Skip to main content
PUT
Replace inference policy

Authorizations

Authorization
string
header
required

Use a JWT bearer token or a Veryfront API key in the Authorization header.

Path Parameters

project_reference
string
required

Project slug, UUID, or domain that identifies the project.

Body

application/json

Full replacement of the policy constraints. Omitted constraints are removed; fields are not merged with the existing policy. The policy can restrict sovereignty tier, precision, jurisdictions, hosts, and models; it can tighten the environment policy but cannot broaden it. Recorded standard-tier consent is preserved. The audit record identifies the caller.

min_tier
enum<string> | null

Lowest sovereignty tier this project will be served from. Null is served as "eu-resident": every project is EU-only by default. "standard" is the lowest, admits hosting outside the EU, and is refused (400) until the project has accepted standard-tier serving through the standard-tier opt-in (REST POST /projects/{project_reference}/inference-policy/standard-tier-opt-in, GraphQL optInProjectInferencePolicyStandardTier, MCP create_project_inference_policy_standard_tier_opt_in); after that it may be set like any other floor.

Available options:
qualified-sovereign,
eu-owned,
eu-resident,
standard,
null
min_quantization
enum<string> | null

Lowest model precision this project will be served at

Available options:
bf16,
fp16,
fp8,
nvfp4,
fp4,
int4,
null
allowed_jurisdictions
string[] | null

Operator jurisdiction codes for this project (ISO 3166-1 alpha-2). Null removes the constraint; an empty list permits nothing.

Maximum array length: 500
Pattern: ^[A-Z]{2}$
allowed_host_ids
string[] | null

Catalog host IDs this project permits. Null removes the constraint; an empty list permits nothing.

Maximum array length: 500
Required string length: 1 - 200
Pattern: ^[a-z0-9][a-z0-9._/-]*$
denied_host_ids
string[] | null

Catalog host IDs this project refuses. Null or an empty list adds no denials; a denial overrides an allowance.

Maximum array length: 500
Required string length: 1 - 200
Pattern: ^[a-z0-9][a-z0-9._/-]*$
allowed_models
string[] | null

Canonical model IDs this project permits, from list_models. Null removes the constraint; an empty list permits nothing.

Maximum array length: 500

Model ID returned by list_models. Known catalog aliases are normalized to canonical IDs. Policy IDs use letters, digits, dots, underscores, slashes, and hyphens; arbitrary provider model strings are not accepted.

Required string length: 1 - 200
Pattern: ^[a-z0-9][a-z0-9._/-]*$
denied_models
string[] | null

Canonical model IDs this project refuses, from list_models. Null or an empty list adds no denials; a denial overrides an allowance.

Maximum array length: 500

Model ID returned by list_models. Known catalog aliases are normalized to canonical IDs. Policy IDs use letters, digits, dots, underscores, slashes, and hyphens; arbitrary provider model strings are not accepted.

Required string length: 1 - 200
Pattern: ^[a-z0-9][a-z0-9._/-]*$

Response

The policy as it now stands

project_id
string<uuid>
required
configured
boolean
required

Whether the project states a policy. False returns the defaults the project is served under: EU-only, with an eu-resident minimum tier. A row that constrains nothing is routed exactly like no row; routing changes begin at the first non-null constraint.

enforced
boolean
required

Whether the gateway can apply this stored policy. True for every readable policy: each stated constraint, the "eu-resident" tier floor included, is enforced. False only when a stored value (a tier or precision) is one this build cannot read, because the gateway then refuses every request for the project instead of applying it.

min_tier
string | null
required

Returns the stored minimum tier: qualified-sovereign, eu-owned, eu-resident, or standard. Null means no stored floor and is served as "eu-resident": every project is EU-only by default. Unknown values from newer builds remain readable.

min_quantization
string | null
required

Returns the stored minimum precision: bf16, fp16, fp8, nvfp4, fp4, or int4. Null means no stored precision constraint. Unknown values from newer builds remain readable.

allowed_jurisdictions
string[] | null
required

Lists allowed operator jurisdictions as uppercase ISO 3166-1 alpha-2 codes. Null adds no jurisdiction constraint; an empty list permits none.

allowed_host_ids
string[] | null
required

Lists allowed catalog host IDs. Null adds no host allowlist constraint; an empty list permits none.

denied_host_ids
string[] | null
required

Lists denied catalog host IDs. Null or an empty list adds no host denials. Denials override allowances.

allowed_models
string[] | null
required

Lists canonical model IDs the project may use. Null adds no model allowlist constraint; an empty list permits none.

denied_models
string[] | null
required

Lists canonical model IDs the project may not use. Null or an empty list adds no model denials. Denials override allowances.

standard_tier_opt_in_at
string | null
required

ISO 8601 timestamp, or null when no acceptance is recorded. When standard-tier consent was recorded. Survives later changes to the minimum tier; opting in again does not change it. Cleared when the policy is removed.

standard_tier_opt_in_by
string<uuid> | null
required

Administrator who recorded standard-tier consent. Null when no actor is recorded.

standard_tier_opt_in_source
string | null
required

How the recorded acceptance was granted: "admin" when a project admin accepted it through this API, "grandfather" when the one-off migration recorded it for inference the project was already running before the default tier floor existed. Null when no acceptance is recorded. Read-only.

allow_non_eu_hosting
boolean
required

Whether this project has opted in to non-EU hosting: the standard-tier opt-in is recorded and min_tier is "standard", which drops the default "eu-resident" floor. False by default: a project is EU-only, and a min_tier of null is served as "eu-resident". True does not mean the project is served outside the EU: its other constraints (for example allowed_jurisdictions or allowed_host_ids) may still restrict serving to the EU. Read-only; derived.

created_at
string | null
required

Records policy creation in ISO 8601 format, or null when no policy row exists.

updated_at
string | null
required

Records the last policy update in ISO 8601 format, or null when no policy row exists.

updated_by
string<uuid> | null
required

Records the user ID responsible for the last policy update, or null when no actor is recorded.