Update workspace CertOps pause or Job approval settings

PUT 
/api/v1/workspaces/:id/certops/settings

Changes the workspace-local kill switch and/or the Job approval policy (certOpsRequireApprovalAlways) and remains available while the deployment-wide rollout flag is disabled. Requires a human cookie/session-authenticated workspace admin; internal worker bearer credentials are not accepted. At least one of certOpsPaused or certOpsRequireApprovalAlways is required. Setting both in one request applies them as a single transaction. A paused workspace rejects new manual jobs and future dispatch or provision side effects with 409 CERTOPS_WORKSPACE_PAUSED; inventory, status, audit, evidence, and existing-work reporting remain available. While Job approval is on, every new job starts pending_approval, including trust-anchor distribute or revoke.

Request

Responses

200

Stored workspace CertOps pause and Job approval state

400

Pause state, Job approval policy, or reason is invalid

401

Unauthorized

403

A human session user with the workspace admin role is required; internal worker bearer credentials are not accepted

404

Not found

422

Request rejected because it contained private key material

500

Internal server error