFORM-scope pre-auth flood cap: requests EdgeRateLimit admits per WindowSec from one client IP.
`updated_at`	body	integer	—	UpdatedAt is the unix second this policy row was last written.
`updated_by`	body	string	—	UpdatedBy is the validated user id that wrote this policy row.
`window_sec`	body	integer	—	WindowSec is the window PerIPRPM is counted over, in seconds.

Response

Status	Body	Meaning
`200`	Policy	ok

200 body — 11 fields.

Field	In	Type	Always	Description
`cache_paths`	body	object	—	CachePaths overrides CacheTTLSec per path PREFIX (key "/v1/models" → seconds).
`cache_paths.*`	body	integer	—
`cache_ttl_sec`	body	integer	—	CacheTTLSec is the org's default edge-cache TTL for its responses, in seconds; 0 means no caching.
`cors_origins`	body	string[]	—	CORSOrigins is the PLATFORM-scope CORS allowlist EdgeCORS admits: an exact origin, a bare host, or a "*.host" wildcard.
`methods`	body	string[]	—	Methods is the allowlist of HTTP methods the edge accepts for this org.
`mode`	body	string	—	Mode is the abuse gate's posture for THIS scope: "shadow" scores traffic and records the verdict without acting on it, "live" enforces it. Unset means shadow.
`org_rpm`	body	integer	—	OrgRPM is the org's OWN authenticated rate ceiling, requests per minute, as ScopeRateLimit enforces it.
`per_ip_rpm`	body	integer	—	PerIPRPM is the PLATFORM-scope pre-auth flood cap: requests EdgeRateLimit admits per WindowSec from one client IP.
`updated_at`	body	integer	—	UpdatedAt is the unix second this policy row was last written.
`updated_by`	body	string	—	UpdatedBy is the validated user id that wrote this policy row.
`window_sec`	body	integer	—	WindowSec is the window PerIPRPM is counted over, in seconds.

Failure carries the platform error shape — see Errors.

Examples

hanzo gateway config replace

import { Configuration, GatewayApi } from 'hanzoai';

const api = new GatewayApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.putGatewayConfig({ cache_paths: {}, cache_ttl_sec: 0 });

from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import GatewayApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = GatewayApi(client).put_gateway_config(cache_paths={}, cache_ttl_sec=0)

cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)

resp, _, err := client.GatewayAPI.PutGatewayConfig(context.Background()).Execute()
if err != nil {
	return err
}

use hanzo_cloud::apis::{configuration::Configuration, gateway_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = gateway_api::put_gateway_config(&cfg, Default::default()).await?;

import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.GatewayApi;

ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));

var result = new GatewayApi(client).putGatewayConfig();

curl -X PUT https://api.hanzo.ai/v1/gateway/config \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "cache_paths": {},
       "cache_ttl_sec": 0
     }'

The door reaches gateway through the gateway tool, which names its 3 operations with its own verbs — this one among them, under a name only the door declares. describe explains any of them:

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "get_gateway_config"
         }
       }
     }'

Gateway API · All Hanzo APIs · Interactive reference

Write updates one policy scope and returns the policy in force after the write.

Request

Response

Examples

On this page