fix: enforce settings authority boundaries (#618)

Close generic settings authorization bypasses and enforce per-setting authority, validation, redaction, transactional config import, and route-local write rate limiting.

apps/api/src/lib/settings-policy.ts

@@ -0,0 +1,293 @@
+import { type Permission, SUPPORTED_LOCALES } from "@snapotter/shared";
+import { type ZodIssue, z } from "zod";
+import { env } from "../config.js";
+
+export type SettingAuthority = Permission | "full-admin" | "none";
+
+export interface SettingPolicy {
+  read: SettingAuthority;
+  write: SettingAuthority;
+  encrypted?: boolean;
+  redacted?: boolean;
+  schema?: z.ZodType<string, z.ZodTypeDef, unknown>;
+  storageKey?: string;
+}
+
+const booleanSetting = z
+  .union([z.boolean(), z.enum(["true", "false"])])
+  .transform((value) => String(value));
+
+function integerSetting(
+  minimum: number,
+  maximum = Number.MAX_SAFE_INTEGER,
+): z.ZodType<string, z.ZodTypeDef, unknown> {
+  return z
+    .union([z.number(), z.string()])
+    .transform((value) => (typeof value === "number" ? value : Number(value)))
+    .refine(Number.isSafeInteger, "Must be an integer")
+    .refine((value) => value >= minimum, `Must be at least ${minimum}`)
+    .refine((value) => value <= maximum, `Must be at most ${maximum}`)
+    .transform(String);
+}
+
+function finiteNumberSetting(minimumExclusive: number): z.ZodType<string, z.ZodTypeDef, unknown> {
+  return z
+    .union([z.number(), z.string()])
+    .transform((value) => (typeof value === "number" ? value : Number(value)))
+    .refine(Number.isFinite, "Must be a finite number")
+    .refine((value) => value > minimumExclusive, `Must be greater than ${minimumExclusive}`)
+    .transform(String);
+}
+
+const timestampSetting = z
+  .string()
+  .max(100)
+  .refine((value) => Number.isFinite(Date.parse(value)), "Must be an ISO-8601 timestamp")
+  .transform((value) => new Date(value).toISOString());
+
+const disabledToolsSetting = z
+  .preprocess(
+    (value) => {
+      if (typeof value !== "string") return value;
+      try {
+        return JSON.parse(value);
+      } catch {
+        return value;
+      }
+    },
+    z.array(z.string().min(1).max(200)).max(5000),
+  )
+  .transform((value) => JSON.stringify(value));
+
+const localeCodes = new Set(SUPPORTED_LOCALES.map((locale) => locale.code));
+const localeSetting = z
+  .string()
+  .refine((value) => localeCodes.has(value), "Must be a supported locale");
+
+const breakGlassUsernameSetting = z
+  .string()
+  .max(50)
+  .refine(
+    (value) => value === "" || /^[A-Za-z0-9_.-]{3,50}$/.test(value),
+    "Must be empty or a valid username",
+  );
+
+const boundedSecretSetting = z.string().max(65_536);
+
+const general = (schema: z.ZodType<string, z.ZodTypeDef, unknown>): SettingPolicy => ({
+  read: "settings:read",
+  write: "settings:write",
+  schema,
+});
+
+const security = (
+  schema: z.ZodType<string, z.ZodTypeDef, unknown>,
+  storageKey?: string,
+): SettingPolicy => ({
+  read: "security:manage",
+  write: "security:manage",
+  schema,
+  ...(storageKey ? { storageKey } : {}),
+});
+
+const compliance = (schema: z.ZodType<string, z.ZodTypeDef, unknown>): SettingPolicy => ({
+  read: "compliance:manage",
+  write: "compliance:manage",
+  schema,
+});
+
+const fullAdminSecret = (schema: z.ZodType<string, z.ZodTypeDef, unknown>): SettingPolicy => ({
+  encrypted: true,
+  read: "full-admin",
+  redacted: true,
+  write: "full-admin",
+  schema,
+});
+
+const readonly = (options: Pick<SettingPolicy, "encrypted" | "redacted"> = {}): SettingPolicy => ({
+  read: "full-admin",
+  write: "none",
+  ...options,
+});
+
+/**
+ * Closed registry for every first-party key accepted by the generic settings API.
+ * Security-sensitive keys must be added here deliberately so a new runtime
+ * consumer cannot silently inherit the coarse settings:write permission.
+ */
+const SETTING_POLICIES: Readonly<Record<string, SettingPolicy>> = {
+  defaultTheme: general(z.enum(["light", "dark", "system"])),
+  defaultLocale: general(localeSetting),
+  defaultToolView: general(z.enum(["sidebar", "fullscreen"])),
+  fileUploadLimitMb: general(finiteNumberSetting(0)),
+  tempFileMaxAgeHours: general(finiteNumberSetting(0)),
+  startupCleanup: general(booleanSetting),
+  analyticsEnabled: general(booleanSetting),
+  jobsRetentionDays: general(integerSetting(0)),
+  disabledTools: general(disabledToolsSetting),
+  enableExperimentalTools: general(booleanSetting),
+  rateLimitPerUser: general(integerSetting(0)),
+  maxConcurrentJobsPerUser: general(integerSetting(0)),
+  "feedback.install.submittedAt": general(timestampSetting),
+  "feedback.install.snoozedUntil": general(timestampSetting),
+  "feedback.install.dismissedAt": general(timestampSetting),
+  "onboarding.usageSurvey.answeredAt": general(timestampSetting),
+  "onboarding.usageSurvey.dismissedAt": general(timestampSetting),
+  "sqlite_import.dismissedAt": general(timestampSetting),
+
+  loginAttemptLimit: security(integerSetting(1)),
+  sessionIdleTimeoutMinutes: security(integerSetting(0)),
+  maxSessionsPerUser: security(integerSetting(0)),
+  mfaPolicy: security(z.enum(["optional", "admins_only", "required"])),
+  ssoEnforcement: security(booleanSetting),
+  ssoBreakGlassUsername: security(breakGlassUsernameSetting),
+  passwordMinLength: security(integerSetting(8, 128)),
+  passwordRequireUppercase: security(booleanSetting),
+  passwordRequireLowercase: security(booleanSetting),
+  passwordRequireDigit: security(booleanSetting),
+  passwordRequireNumber: security(booleanSetting, "passwordRequireDigit"),
+  passwordRequireSpecial: security(booleanSetting),
+
+  auditRetentionDays: compliance(integerSetting(0)),
+  auditArchiveMonths: compliance(integerSetting(0)),
+  auditToolOperations: compliance(booleanSetting),
+  tamperResistantAudit: compliance(booleanSetting),
+
+  oidc_client_secret: fullAdminSecret(boundedSecretSetting),
+  saml_idp_certificate: fullAdminSecret(boundedSecretSetting),
+  siem_webhook_auth: fullAdminSecret(boundedSecretSetting),
+
+  cookie_secret: readonly({ encrypted: true, redacted: true }),
+  instance_id: readonly(),
+  sqlite_import: readonly(),
+  "onboarding.firstProcessedAt": readonly(),
+  scim_token_hash: readonly({ encrypted: true, redacted: true }),
+  siem_config: readonly({ redacted: true }),
+  webhook_destinations: readonly({ redacted: true }),
+  ipAllowlist: readonly(),
+  backup_last_completed: readonly(),
+  audit_archival_state: readonly(),
+  siem_last_forwarded_at: readonly(),
+  siem_consecutive_failures: readonly(),
+};
+
+export function getSettingPolicy(key: string): SettingPolicy | undefined {
+  return SETTING_POLICIES[key];
+}
+
+export function isConfigExportableSetting(key: string): boolean {
+  const policy = getSettingPolicy(key);
+  return Boolean(
+    policy &&
+      policy.write !== "none" &&
+      !policy.redacted &&
+      (!policy.storageKey || policy.storageKey === key),
+  );
+}
+
+export type SettingsRuntimeValidation =
+  | { success: true }
+  | {
+      success: false;
+      statusCode: 400 | 403;
+      code: "DEPENDENCY_VALIDATION_FAILED" | "FEATURE_NOT_LICENSED";
+      error: string;
+      validationErrors?: string[];
+    };
+
+/** Validate constraints that depend on runtime state rather than value shape. */
+export async function validateSettingsRuntimeConstraints(
+  settings: ReadonlyArray<{ key: string; value: string }>,
+): Promise<SettingsRuntimeValidation> {
+  const enforcesMfa = settings.some(
+    ({ key, value }) => key === "mfaPolicy" && (value === "admins_only" || value === "required"),
+  );
+  if (enforcesMfa) {
+    let mfaLicensed = false;
+    try {
+      const { isFeatureEnabled } = await import("@snapotter/enterprise");
+      mfaLicensed = isFeatureEnabled("mfa");
+    } catch {
+      // Enterprise package not available.
+    }
+
+    if (!mfaLicensed) {
+      return {
+        success: false,
+        statusCode: 403,
+        error: "MFA requires an enterprise license",
+        code: "FEATURE_NOT_LICENSED",
+      };
+    }
+  }
+
+  const enforcesSso = settings.some(
+    ({ key, value }) => key === "ssoEnforcement" && value === "true",
+  );
+  if (enforcesSso && !env.OIDC_ENABLED && !env.SAML_ENABLED) {
+    const validationErrors = [
+      "ssoEnforcement is enabled but no OIDC or SAML provider is configured",
+    ];
+    return {
+      success: false,
+      statusCode: 400,
+      error: "Dependency validation failed",
+      code: "DEPENDENCY_VALIDATION_FAILED",
+      validationErrors,
+    };
+  }
+
+  return { success: true };
+}
+
+export type PreparedSetting =
+  | {
+      success: true;
+      key: string;
+      value: string;
+      policy: SettingPolicy;
+    }
+  | {
+      success: false;
+      code: "UNKNOWN_SETTING" | "VALIDATION_ERROR";
+      error: string;
+      details?: ZodIssue[];
+    };
+
+export function prepareSetting(key: string, value: unknown): PreparedSetting {
+  const policy = getSettingPolicy(key);
+  if (!policy) {
+    return {
+      success: false,
+      code: "UNKNOWN_SETTING",
+      error: `Unknown setting "${key}"`,
+    };
+  }
+
+  if (!policy.schema) {
+    const serialized = typeof value === "string" ? value : JSON.stringify(value);
+    return {
+      success: true,
+      key: policy.storageKey ?? key,
+      value: serialized ?? "",
+      policy,
+    };
+  }
+
+  const parsed = policy.schema.safeParse(value);
+  if (!parsed.success) {
+    return {
+      success: false,
+      code: "VALIDATION_ERROR",
+      error: `Invalid value for setting "${key}"`,
+      details: parsed.error.issues,
+    };
+  }
+
+  return {
+    success: true,
+    key: policy.storageKey ?? key,
+    value: parsed.data,
+    policy,
+  };
+}

apps/api/src/openapi.ar.yaml

@@ -6194,7 +6194,7 @@ paths:
       tags:
         - Settings
       summary: الحصول على جميع الإعدادات
-      description: استرداد جميع إعدادات النظام كأزواج مفتاح-قيمة. يتطلب المصادقة.
+      description: استرداد إعدادات النظام التي تسمح بها الصلاحيات الفعلية للمتصل. يتطلب `settings:read`؛ وتُرشَّح إعدادات الأمان والامتثال والمسؤول الكامل كلٌّ على حدة.
       security:
         - bearerAuth: []
       responses:
@@ -6220,7 +6220,7 @@ paths:
       tags:
         - Settings
       summary: تحديث الإعدادات
-      description: يقبل كائن JSON مسطّح من أزواج مفتاح-قيمة لضبطها. يتطلب دور المسؤول.
+      description: يقبل كائن JSON مسطّحًا يحتوي على مفاتيح إعدادات معروفة وقابلة للكتابة. يتطلب `settings:write`؛ وتتطلب مفاتيح الأمان والامتثال أيضًا الصلاحية الفعلية المطابقة، وتتطلب الإعدادات السرية صلاحية مسؤول كاملة، أما المفاتيح المخصصة أو التي يديرها الخادم فهي للقراءة فقط.
       security:
         - bearerAuth: []
       requestBody:
@@ -6267,7 +6267,7 @@ paths:
       tags:
         - Settings
       summary: الحصول على إعداد واحد
-      description: استرداد قيمة إعداد واحد بواسطة اسم مفتاحه. يُرجع القيمة والطابع الزمني لآخر تحديث.
+      description: استرداد إعداد معروف حسب المفتاح. يُرجع القيمة والطابع الزمني لآخر تحديث عندما يمتلك المتصل كلًا من `settings:read` والصلاحية الإضافية للمفتاح.
       security:
         - bearerAuth: []
       parameters:
@@ -18397,7 +18397,8 @@ paths:
       tags:
         - Enterprise
       summary: تصدير الإعدادات
-      description: تصدير إعدادات المثيل المنقّحة والأدوار المخصصة والفرق. يتطلب إذن system:health.
+      description: |
+        تصدير إعدادات المثيل المنقّحة والأدوار المخصصة والفرق. يتطلب صلاحيات فعّالة وكاملة لمسؤول مضمّن؛ لا تتأهل الأدوار المخصصة، ولا مفاتيح API التي ينقصها أي إذن من أذونات المسؤول.
       security:
         - bearerAuth: []
       responses:
@@ -18412,7 +18413,7 @@ paths:
         - Enterprise
       summary: استيراد الإعدادات
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        استيراد إعدادات المثيل والأدوار المخصصة والفرق. يتطلب صلاحيات فعّالة وكاملة لمسؤول مضمّن؛ لا تتأهل الأدوار المخصصة، ولا مفاتيح API التي ينقصها أي إذن من أذونات المسؤول.
       security:
         - bearerAuth: []
       responses:
@@ -19664,25 +19665,25 @@ x-i18n:
       provenance: machine
       outputHash: 1262280f9c6e
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: e1ec683f5e5c
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 4cfe8f3730f8
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 0023629c3617
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: c77d7bec978d
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: b76279ea2d3f
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 5fcf8f2d6008
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 11dbe8b156b5
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 095b505c1779
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21632,13 +21633,17 @@ x-i18n:
       provenance: machine
       outputHash: 9f53f3a2841a
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: cacf92da7e22
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: b83bec75dec4
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: cb053b845a9d
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: c660c73729fb
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.de.yaml

@@ -6191,7 +6191,7 @@ paths:
       tags:
         - Settings
       summary: Alle Einstellungen abrufen
-      description: Alle Systemeinstellungen als Schlüssel-Wert-Paare abrufen. Erfordert Authentifizierung.
+      description: Ruft die Systemeinstellungen ab, zu denen die effektiven Berechtigungen des Aufrufers berechtigen. Erfordert `settings:read`; Sicherheits-, Compliance- und vollständige Administratoreinstellungen werden jeweils separat gefiltert.
       security:
         - bearerAuth: []
       responses:
@@ -6217,7 +6217,7 @@ paths:
       tags:
         - Settings
       summary: Einstellungen aktualisieren
-      description: Akzeptiert ein flaches JSON-Objekt aus Schlüssel-Wert-Paaren zum Setzen. Erfordert die Admin-Rolle.
+      description: Akzeptiert ein flaches JSON-Objekt mit erkannten, beschreibbaren Einstellungsschlüsseln. Erfordert `settings:write`; Sicherheits- und Compliance-Schlüssel erfordern zusätzlich die jeweils passende effektive Berechtigung, Geheimnisse erfordern die vollständige Administratorberechtigung und dedizierte oder serververwaltete Schlüssel sind schreibgeschützt.
       security:
         - bearerAuth: []
       requestBody:
@@ -6264,7 +6264,7 @@ paths:
       tags:
         - Settings
       summary: Eine einzelne Einstellung abrufen
-      description: Einen einzelnen Einstellungswert anhand seines Schlüsselnamens abrufen. Gibt den Wert und den Zeitstempel der letzten Aktualisierung zurück.
+      description: Ruft eine erkannte Einstellung anhand ihres Schlüssels ab. Gibt den Wert und den Zeitstempel der letzten Aktualisierung zurück, wenn der Aufrufer sowohl `settings:read` als auch die zusätzliche Berechtigung des Schlüssels besitzt.
       security:
         - bearerAuth: []
       parameters:
@@ -18394,7 +18394,8 @@ paths:
       tags:
         - Enterprise
       summary: Konfiguration exportieren
-      description: Geschwärzte Instanzkonfiguration, benutzerdefinierte Rollen und Teams exportieren. Erfordert die Berechtigung system:health.
+      description: |
+        Geschwärzte Instanzkonfiguration, benutzerdefinierte Rollen und Teams exportieren. Erfordert die vollständige effektive Berechtigung eines integrierten Administrators; benutzerdefinierte Rollen sind nicht zulässig, ebenso wenig API-Schlüssel, denen auch nur eine Administratorberechtigung fehlt.
       security:
         - bearerAuth: []
       responses:
@@ -18409,7 +18410,7 @@ paths:
         - Enterprise
       summary: Konfiguration importieren
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Instanzkonfiguration, benutzerdefinierte Rollen und Teams importieren. Erfordert die vollständige effektive Berechtigung eines integrierten Administrators; benutzerdefinierte Rollen sind nicht zulässig, ebenso wenig API-Schlüssel, denen auch nur eine Administratorberechtigung fehlt.
       security:
         - bearerAuth: []
       responses:
@@ -19661,25 +19662,25 @@ x-i18n:
       provenance: machine
       outputHash: e8795091074e
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 370caf182a66
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: f104c8a3fe10
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: ae9fe22e7c45
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: ed77431f7a09
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: c8e069512be0
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 3c0291a04d61
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 1066c0dd57dd
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 28ce113c2055
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21629,13 +21630,17 @@ x-i18n:
       provenance: machine
       outputHash: f3710da98e9d
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 614419e41180
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: aaea0072c382
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 690fb30ee112
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: f353b61c4566
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.es.yaml

@@ -6195,7 +6195,7 @@ paths:
       tags:
         - Settings
       summary: Obtener todos los ajustes
-      description: Recupera todos los ajustes del sistema como pares clave-valor. Requiere autenticación.
+      description: Recupera los ajustes del sistema autorizados por los permisos efectivos del solicitante. Requiere `settings:read`; los ajustes de seguridad, cumplimiento y administrador pleno se filtran por separado.
       security:
         - bearerAuth: []
       responses:
@@ -6221,7 +6221,7 @@ paths:
       tags:
         - Settings
       summary: Actualizar ajustes
-      description: Acepta un objeto JSON plano de pares clave-valor para establecer. Requiere el rol de administrador.
+      description: Acepta un objeto JSON plano que contiene claves de ajustes reconocidas y escribibles. Requiere `settings:write`; las claves de seguridad y cumplimiento requieren además su permiso efectivo correspondiente, los secretos requieren autoridad de administrador pleno y las claves específicas o gestionadas por el servidor son de solo lectura.
       security:
         - bearerAuth: []
       requestBody:
@@ -6268,7 +6268,7 @@ paths:
       tags:
         - Settings
       summary: Obtener un solo ajuste
-      description: Recupera el valor de un solo ajuste por su nombre de clave. Devuelve el valor y la marca de tiempo de la última actualización.
+      description: Recupera un ajuste reconocido por clave. Devuelve el valor y la marca de tiempo de la última actualización cuando el solicitante tiene tanto `settings:read` como la autoridad adicional de la clave.
       security:
         - bearerAuth: []
       parameters:
@@ -18398,7 +18398,8 @@ paths:
       tags:
         - Enterprise
       summary: Exportar configuración
-      description: Exporta la configuración de instancia, los roles personalizados y los equipos con datos ocultos. Requiere el permiso system:health.
+      description: |
+        Exporta la configuración de instancia, los roles personalizados y los equipos con datos ocultos. Requiere autoridad efectiva completa de administrador integrado; los roles personalizados no cumplen el requisito, ni tampoco las claves de API a las que les falte cualquier permiso de administrador.
       security:
         - bearerAuth: []
       responses:
@@ -18413,7 +18414,7 @@ paths:
         - Enterprise
       summary: Importar configuración
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Importa la configuración de instancia, los roles personalizados y los equipos. Requiere autoridad efectiva completa de administrador integrado; los roles personalizados no cumplen el requisito, ni tampoco las claves de API a las que les falte cualquier permiso de administrador.
       security:
         - bearerAuth: []
       responses:
@@ -19665,25 +19666,25 @@ x-i18n:
       provenance: machine
       outputHash: 862c4c5821b7
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 09a24816393d
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 5944419bed64
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 3cc6d401df39
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 2f17092c37cc
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 598c9c86bd29
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 7dfd64b62ef9
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: bd49c5e3c701
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: c80feeaf5943
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21633,13 +21634,17 @@ x-i18n:
       provenance: machine
       outputHash: 9b4ebaabe258
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: c707b400987f
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: a8568826d1ae
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: b6274c66f0c5
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: e166fcc46360
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.fr.yaml

@@ -6195,7 +6195,7 @@ paths:
       tags:
         - Settings
       summary: Obtenir tous les paramètres
-      description: Récupère tous les paramètres système sous forme de paires clé-valeur. Requiert une authentification.
+      description: Récupère les paramètres système autorisés par les permissions effectives de l'appelant. Nécessite `settings:read` ; les paramètres de sécurité, de conformité et d'administrateur complet sont filtrés séparément.
       security:
         - bearerAuth: []
       responses:
@@ -6221,7 +6221,7 @@ paths:
       tags:
         - Settings
       summary: Mettre à jour les paramètres
-      description: Accepte un objet JSON plat de paires clé-valeur à définir. Requiert le rôle admin.
+      description: Accepte un objet JSON plat contenant des clés de paramètres reconnues et modifiables. Nécessite `settings:write` ; les clés de sécurité et de conformité nécessitent en plus la permission effective correspondante, les secrets nécessitent les droits d'un administrateur complet et les clés dédiées ou gérées par le serveur sont en lecture seule.
       security:
         - bearerAuth: []
       requestBody:
@@ -6268,7 +6268,7 @@ paths:
       tags:
         - Settings
       summary: Obtenir un paramètre unique
-      description: Récupère la valeur d'un paramètre unique par son nom de clé. Renvoie la valeur et l'horodatage de dernière mise à jour.
+      description: Récupère un paramètre reconnu par clé. Renvoie la valeur et l'horodatage de dernière mise à jour lorsque l'appelant possède à la fois `settings:read` et l'autorité supplémentaire de la clé.
       security:
         - bearerAuth: []
       parameters:
@@ -18378,7 +18378,8 @@ paths:
       tags:
         - Enterprise
       summary: Exporter la configuration
-      description: Exporte la configuration d'instance expurgée, les rôles personnalisés et les équipes. Requiert la permission system:health.
+      description: |
+        Exporte la configuration d'instance expurgée, les rôles personnalisés et les équipes. Requiert l'autorité effective complète d'un administrateur intégré ; les rôles personnalisés ne sont pas admissibles, pas plus que les clés API auxquelles il manque une seule permission d'administrateur.
       security:
         - bearerAuth: []
       responses:
@@ -18393,7 +18394,7 @@ paths:
         - Enterprise
       summary: Importer la configuration
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Importe la configuration d'instance, les rôles personnalisés et les équipes. Requiert l'autorité effective complète d'un administrateur intégré ; les rôles personnalisés ne sont pas admissibles, pas plus que les clés API auxquelles il manque une seule permission d'administrateur.
       security:
         - bearerAuth: []
       responses:
@@ -19645,25 +19646,25 @@ x-i18n:
       provenance: machine
       outputHash: b70c3c92d7f6
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 8720b9ff1c0c
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 2c06b77c18c0
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 74ea56ee20f2
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 3e54e8c482c9
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: dde1658a5b80
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: eedbcd4081b1
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 27ef7b78107f
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 39200ccf8e60
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21613,13 +21614,17 @@ x-i18n:
       provenance: machine
       outputHash: 1e2c987abfe2
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 51d77ffdd098
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: d56c8c1c6eff
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: a40e966d8e6e
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 1ea731aea890
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.hi.yaml

@@ -6193,7 +6193,7 @@ paths:
       tags:
         - Settings
       summary: सभी settings प्राप्त करें
-      description: सभी सिस्टम settings को key-value जोड़े के रूप में पुनर्प्राप्त करें। authentication आवश्यक है।
+      description: कॉलर की प्रभावी अनुमतियों द्वारा अधिकृत सिस्टम सेटिंग्स प्राप्त करें। `settings:read` आवश्यक है; सुरक्षा, अनुपालन और पूर्ण-एडमिन सेटिंग्स को अलग-अलग फ़िल्टर किया जाता है।
       security:
         - bearerAuth: []
       responses:
@@ -6219,7 +6219,7 @@ paths:
       tags:
         - Settings
       summary: settings अपडेट करें
-      description: सेट करने के लिए key-value जोड़ों का एक फ़्लैट JSON object स्वीकार करता है। admin role आवश्यक है।
+      description: मान्य और लिखने योग्य सेटिंग कीज़ वाला एक फ़्लैट JSON ऑब्जेक्ट स्वीकार करता है। `settings:write` आवश्यक है; सुरक्षा और अनुपालन कीज़ के लिए उनकी संबंधित प्रभावी अनुमति भी आवश्यक है, गोपनीय मानों के लिए पूर्ण-एडमिन अधिकार आवश्यक हैं, और समर्पित या सर्वर-प्रबंधित कीज़ केवल पढ़ने योग्य हैं।
       security:
         - bearerAuth: []
       requestBody:
@@ -6266,7 +6266,7 @@ paths:
       tags:
         - Settings
       summary: एकल setting प्राप्त करें
-      description: एक एकल setting मान को उसके key नाम से पुनर्प्राप्त करें। मान और अंतिम-अपडेट टाइमस्टैम्प लौटाता है।
+      description: की द्वारा एक मान्य सेटिंग प्राप्त करें। जब कॉलर के पास `settings:read` और उस की का अतिरिक्त अधिकार दोनों हों, तब मान और अंतिम-अपडेट टाइमस्टैम्प लौटाता है।
       security:
         - bearerAuth: []
       parameters:
@@ -18393,7 +18393,8 @@ paths:
       tags:
         - Enterprise
       summary: configuration निर्यात करें
-      description: redacted instance configuration, कस्टम roles, और teams निर्यात करें। system:health permission आवश्यक है।
+      description: |
+        संशोधित इंस्टेंस कॉन्फ़िगरेशन, कस्टम भूमिकाएँ और टीमें निर्यात करें। पूर्ण प्रभावी अंतर्निहित एडमिन अधिकार आवश्यक है; कस्टम भूमिकाएँ योग्य नहीं हैं और वे API कुंजियाँ भी योग्य नहीं हैं जिनमें एडमिन की कोई अनुमति अनुपलब्ध है।
       security:
         - bearerAuth: []
       responses:
@@ -18408,7 +18409,7 @@ paths:
         - Enterprise
       summary: configuration आयात करें
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        इंस्टेंस कॉन्फ़िगरेशन, कस्टम भूमिकाएँ और टीमें आयात करें। पूर्ण प्रभावी अंतर्निहित एडमिन अधिकार आवश्यक है; कस्टम भूमिकाएँ योग्य नहीं हैं और वे API कुंजियाँ भी योग्य नहीं हैं जिनमें एडमिन की कोई अनुमति अनुपलब्ध है।
       security:
         - bearerAuth: []
       responses:
@@ -19660,25 +19661,25 @@ x-i18n:
       provenance: machine
       outputHash: c6fdce15d344
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: d3e94911b256
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 970c5299cc14
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 072888ed4abc
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: b02ca90edfb4
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: aab6513a2028
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 4dde6655440e
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 9317b165aad6
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: b6fec86f5f9e
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21628,13 +21629,17 @@ x-i18n:
       provenance: machine
       outputHash: 90c5442816d3
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 95221fc9e75c
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 67b7c13336de
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: a35b2c408440
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 941451f40982
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.id.yaml

@@ -6195,7 +6195,7 @@ paths:
       tags:
         - Settings
       summary: Dapatkan semua settings
-      description: Ambil semua settings sistem sebagai pasangan key-value. Memerlukan autentikasi.
+      description: Ambil pengaturan sistem yang diizinkan oleh izin efektif pemanggil. Memerlukan `settings:read`; pengaturan keamanan, kepatuhan, dan admin penuh difilter secara terpisah.
       security:
         - bearerAuth: []
       responses:
@@ -6221,7 +6221,7 @@ paths:
       tags:
         - Settings
       summary: Perbarui settings
-      description: Menerima objek JSON datar berisi pasangan key-value untuk diatur. Memerlukan role admin.
+      description: Menerima objek JSON datar yang berisi kunci pengaturan yang dikenali dan dapat ditulis. Memerlukan `settings:write`; kunci keamanan dan kepatuhan juga memerlukan izin efektif yang sesuai, rahasia memerlukan wewenang admin penuh, dan kunci khusus atau yang dikelola server hanya dapat dibaca.
       security:
         - bearerAuth: []
       requestBody:
@@ -6268,7 +6268,7 @@ paths:
       tags:
         - Settings
       summary: Dapatkan satu setting
-      description: Ambil satu nilai setting berdasarkan nama key-nya. Mengembalikan nilai dan timestamp terakhir diperbarui.
+      description: Ambil pengaturan yang dikenali berdasarkan kunci. Mengembalikan nilai dan stempel waktu pembaruan terakhir ketika pemanggil memiliki `settings:read` serta wewenang tambahan untuk kunci tersebut.
       security:
         - bearerAuth: []
       parameters:
@@ -18398,7 +18398,8 @@ paths:
       tags:
         - Enterprise
       summary: Ekspor konfigurasi
-      description: Ekspor konfigurasi instance yang disunting, role kustom, dan teams. Memerlukan permission system:health.
+      description: |
+        Ekspor konfigurasi instans yang disunting, peran kustom, dan tim. Memerlukan kewenangan efektif penuh sebagai administrator bawaan; peran kustom tidak memenuhi syarat, demikian pula kunci API yang tidak mencakup semua izin administrator.
       security:
         - bearerAuth: []
       responses:
@@ -18413,7 +18414,7 @@ paths:
         - Enterprise
       summary: Impor konfigurasi
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Impor konfigurasi instans, peran kustom, dan tim. Memerlukan kewenangan efektif penuh sebagai administrator bawaan; peran kustom tidak memenuhi syarat, demikian pula kunci API yang tidak mencakup semua izin administrator.
       security:
         - bearerAuth: []
       responses:
@@ -19665,25 +19666,25 @@ x-i18n:
       provenance: machine
       outputHash: 1aab5d5325ae
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: e63beb9e2cdc
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 16bc43350f34
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 453963b68132
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 5a2be16b8683
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 9d7505a0cb61
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 814fbb078520
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 69883260d6ad
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: ef77c0d8af03
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21633,13 +21634,17 @@ x-i18n:
       provenance: machine
       outputHash: 3bb3de7ecbbf
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 643bd277962f
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 03167a2a49ed
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 1f25d439e461
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 66dd2399c1d1
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.it.yaml

@@ -6195,7 +6195,7 @@ paths:
       tags:
         - Settings
       summary: Ottieni tutte le impostazioni
-      description: Recupera tutte le impostazioni di sistema come coppie chiave-valore. Richiede l'autenticazione.
+      description: Recupera le impostazioni di sistema autorizzate dalle autorizzazioni effettive del chiamante. Richiede `settings:read`; le impostazioni di sicurezza, conformità e amministratore completo vengono filtrate separatamente.
       security:
         - bearerAuth: []
       responses:
@@ -6221,7 +6221,7 @@ paths:
       tags:
         - Settings
       summary: Aggiorna impostazioni
-      description: Accetta un oggetto JSON piatto di coppie chiave-valore da impostare. Richiede il ruolo admin.
+      description: Accetta un oggetto JSON piatto contenente chiavi di impostazione riconosciute e scrivibili. Richiede `settings:write`; le chiavi di sicurezza e conformità richiedono inoltre la rispettiva autorizzazione effettiva, i segreti richiedono l'autorità di amministratore completo e le chiavi dedicate o gestite dal server sono di sola lettura.
       security:
         - bearerAuth: []
       requestBody:
@@ -6268,7 +6268,7 @@ paths:
       tags:
         - Settings
       summary: Ottieni una singola impostazione
-      description: Recupera il valore di una singola impostazione tramite il nome della sua chiave. Restituisce il valore e il timestamp dell'ultimo aggiornamento.
+      description: Recupera un'impostazione riconosciuta tramite la chiave. Restituisce il valore e il timestamp dell'ultimo aggiornamento quando il chiamante dispone sia di `settings:read` sia dell'autorità aggiuntiva della chiave.
       security:
         - bearerAuth: []
       parameters:
@@ -18398,7 +18398,8 @@ paths:
       tags:
         - Enterprise
       summary: Esporta configurazione
-      description: Esporta la configurazione oscurata dell'istanza, i ruoli personalizzati e i team. Richiede il permesso system:health.
+      description: |
+        Esporta la configurazione oscurata dell'istanza, i ruoli personalizzati e i team. Richiede l'autorità effettiva completa di un amministratore integrato; i ruoli personalizzati non sono idonei, né lo sono le chiavi API prive anche di una sola autorizzazione amministrativa.
       security:
         - bearerAuth: []
       responses:
@@ -18413,7 +18414,7 @@ paths:
         - Enterprise
       summary: Importa configurazione
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Importa la configurazione dell'istanza, i ruoli personalizzati e i team. Richiede l'autorità effettiva completa di un amministratore integrato; i ruoli personalizzati non sono idonei, né lo sono le chiavi API prive anche di una sola autorizzazione amministrativa.
       security:
         - bearerAuth: []
       responses:
@@ -19665,25 +19666,25 @@ x-i18n:
       provenance: machine
       outputHash: f9cdc1e7455c
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 14097383c829
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 5cdfc3e48c16
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 14c1ddae327c
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 37bf1f7dad61
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: b6a0e1964254
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: b30db479d104
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 1c921a65d3bb
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 8583f2d1dfee
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21633,13 +21634,17 @@ x-i18n:
       provenance: machine
       outputHash: e07ab8c81b04
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: fe14c176c9e2
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 7cf25f1e1e9c
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: a5c7f6cb48a5
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 300f32c73293
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.ja.yaml

@@ -6160,7 +6160,7 @@ paths:
       tags:
         - Settings
       summary: すべての設定の取得
-      description: すべてのシステム設定をキーと値のペアとして取得します。認証が必要です。
+      description: 呼び出し元の有効な権限で許可されたシステム設定を取得します。`settings:read` が必要です。セキュリティ、コンプライアンス、完全な管理者向けの設定は、それぞれ個別にフィルタリングされます。
       security:
         - bearerAuth: []
       responses:
@@ -6186,7 +6186,7 @@ paths:
       tags:
         - Settings
       summary: 設定の更新
-      description: 設定するキーと値のペアのフラットな JSON オブジェクトを受け付けます。管理者ロールが必要です。
+      description: 認識済みで書き込み可能な設定キーを含むフラットな JSON オブジェクトを受け付けます。`settings:write` が必要です。セキュリティおよびコンプライアンスのキーには対応する有効な権限も、秘密情報には完全な管理者権限も必要で、専用またはサーバー管理のキーは読み取り専用です。
       security:
         - bearerAuth: []
       requestBody:
@@ -6233,7 +6233,7 @@ paths:
       tags:
         - Settings
       summary: 単一設定の取得
-      description: キー名で単一の設定値を取得します。値と最終更新タイムスタンプを返します。
+      description: 認識済みの設定をキーで取得します。呼び出し元が `settings:read` とそのキーに必要な追加権限の両方を持つ場合に、値と最終更新タイムスタンプを返します。
       security:
         - bearerAuth: []
       parameters:
@@ -18327,7 +18327,8 @@ paths:
       tags:
         - Enterprise
       summary: 設定のエクスポート
-      description: 編集除去済みのインスタンス設定、カスタムロール、チームをエクスポートします。system:health 権限が必要です。
+      description: |
+        秘匿化されたインスタンス設定、カスタムロール、チームをエクスポートします。完全かつ実効的な組み込み管理者権限が必要です。カスタムロールは対象外であり、管理者権限が一つでも欠けている API キーも対象外です。
       security:
         - bearerAuth: []
       responses:
@@ -18342,7 +18343,7 @@ paths:
         - Enterprise
       summary: 設定のインポート
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        インスタンス設定、カスタムロール、チームをインポートします。完全かつ実効的な組み込み管理者権限が必要です。カスタムロールは対象外であり、管理者権限が一つでも欠けている API キーも対象外です。
       security:
         - bearerAuth: []
       responses:
@@ -19594,25 +19595,25 @@ x-i18n:
       provenance: machine
       outputHash: 2d107a5eb4f3
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 307ae971697e
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 9a58dcc21002
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 98cfb65d08f6
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: d5c6d2ccac83
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 9bcfba34c986
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 48db6298cef0
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 4fa6b2c77ee2
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 6fa9dce31531
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21562,13 +21563,17 @@ x-i18n:
       provenance: machine
       outputHash: efea2136bc64
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: cf999b06bf18
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: a2674017cc21
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 9658e7ae2aa5
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: a56e90fb33e9
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.ko.yaml

@@ -6194,7 +6194,7 @@ paths:
       tags:
         - Settings
       summary: 모든 설정 가져오기
-      description: 모든 시스템 설정을 키-값 쌍으로 조회합니다. 인증이 필요합니다.
+      description: 호출자의 유효 권한으로 허용된 시스템 설정을 조회합니다. `settings:read`가 필요하며 보안, 규정 준수 및 전체 관리자 설정은 각각 별도로 필터링됩니다.
       security:
         - bearerAuth: []
       responses:
@@ -6220,7 +6220,7 @@ paths:
       tags:
         - Settings
       summary: 설정 업데이트
-      description: 설정할 키-값 쌍의 플랫 JSON 객체를 받습니다. 관리자 역할이 필요합니다.
+      description: 인식된 쓰기 가능 설정 키를 포함하는 플랫 JSON 객체를 받습니다. `settings:write`가 필요하며 보안 및 규정 준수 키에는 각각 일치하는 유효 권한도 필요합니다. 비밀 정보에는 전체 관리자 권한이 필요하고 전용 또는 서버 관리 키는 읽기 전용입니다.
       security:
         - bearerAuth: []
       requestBody:
@@ -6267,7 +6267,7 @@ paths:
       tags:
         - Settings
       summary: 단일 설정 가져오기
-      description: 키 이름으로 단일 설정 값을 조회합니다. 값과 마지막 업데이트 타임스탬프를 반환합니다.
+      description: 인식된 설정을 키로 조회합니다. 호출자에게 `settings:read`와 해당 키의 추가 권한이 모두 있는 경우 값과 마지막 업데이트 타임스탬프를 반환합니다.
       security:
         - bearerAuth: []
       parameters:
@@ -18396,7 +18396,8 @@ paths:
       tags:
         - Enterprise
       summary: 구성 내보내기
-      description: 삭제 처리된 인스턴스 구성, 사용자 정의 역할, 팀을 내보냅니다. system:health 권한이 필요합니다.
+      description: |
+        민감 정보가 제거된 인스턴스 구성, 사용자 지정 역할, 팀을 내보냅니다. 완전하고 유효한 기본 제공 관리자 권한이 필요합니다. 사용자 지정 역할은 자격이 없으며, 관리자 권한이 하나라도 누락된 API 키도 자격이 없습니다.
       security:
         - bearerAuth: []
       responses:
@@ -18411,7 +18412,7 @@ paths:
         - Enterprise
       summary: 구성 가져오기
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        인스턴스 구성, 사용자 지정 역할, 팀을 가져옵니다. 완전하고 유효한 기본 제공 관리자 권한이 필요합니다. 사용자 지정 역할은 자격이 없으며, 관리자 권한이 하나라도 누락된 API 키도 자격이 없습니다.
       security:
         - bearerAuth: []
       responses:
@@ -19663,25 +19664,25 @@ x-i18n:
       provenance: machine
       outputHash: 035764fb2a66
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 356b431c19e0
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 92e2b24a638a
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 5236b38f5ebc
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: ee2b9ad3de23
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 91196394ed7c
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: f0bbecf0a440
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 197135f3a96e
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 844244eeeb22
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21631,13 +21632,17 @@ x-i18n:
       provenance: machine
       outputHash: cae0b5d8b1da
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 3ea14ebe2434
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 57ba635adf06
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 545bc5835bce
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: eac40b873768
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.nl.yaml

@@ -6160,7 +6160,7 @@ paths:
       tags:
         - Settings
       summary: Alle instellingen ophalen
-      description: Haal alle systeeminstellingen op als sleutel-waardeparen. Vereist authenticatie.
+      description: Haalt de systeeminstellingen op waarvoor de effectieve machtigingen van de aanroeper toestemming geven. Vereist `settings:read`; beveiligings-, compliance- en volledige beheerdersinstellingen worden afzonderlijk gefilterd.
       security:
         - bearerAuth: []
       responses:
@@ -6186,7 +6186,7 @@ paths:
       tags:
         - Settings
       summary: Instellingen bijwerken
-      description: Accepteert een plat JSON-object met sleutel-waardeparen om in te stellen. Vereist de admin-rol.
+      description: Accepteert een plat JSON-object met herkende, beschrijfbare instellingssleutels. Vereist `settings:write`; beveiligings- en compliancesleutels vereisen daarnaast de bijbehorende effectieve machtiging, geheimen vereisen volledige beheerdersbevoegdheid en specifieke of door de server beheerde sleutels zijn alleen-lezen.
       security:
         - bearerAuth: []
       requestBody:
@@ -6233,7 +6233,7 @@ paths:
       tags:
         - Settings
       summary: Een enkele instelling ophalen
-      description: Haal een enkele instellingswaarde op via de sleutelnaam. Geeft de waarde en het tijdstip van laatste wijziging terug.
+      description: Haalt een herkende instelling op via de sleutel. Geeft de waarde en het tijdstip van de laatste wijziging terug wanneer de aanroeper zowel `settings:read` als de aanvullende bevoegdheid voor de sleutel bezit.
       security:
         - bearerAuth: []
       parameters:
@@ -18326,7 +18326,8 @@ paths:
       tags:
         - Enterprise
       summary: Configuratie exporteren
-      description: Exporteer geredigeerde instanceconfiguratie, aangepaste rollen en teams. Vereist de permissie system:health.
+      description: |
+        Exporteer geredigeerde instanceconfiguratie, aangepaste rollen en teams. Vereist volledige effectieve bevoegdheid van een ingebouwde beheerder; aangepaste rollen komen niet in aanmerking, evenmin als API-sleutels waaraan een beheerderspermissie ontbreekt.
       security:
         - bearerAuth: []
       responses:
@@ -18341,7 +18342,7 @@ paths:
         - Enterprise
       summary: Configuratie importeren
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Importeer instanceconfiguratie, aangepaste rollen en teams. Vereist volledige effectieve bevoegdheid van een ingebouwde beheerder; aangepaste rollen komen niet in aanmerking, evenmin als API-sleutels waaraan een beheerderspermissie ontbreekt.
       security:
         - bearerAuth: []
       responses:
@@ -19593,25 +19594,25 @@ x-i18n:
       provenance: machine
       outputHash: 666c293de44a
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 78d23fe3574e
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: a121e623e4a5
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: a8d44c68e07a
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: b2df9ad7451d
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 813e87bcde6a
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 42ada4bb9e65
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 700218f9c448
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 05c0b7d34d3b
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21561,13 +21562,17 @@ x-i18n:
       provenance: machine
       outputHash: 483802d6d88b
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 273e5733e90b
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 549dae89e5db
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: e879e533fcf9
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 0057af9b7cd9
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.pl.yaml

@@ -6195,7 +6195,7 @@ paths:
       tags:
         - Settings
       summary: Pobierz wszystkie ustawienia
-      description: Pobierz wszystkie ustawienia systemowe jako pary klucz-wartość. Wymaga uwierzytelnienia.
+      description: Pobiera ustawienia systemowe dostępne na podstawie efektywnych uprawnień wywołującego. Wymaga `settings:read`; ustawienia zabezpieczeń, zgodności i pełnego administratora są filtrowane oddzielnie.
       security:
         - bearerAuth: []
       responses:
@@ -6221,7 +6221,7 @@ paths:
       tags:
         - Settings
       summary: Aktualizuj ustawienia
-      description: Przyjmuje płaski obiekt JSON par klucz-wartość do ustawienia. Wymaga roli admina.
+      description: Przyjmuje płaski obiekt JSON zawierający rozpoznawane, zapisywalne klucze ustawień. Wymaga `settings:write`; klucze zabezpieczeń i zgodności dodatkowo wymagają odpowiedniego efektywnego uprawnienia, ustawienia tajne wymagają uprawnień pełnego administratora, a klucze dedykowane lub zarządzane przez serwer są tylko do odczytu.
       security:
         - bearerAuth: []
       requestBody:
@@ -6268,7 +6268,7 @@ paths:
       tags:
         - Settings
       summary: Pobierz pojedyncze ustawienie
-      description: Pobierz wartość pojedynczego ustawienia według nazwy klucza. Zwraca wartość i znacznik czasu ostatniej aktualizacji.
+      description: Pobiera rozpoznawane ustawienie według klucza. Zwraca wartość i znacznik czasu ostatniej aktualizacji, gdy wywołujący ma zarówno `settings:read`, jak i dodatkowe uprawnienie wymagane przez klucz.
       security:
         - bearerAuth: []
       parameters:
@@ -18398,7 +18398,11 @@ paths:
       tags:
         - Enterprise
       summary: Eksportuj konfigurację
-      description: Eksportuj ocenzurowaną konfigurację instancji, niestandardowe role i zespoły. Wymaga uprawnienia system:health.
+      description: >
+        Eksportuje zredagowaną konfigurację instancji, niestandardowe role i zespoły.
+        Wymaga pełnych efektywnych uprawnień wbudowanego administratora. Role niestandardowe
+        nie spełniają tego wymagania; nie spełniają go również klucze API, którym brakuje
+        choć jednego uprawnienia administratora.
       security:
         - bearerAuth: []
       responses:
@@ -18413,7 +18417,7 @@ paths:
         - Enterprise
       summary: Importuj konfigurację
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Importuje konfigurację instancji, niestandardowe role i zespoły. Wymaga pełnych efektywnych uprawnień wbudowanego administratora. Role niestandardowe nie spełniają tego wymagania; nie spełniają go również klucze API, którym brakuje choć jednego uprawnienia administratora.
       security:
         - bearerAuth: []
       responses:
@@ -19665,25 +19669,25 @@ x-i18n:
       provenance: machine
       outputHash: 2d3309d3d734
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 922c505e81c5
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: fde39a0b5fde
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 865cc609ce5a
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 690935d899b9
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 2f5dd782fa2d
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 75ace75129e8
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: fe175eaa6a44
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 9499a2b66ce0
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21633,13 +21637,17 @@ x-i18n:
       provenance: machine
       outputHash: 6741ae612f1a
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 783abf56dd51
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 565e220d1ee1
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 69d9e498d678
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 050e4bd70006
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.pt-BR.yaml

@@ -6195,7 +6195,7 @@ paths:
       tags:
         - Settings
       summary: Obter todas as configurações
-      description: Recupera todas as configurações do sistema como pares chave-valor. Requer autenticação.
+      description: Recupera as configurações do sistema autorizadas pelas permissões efetivas do solicitante. Requer `settings:read`; as configurações de segurança, conformidade e de administrador completo são filtradas separadamente.
       security:
         - bearerAuth: []
       responses:
@@ -6221,7 +6221,7 @@ paths:
       tags:
         - Settings
       summary: Atualizar configurações
-      description: Aceita um objeto JSON plano de pares chave-valor a definir. Requer a função admin.
+      description: Aceita um objeto JSON plano contendo chaves de configuração reconhecidas e graváveis. Requer `settings:write`; chaves de segurança e conformidade também exigem a permissão efetiva correspondente, configurações secretas exigem autoridade de administrador completo e chaves dedicadas ou gerenciadas pelo servidor são somente leitura.
       security:
         - bearerAuth: []
       requestBody:
@@ -6268,7 +6268,7 @@ paths:
       tags:
         - Settings
       summary: Obter uma única configuração
-      description: Recupera o valor de uma única configuração pelo nome da chave. Retorna o valor e o timestamp da última atualização.
+      description: Recupera uma configuração reconhecida pela chave. Retorna o valor e o horário da última atualização quando o solicitante tem `settings:read` e a autoridade adicional exigida pela chave.
       security:
         - bearerAuth: []
       parameters:
@@ -18398,7 +18398,10 @@ paths:
       tags:
         - Enterprise
       summary: Exportar configuração
-      description: Exporta a configuração redigida da instância, funções personalizadas e equipes. Requer a permissão system:health.
+      description: >
+        Exporta a configuração redigida da instância, os papéis personalizados e as equipes.
+        Requer autoridade efetiva total de administrador integrado. Papéis personalizados não
+        se qualificam, nem chaves de API que não incluam todas as permissões de administrador.
       security:
         - bearerAuth: []
       responses:
@@ -18413,7 +18416,7 @@ paths:
         - Enterprise
       summary: Importar configuração
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Importa a configuração da instância, os papéis personalizados e as equipes. Requer autoridade efetiva total de administrador integrado. Papéis personalizados não se qualificam, nem chaves de API que não incluam todas as permissões de administrador.
       security:
         - bearerAuth: []
       responses:
@@ -19665,25 +19668,25 @@ x-i18n:
       provenance: machine
       outputHash: e6f093f09f4e
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: c6fe75e15bc0
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 0001005a79ad
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 78d8117d251c
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 327f6546fdab
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 805deb038f5e
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 14b11f7a54c5
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 9881141d8b55
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 696303124fab
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21633,13 +21636,17 @@ x-i18n:
       provenance: machine
       outputHash: a29248d9ba03
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 240b4bd3ef81
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: fc97fe44d92a
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 79e7be0dfa9f
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: ecb1bd41efa8
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.ru.yaml

@@ -6197,7 +6197,7 @@ paths:
       tags:
         - Settings
       summary: Получить все настройки
-      description: Получение всех системных настроек в виде пар ключ-значение. Требует аутентификации.
+      description: Возвращает системные настройки, доступные согласно действующим разрешениям вызывающей стороны. Требуется `settings:read`; настройки безопасности, соответствия и полного администратора фильтруются отдельно.
       security:
         - bearerAuth: []
       responses:
@@ -6223,7 +6223,7 @@ paths:
       tags:
         - Settings
       summary: Обновление настроек
-      description: Принимает плоский JSON-объект пар ключ-значение для установки. Требует роль администратора.
+      description: Принимает плоский JSON-объект с распознаваемыми и доступными для записи ключами настроек. Требуется `settings:write`; для ключей безопасности и соответствия также требуется соответствующее действующее разрешение, секретные настройки требуют полномочий администратора в полном объёме, а специализированные или управляемые сервером ключи доступны только для чтения.
       security:
         - bearerAuth: []
       requestBody:
@@ -6270,7 +6270,7 @@ paths:
       tags:
         - Settings
       summary: Получить одну настройку
-      description: Получение значения одной настройки по имени ключа. Возвращает значение и временную метку последнего обновления.
+      description: Возвращает распознаваемую настройку по ключу. Значение и время последнего обновления возвращаются, если вызывающая сторона имеет `settings:read` и дополнительное полномочие, необходимое для этого ключа.
       security:
         - bearerAuth: []
       parameters:
@@ -18400,7 +18400,11 @@ paths:
       tags:
         - Enterprise
       summary: Экспорт конфигурации
-      description: Экспорт отредактированной конфигурации экземпляра, пользовательских ролей и команд. Требует разрешение system:health.
+      description: >
+        Экспортирует отредактированную конфигурацию экземпляра, пользовательские роли и команды.
+        Требуются полные действующие полномочия встроенного администратора. Пользовательские роли
+        не подходят; также не подходят ключи API, в которых отсутствует хотя бы одно разрешение
+        администратора.
       security:
         - bearerAuth: []
       responses:
@@ -18415,7 +18419,7 @@ paths:
         - Enterprise
       summary: Импорт конфигурации
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Импортирует конфигурацию экземпляра, пользовательские роли и команды. Требуются полные действующие полномочия встроенного администратора. Пользовательские роли не подходят; также не подходят ключи API, в которых отсутствует хотя бы одно разрешение администратора.
       security:
         - bearerAuth: []
       responses:
@@ -19667,25 +19671,25 @@ x-i18n:
       provenance: machine
       outputHash: 924fe311b5da
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 752016209a09
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 705b786a77be
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 603ae7d76ad5
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 7987df38d257
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: d62ac18b7a23
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 633988a54360
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 4d5189e0bab6
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 9d6ce07a3ef3
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21635,13 +21639,17 @@ x-i18n:
       provenance: machine
       outputHash: c884141b63c1
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: a56dbe5d051e
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: d41ea886abf4
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: ad05d605d6dc
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 76f839bcc1ff
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.sv.yaml

@@ -6195,7 +6195,7 @@ paths:
       tags:
         - Settings
       summary: Haamta alla installningar
-      description: Haamta alla systeminstallningar som nyckel-vardepar. Kraver autentisering.
+      description: Hämtar de systeminställningar som anroparens effektiva behörigheter medger. Kräver `settings:read`; säkerhets-, efterlevnads- och fullständiga administratörsinställningar filtreras separat.
       security:
         - bearerAuth: []
       responses:
@@ -6221,7 +6221,7 @@ paths:
       tags:
         - Settings
       summary: Uppdatera installningar
-      description: Tar emot ett platt JSON-objekt av nyckel-vardepar att stalla in. Kraver admin-roll.
+      description: Tar emot ett platt JSON-objekt med kända, skrivbara inställningsnycklar. Kräver `settings:write`; säkerhets- och efterlevnadsnycklar kräver dessutom motsvarande effektiv behörighet, hemliga inställningar kräver fullständig administratörsbehörighet och särskilda eller serverhanterade nycklar är skrivskyddade.
       security:
         - bearerAuth: []
       requestBody:
@@ -6268,7 +6268,7 @@ paths:
       tags:
         - Settings
       summary: Haamta en enskild installning
-      description: Haamta ett enskilt installningsvarde via dess nyckelnamn. Returnerar vardet och tidsstampeln for senaste uppdatering.
+      description: Hämtar en känd inställning via nyckel. Returnerar värdet och tidsstämpeln för den senaste uppdateringen när anroparen har både `settings:read` och nyckelns ytterligare behörighet.
       security:
         - bearerAuth: []
       parameters:
@@ -18397,7 +18397,10 @@ paths:
       tags:
         - Enterprise
       summary: Exportera konfiguration
-      description: Exportera redigerad instanskonfiguration, anpassade roller och team. Kraver behorigheten system:health.
+      description: >
+        Exporterar redigerad instanskonfiguration, anpassade roller och team. Kräver fullständig
+        faktisk behörighet som inbyggd administratör. Anpassade roller kvalificerar inte, och inte
+        heller API-nycklar som saknar någon administratörsbehörighet.
       security:
         - bearerAuth: []
       responses:
@@ -18412,7 +18415,7 @@ paths:
         - Enterprise
       summary: Importera konfiguration
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Importerar instanskonfiguration, anpassade roller och team. Kräver fullständig faktisk behörighet som inbyggd administratör. Anpassade roller kvalificerar inte, och inte heller API-nycklar som saknar någon administratörsbehörighet.
       security:
         - bearerAuth: []
       responses:
@@ -19664,25 +19667,25 @@ x-i18n:
       provenance: machine
       outputHash: 682cc2c07112
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 40689398e10e
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 798934885bfb
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 29711c3c4044
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 1763022012df
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: a1c1c1598466
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: f4542877281b
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 582bf0445c23
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 2d888ca899a8
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21632,13 +21635,17 @@ x-i18n:
       provenance: machine
       outputHash: b0d69bc545d5
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 0df30ed01216
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 7cde619401b4
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 44be217903e1
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: d6f32546d706
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.th.yaml

@@ -6159,7 +6159,7 @@ paths:
       tags:
         - Settings
       summary: รับการตั้งค่าทั้งหมด
-      description: ดึงการตั้งค่าระบบทั้งหมดเป็นคู่ key-value ต้องมีการยืนยันตัวตน
+      description: ดึงการตั้งค่าระบบที่สิทธิ์ที่มีผลของผู้เรียกอนุญาต ต้องมี `settings:read` โดยระบบจะกรองการตั้งค่าด้านความปลอดภัย การปฏิบัติตามข้อกำหนด และผู้ดูแลระบบเต็มรูปแบบแยกกัน
       security:
         - bearerAuth: []
       responses:
@@ -6185,7 +6185,7 @@ paths:
       tags:
         - Settings
       summary: อัปเดตการตั้งค่า
-      description: รับ JSON object แบบแบนของคู่ key-value เพื่อตั้งค่า ต้องมีบทบาทแอดมิน
+      description: รับ JSON object แบบแบนที่มีคีย์การตั้งค่าซึ่งระบบรู้จักและเขียนได้ ต้องมี `settings:write` ส่วนคีย์ด้านความปลอดภัยและการปฏิบัติตามข้อกำหนดต้องมีสิทธิ์ที่มีผลซึ่งตรงกันเพิ่มเติม การตั้งค่าที่เป็นความลับต้องมีสิทธิ์ผู้ดูแลระบบเต็มรูปแบบ และคีย์เฉพาะหรือคีย์ที่เซิร์ฟเวอร์จัดการจะเป็นแบบอ่านอย่างเดียว
       security:
         - bearerAuth: []
       requestBody:
@@ -6232,7 +6232,7 @@ paths:
       tags:
         - Settings
       summary: รับการตั้งค่ารายการเดียว
-      description: ดึงค่าการตั้งค่ารายการเดียวตามชื่อ key คืนค่าและ timestamp ที่อัปเดตล่าสุด
+      description: ดึงการตั้งค่าที่ระบบรู้จักตามคีย์ โดยจะคืนค่าและเวลาอัปเดตล่าสุดเมื่อผู้เรียกมีทั้ง `settings:read` และสิทธิ์เพิ่มเติมที่คีย์นั้นกำหนด
       security:
         - bearerAuth: []
       parameters:
@@ -18325,7 +18325,9 @@ paths:
       tags:
         - Enterprise
       summary: ส่งออกการกำหนดค่า
-      description: ส่งออกการกำหนดค่าอินสแตนซ์ที่ปิดบังแล้ว บทบาทกำหนดเอง และทีม ต้องมีสิทธิ์ system:health
+      description: >
+        ส่งออกการกำหนดค่าอินสแตนซ์ที่ปิดบังแล้ว บทบาทที่กำหนดเอง และทีม ต้องมีอำนาจผู้ดูแลระบบในตัวแบบเต็มตามสิทธิ์ที่มีผล
+        บทบาทที่กำหนดเองไม่มีคุณสมบัติ และคีย์ API ที่ขาดสิทธิ์ผู้ดูแลระบบแม้แต่รายการเดียวก็ไม่มีคุณสมบัติเช่นกัน
       security:
         - bearerAuth: []
       responses:
@@ -18340,7 +18342,7 @@ paths:
         - Enterprise
       summary: นำเข้าการกำหนดค่า
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        นำเข้าการกำหนดค่าอินสแตนซ์ บทบาทที่กำหนดเอง และทีม ต้องมีอำนาจผู้ดูแลระบบในตัวแบบเต็มตามสิทธิ์ที่มีผล บทบาทที่กำหนดเองไม่มีคุณสมบัติ และคีย์ API ที่ขาดสิทธิ์ผู้ดูแลระบบแม้แต่รายการเดียวก็ไม่มีคุณสมบัติเช่นกัน
       security:
         - bearerAuth: []
       responses:
@@ -19592,25 +19594,25 @@ x-i18n:
       provenance: machine
       outputHash: 86f2afe11a85
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 0eefc4821fa9
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 7caf2a6887b2
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 5c40ab117f50
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: d4199ba5e6bf
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: ae30d567e320
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 521ebe64be35
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 50c149751003
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 981b04469600
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21560,13 +21562,17 @@ x-i18n:
       provenance: machine
       outputHash: d214db073a3f
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: fe3be4237a3c
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 7c26f7cf8693
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: b6a1491a4fde
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: f4b1d116c50e
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.tr.yaml

@@ -6195,7 +6195,7 @@ paths:
       tags:
         - Settings
       summary: Tüm ayarları al
-      description: Tüm sistem ayarlarını anahtar-değer çiftleri olarak alın. Kimlik doğrulama gerektirir.
+      description: Çağıranın etkin izinlerinin yetkilendirdiği sistem ayarlarını getirir. `settings:read` gerektirir; güvenlik, uyumluluk ve tam yönetici ayarları ayrı ayrı filtrelenir.
       security:
         - bearerAuth: []
       responses:
@@ -6221,7 +6221,7 @@ paths:
       tags:
         - Settings
       summary: Ayarları güncelle
-      description: Ayarlanacak anahtar-değer çiftlerinin düz bir JSON nesnesini kabul eder. Yönetici rolü gerektirir.
+      description: Tanınan ve yazılabilir ayar anahtarlarını içeren düz bir JSON nesnesini kabul eder. `settings:write` gerektirir; güvenlik ve uyumluluk anahtarları ayrıca karşılık gelen etkin izni, gizli ayarlar tam yönetici yetkisini gerektirir; özel veya sunucu tarafından yönetilen anahtarlar ise salt okunurdur.
       security:
         - bearerAuth: []
       requestBody:
@@ -6268,7 +6268,7 @@ paths:
       tags:
         - Settings
       summary: Tek bir ayarı al
-      description: Tek bir ayar değerini anahtar adına göre alın. Değeri ve son güncelleme zaman damgasını döndürür.
+      description: Tanınan bir ayarı anahtarına göre getirir. Çağıran hem `settings:read` hem de anahtarın ek yetkisine sahip olduğunda değeri ve son güncelleme zaman damgasını döndürür.
       security:
         - bearerAuth: []
       parameters:
@@ -18397,7 +18397,10 @@ paths:
       tags:
         - Enterprise
       summary: Yapılandırmayı dışa aktar
-      description: Redakte edilmiş örnek yapılandırmasını, özel rolleri ve ekipleri dışa aktarın. system:health iznini gerektirir.
+      description: >
+        Redakte edilmiş örnek yapılandırmasını, özel rolleri ve ekipleri dışa aktarır. Tam etkin
+        yerleşik yönetici yetkisi gerektirir. Özel roller ve herhangi bir yönetici izni eksik olan
+        API anahtarları uygun değildir.
       security:
         - bearerAuth: []
       responses:
@@ -18412,7 +18415,7 @@ paths:
         - Enterprise
       summary: Yapılandırmayı içe aktar
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Örnek yapılandırmasını, özel rolleri ve ekipleri içe aktarır. Tam etkin yerleşik yönetici yetkisi gerektirir. Özel roller ve herhangi bir yönetici izni eksik olan API anahtarları uygun değildir.
       security:
         - bearerAuth: []
       responses:
@@ -19664,25 +19667,25 @@ x-i18n:
       provenance: machine
       outputHash: a32e241d07b6
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 3edd8247aa35
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 217e7761a265
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: ec872d75e4b1
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 20bdc243879a
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 7e7097fbe6ae
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 92329e85bfdc
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 93bf784f2848
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: b3576633b872
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21632,13 +21635,17 @@ x-i18n:
       provenance: machine
       outputHash: 78b131e59df9
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: fe29b94fea16
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: fefe5ebfe202
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 3c49ebff8d5c
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: e5a410562089
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.uk.yaml

@@ -6195,7 +6195,7 @@ paths:
       tags:
         - Settings
       summary: Отримати всі налаштування
-      description: Отримати всі системні налаштування як пари ключ-значення. Потребує автентифікації.
+      description: Повертає системні налаштування, дозволені ефективними правами викликувача. Потрібен дозвіл `settings:read`; налаштування безпеки, відповідності та повного адміністратора фільтруються окремо.
       security:
         - bearerAuth: []
       responses:
@@ -6221,7 +6221,7 @@ paths:
       tags:
         - Settings
       summary: Оновити налаштування
-      description: Приймає плоский об'єкт JSON із парами ключ-значення для встановлення. Потребує ролі адміністратора.
+      description: Приймає плоский об'єкт JSON із розпізнаваними ключами налаштувань, доступними для запису. Потрібен дозвіл `settings:write`; ключі безпеки та відповідності також вимагають відповідного ефективного дозволу, секретні налаштування вимагають повноважень повного адміністратора, а спеціалізовані або керовані сервером ключі доступні лише для читання.
       security:
         - bearerAuth: []
       requestBody:
@@ -6268,7 +6268,7 @@ paths:
       tags:
         - Settings
       summary: Отримати одне налаштування
-      description: Отримати значення одного налаштування за іменем ключа. Повертає значення та мітку часу останнього оновлення.
+      description: Повертає розпізнаване налаштування за ключем. Значення та мітка часу останнього оновлення повертаються, якщо викликувач має `settings:read` і додаткові повноваження, необхідні для цього ключа.
       security:
         - bearerAuth: []
       parameters:
@@ -18398,7 +18398,10 @@ paths:
       tags:
         - Enterprise
       summary: Експортувати конфігурацію
-      description: Експортувати приховувану конфігурацію екземпляра, власні ролі та команди. Потребує дозволу system:health.
+      description: >
+        Експортує приховану конфігурацію екземпляра, власні ролі та команди. Потрібні повні
+        фактичні повноваження вбудованого адміністратора. Власні ролі не відповідають цій вимозі;
+        так само їй не відповідають ключі API, у яких відсутній хоча б один дозвіл адміністратора.
       security:
         - bearerAuth: []
       responses:
@@ -18413,7 +18416,7 @@ paths:
         - Enterprise
       summary: Імпортувати конфігурацію
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Імпортує конфігурацію екземпляра, власні ролі та команди. Потрібні повні фактичні повноваження вбудованого адміністратора. Власні ролі не відповідають цій вимозі; так само їй не відповідають ключі API, у яких відсутній хоча б один дозвіл адміністратора.
       security:
         - bearerAuth: []
       responses:
@@ -19665,25 +19668,25 @@ x-i18n:
       provenance: machine
       outputHash: d5a2e5936382
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 5b6a5774bbc9
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: a87bf50bf0c9
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 022d75be8a33
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 6f8bdc5f2726
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 2dae8e572dfe
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 8d466ef13a3b
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: af91370069b1
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: fb1367bdacbe
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21633,13 +21636,17 @@ x-i18n:
       provenance: machine
       outputHash: aefff1771914
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: cdae7926ad8d
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 6bf7d9f7cd87
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 9913cd1c8f54
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: b5c8cf8a0eb8
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.vi.yaml

@@ -6194,7 +6194,7 @@ paths:
       tags:
         - Settings
       summary: Lấy tất cả cài đặt
-      description: Truy xuất tất cả cài đặt hệ thống dưới dạng cặp khóa-giá trị. Yêu cầu xác thực.
+      description: Truy xuất các cài đặt hệ thống mà quyền hiệu lực của bên gọi cho phép. Yêu cầu `settings:read`; các cài đặt bảo mật, tuân thủ và dành cho quản trị viên đầy đủ được lọc riêng.
       security:
         - bearerAuth: []
       responses:
@@ -6220,7 +6220,7 @@ paths:
       tags:
         - Settings
       summary: Cập nhật cài đặt
-      description: Nhận một đối tượng JSON phẳng gồm các cặp khóa-giá trị để thiết lập. Yêu cầu vai trò admin.
+      description: Nhận một đối tượng JSON phẳng chứa các khóa cài đặt được nhận dạng và có thể ghi. Yêu cầu `settings:write`; các khóa bảo mật và tuân thủ còn yêu cầu quyền hiệu lực tương ứng, cài đặt bí mật yêu cầu quyền quản trị viên đầy đủ, còn các khóa chuyên biệt hoặc do máy chủ quản lý chỉ có thể đọc.
       security:
         - bearerAuth: []
       requestBody:
@@ -6267,7 +6267,7 @@ paths:
       tags:
         - Settings
       summary: Lấy một cài đặt đơn lẻ
-      description: Truy xuất giá trị của một cài đặt đơn lẻ theo tên khóa của nó. Trả về giá trị và dấu thời gian cập nhật lần cuối.
+      description: Truy xuất một cài đặt được nhận dạng theo khóa. Trả về giá trị và dấu thời gian cập nhật lần cuối khi bên gọi có cả `settings:read` và quyền bổ sung của khóa đó.
       security:
         - bearerAuth: []
       parameters:
@@ -18396,7 +18396,10 @@ paths:
       tags:
         - Enterprise
       summary: Xuất cấu hình
-      description: Xuất cấu hình phiên bản đã ẩn thông tin nhạy cảm, vai trò tùy chỉnh và nhóm. Yêu cầu quyền system:health.
+      description: >
+        Xuất cấu hình phiên bản đã ẩn thông tin nhạy cảm, vai trò tùy chỉnh và nhóm. Yêu cầu quyền
+        toàn bộ quyền có hiệu lực của quản trị viên tích hợp sẵn. Vai trò tùy chỉnh không đủ điều kiện; khóa API
+        thiếu bất kỳ quyền quản trị viên nào cũng vậy.
       security:
         - bearerAuth: []
       responses:
@@ -18411,7 +18414,7 @@ paths:
         - Enterprise
       summary: Nhập cấu hình
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Nhập cấu hình phiên bản, vai trò tùy chỉnh và nhóm. Yêu cầu toàn bộ quyền có hiệu lực của quản trị viên tích hợp sẵn. Vai trò tùy chỉnh không đủ điều kiện; khóa API thiếu bất kỳ quyền quản trị viên nào cũng vậy.
       security:
         - bearerAuth: []
       responses:
@@ -19663,25 +19666,25 @@ x-i18n:
       provenance: machine
       outputHash: b726bf084992
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 897b6f0f9503
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: e273a1ca0985
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: e25578f7de79
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 4e206969c9ca
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 2b8c06f0fcf9
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 684a7f58039a
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: a54eb9428ba8
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 18ef15617bf5
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21631,13 +21634,17 @@ x-i18n:
       provenance: machine
       outputHash: 8858b7ade9c0
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 8794f9f12675
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 8f4838e98180
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 626289366f67
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 2cb62977f308
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.yaml

@@ -6070,7 +6070,7 @@ paths:
       operationId: getSettings
       tags: [Settings]
       summary: Get all settings
-      description: Retrieve all system settings as key-value pairs. Requires authentication.
+      description: Retrieve the system settings authorized by the caller's effective permissions. Requires `settings:read`; security, compliance, and full-administrator settings are filtered separately.
       security:
         - bearerAuth: []
       responses:
@@ -6095,7 +6095,7 @@ paths:
       operationId: updateSettings
       tags: [Settings]
       summary: Update settings
-      description: Accepts a flat JSON object of key-value pairs to set. Requires admin role.
+      description: Accepts a flat JSON object containing recognized, writable setting keys. Requires `settings:write`; security and compliance keys additionally require their matching effective permission, secrets require full-administrator authority, and dedicated or server-managed keys are read-only.
       security:
         - bearerAuth: []
       requestBody:
@@ -6142,7 +6142,7 @@ paths:
       operationId: getSetting
       tags: [Settings]
       summary: Get a single setting
-      description: Retrieve a single setting value by its key name. Returns the value and last-updated timestamp.
+      description: Retrieve a recognized setting by key. Returns the value and last-updated timestamp when the caller has both `settings:read` and the key's additional authority.
       security:
         - bearerAuth: []
       parameters:
@@ -18001,7 +18001,10 @@ paths:
       operationId: exportEnterpriseConfig
       tags: [Enterprise]
       summary: Export configuration
-      description: Export redacted instance configuration, custom roles, and teams. Requires system:health permission.
+      description: >
+        Export redacted instance configuration, custom roles, and teams. Requires
+        full effective built-in administrator authority; custom roles and API
+        keys missing any administrator permission do not qualify.
       security:
         - bearerAuth: []
       responses:

apps/api/src/openapi.zh-CN.yaml

@@ -6159,7 +6159,7 @@ paths:
       tags:
         - Settings
       summary: 获取所有设置
-      description: 以键值对形式检索所有系统设置。需要身份验证。
+      description: 获取调用方有效权限所允许的系统设置。需要 `settings:read`；安全、合规和完整管理员设置会分别进行筛选。
       security:
         - bearerAuth: []
       responses:
@@ -6185,7 +6185,7 @@ paths:
       tags:
         - Settings
       summary: 更新设置
-      description: 接受一个扁平的键值对 JSON 对象进行设置。需要管理员角色。
+      description: 接受包含已识别且可写设置键的扁平 JSON 对象。需要 `settings:write`；安全和合规键还需要相应的有效权限，机密设置需要完整管理员权限，专用键或服务器管理的键则为只读。
       security:
         - bearerAuth: []
       requestBody:
@@ -6232,7 +6232,7 @@ paths:
       tags:
         - Settings
       summary: 获取单个设置
-      description: 按键名检索单个设置值。返回该值和最后更新时间戳。
+      description: 按键获取已识别的设置。当调用方同时拥有 `settings:read` 和该键所需的额外权限时，返回设置值和最后更新时间戳。
       security:
         - bearerAuth: []
       parameters:
@@ -18322,7 +18322,7 @@ paths:
       tags:
         - Enterprise
       summary: 导出配置
-      description: 导出已脱敏的实例配置、自定义角色和团队。需要 system:health 权限。
+      description: 导出已脱敏的实例配置、自定义角色和团队。仅限拥有完整有效权限的内置管理员；自定义角色不符合要求，缺少任何管理员权限的 API 密钥也不符合要求。
       security:
         - bearerAuth: []
       responses:
@@ -18337,7 +18337,7 @@ paths:
         - Enterprise
       summary: 导入配置
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        导入实例配置、自定义角色和团队。仅限拥有完整有效权限的内置管理员；自定义角色不符合要求，缺少任何管理员权限的 API 密钥也不符合要求。
       security:
         - bearerAuth: []
       responses:
@@ -19589,25 +19589,25 @@ x-i18n:
       provenance: machine
       outputHash: 34f14c11223a
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 6dfb9d60666b
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 3e1f6ee5b1d7
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: cb2bec93a8f8
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: e3da0c2e704d
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: bdd5282d17d9
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 18771b9d6912
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 102be9d181fe
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: d8add1498f34
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21557,13 +21557,17 @@ x-i18n:
       provenance: machine
       outputHash: 429ea3af443d
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 845a7336b6b8
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 075f120a03fa
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: b48b6518293a
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 0a961b761696
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.zh-TW.yaml

@@ -6159,7 +6159,7 @@ paths:
       tags:
         - Settings
       summary: 取得所有設定
-      description: 以鍵值對取得所有系統設定。需要驗證。
+      description: 取得呼叫者有效權限所允許的系統設定。需要 `settings:read`；安全性、合規性與完整管理員設定會分別篩選。
       security:
         - bearerAuth: []
       responses:
@@ -6185,7 +6185,7 @@ paths:
       tags:
         - Settings
       summary: 更新設定
-      description: 接受一個扁平的鍵值對 JSON 物件進行設定。需要 admin 角色。
+      description: 接受包含已識別且可寫入設定 key 的扁平 JSON 物件。需要 `settings:write`；安全性與合規性 key 還需要相應的有效權限，機密設定需要完整管理員權限，而專用或由伺服器管理的 key 則為唯讀。
       security:
         - bearerAuth: []
       requestBody:
@@ -6232,7 +6232,7 @@ paths:
       tags:
         - Settings
       summary: 取得單一設定
-      description: 依鍵名取得單一設定值。回傳該值與最後更新時間戳記。
+      description: 依 key 取得已識別的設定。當呼叫者同時擁有 `settings:read` 與該 key 所需的額外權限時，回傳設定值與最後更新時間戳記。
       security:
         - bearerAuth: []
       parameters:
@@ -18322,7 +18322,7 @@ paths:
       tags:
         - Enterprise
       summary: 匯出設定
-      description: 匯出已遮蔽的執行個體設定、自訂角色與團隊。需要 system:health 權限。
+      description: 匯出已遮蔽的執行個體設定、自訂角色與團隊。僅限擁有完整有效權限的內建管理員；自訂角色不符合資格，缺少任何管理員權限的 API 金鑰也不符合資格。
       security:
         - bearerAuth: []
       responses:
@@ -18337,7 +18337,7 @@ paths:
         - Enterprise
       summary: 匯入設定
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        匯入執行個體設定、自訂角色與團隊。僅限擁有完整有效權限的內建管理員；自訂角色不符合資格，缺少任何管理員權限的 API 金鑰也不符合資格。
       security:
         - bearerAuth: []
       responses:
@@ -19589,25 +19589,25 @@ x-i18n:
       provenance: machine
       outputHash: fd62da472768
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 7ff5c6bc1894
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 4514a40964cb
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: ba85a03bad36
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: e38f18350ac0
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 93cb9b010e99
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 3183095c651e
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: db9f976f5a78
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: b2729853693a
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21557,13 +21557,17 @@ x-i18n:
       provenance: machine
       outputHash: 9263e6bbcdf7
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 4e22d51f3c31
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: c8a715849282
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: f5475897e4a5
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 0141629e0b36
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/routes/enterprise/config.ts

@@ -4,23 +4,16 @@ import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
 import { z } from "zod";
 import { db, schema } from "../../db/index.js";
 import { auditFromRequest } from "../../lib/audit.js";
-import { requireFullAdmin, requirePermission } from "../../permissions.js";
+import {
+  getSettingPolicy,
+  isConfigExportableSetting,
+  prepareSetting,
+  validateSettingsRuntimeConstraints,
+} from "../../lib/settings-policy.js";
+import { requireFullAdmin } from "../../permissions.js";
 
 const CONFIG_SCHEMA_VERSION = 1;
-
-const REDACTED_KEYS = new Set([
-  "cookie_secret",
-  "instance_id",
-  "siem_config",
-  "scim_token_hash",
-  "oidc_client_secret",
-  "saml_idp_certificate",
-  "siem_last_forwarded_at",
-  "siem_consecutive_failures",
-  "audit_archival_state",
-  "backup_last_completed",
-  "webhook_destinations",
-]);
+const POSTGRES_INTEGER_MAX = 2_147_483_647;
 
 const roleNameField = z
   .string()
@@ -73,21 +66,36 @@ const importedRoleSchema = z
   })
   .strict();
 
+const importedTeamSchema = z
+  .object({
+    name: z
+      .string()
+      .transform((value) => value.trim())
+      .pipe(z.string().min(1).max(50)),
+    storageQuota: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).nullable().optional(),
+    retentionHours: z.number().int().positive().max(POSTGRES_INTEGER_MAX).nullable().optional(),
+  })
+  .strict();
+
+const BUILTIN_ROLE_NAMES = new Set(["admin", "editor", "user", "disabled"]);
+
+function findDuplicateName(names: readonly string[], caseInsensitive = false): string | undefined {
+  const seen = new Set<string>();
+  for (const name of names) {
+    const identity = caseInsensitive ? name.toLowerCase() : name;
+    if (seen.has(identity)) return name;
+    seen.add(identity);
+  }
+  return undefined;
+}
+
 const importSchema = z.object({
   dryRun: z.boolean().default(false),
   config: z.object({
     configSchemaVersion: z.number(),
     settings: z.record(z.string()).optional(),
     roles: z.array(importedRoleSchema).optional(),
-    teams: z
-      .array(
-        z.object({
-          name: z.string(),
-          storageQuota: z.number().nullable().optional(),
-          retentionHours: z.number().nullable().optional(),
-        }),
-      )
-      .optional(),
+    teams: z.array(importedTeamSchema).optional(),
   }),
 });
 
@@ -96,7 +104,7 @@ export async function registerConfigRoutes(app: FastifyInstance): Promise<void>
   app.get(
     "/api/v1/enterprise/config/export",
     async (request: FastifyRequest, reply: FastifyReply) => {
-      const user = await requirePermission("system:health")(request, reply);
+      const user = await requireFullAdmin(request, reply);
       if (!user) return;
 
       // Enterprise feature gate
@@ -127,7 +135,7 @@ export async function registerConfigRoutes(app: FastifyInstance): Promise<void>
       const allSettings = await db.select().from(schema.settings);
       const settingsMap = config.settings as Record<string, string>;
       for (const s of allSettings) {
-        if (!REDACTED_KEYS.has(s.key)) {
+        if (isConfigExportableSetting(s.key)) {
           settingsMap[s.key] = s.value;
         }
       }
@@ -201,38 +209,83 @@ export async function registerConfigRoutes(app: FastifyInstance): Promise<void>
         });
       }
 
-      // Dependency validation
-      const validationErrors: string[] = [];
+      const duplicateRoleName = findDuplicateName(config.roles?.map((role) => role.name) ?? []);
+      if (duplicateRoleName) {
+        return reply.status(400).send({
+          error: `Duplicate role name "${duplicateRoleName}" in config import`,
+          code: "VALIDATION_ERROR",
+        });
+      }
+      const reservedRoleName = config.roles?.find((role) =>
+        BUILTIN_ROLE_NAMES.has(role.name),
+      )?.name;
+      if (reservedRoleName) {
+        return reply.status(400).send({
+          error: `Built-in role "${reservedRoleName}" cannot be imported as a custom role`,
+          code: "VALIDATION_ERROR",
+        });
+      }
 
+      const duplicateTeamName = findDuplicateName(
+        config.teams?.map((team) => team.name) ?? [],
+        true,
+      );
+      if (duplicateTeamName) {
+        return reply.status(400).send({
+          error: `Duplicate team name "${duplicateTeamName}" in config import`,
+          code: "VALIDATION_ERROR",
+        });
+      }
+
+      const preparedSettings: Array<{ key: string; value: string }> = [];
+      const preparedKeys = new Set<string>();
       if (config.settings) {
-        // SSO enforcement requires OIDC or SAML to be configured
-        if (config.settings.ssoEnforcement === "true") {
-          const hasOidc = config.settings.oidcIssuer || config.settings.oidcClientId;
-          const hasSaml = config.settings.samlIdpUrl || config.settings.samlEntityId;
-          if (!hasOidc && !hasSaml) {
-            validationErrors.push(
-              "ssoEnforcement is enabled but no OIDC or SAML provider is configured in the import",
-            );
+        for (const [requestedKey, value] of Object.entries(config.settings)) {
+          const policy = getSettingPolicy(requestedKey);
+          if (!policy) {
+            return reply.status(400).send({
+              error: `Unknown setting "${requestedKey}"`,
+              code: "UNKNOWN_SETTING",
+            });
+          }
+          if (policy.write === "none") {
+            return reply.status(400).send({
+              error: `Setting "${requestedKey}" cannot be modified through config import`,
+              code: "READONLY_SETTING",
+            });
           }
-        }
 
-        // IP allowlist must have at least one CIDR
-        if (config.settings.ipAllowlist) {
-          try {
-            const cidrs = JSON.parse(config.settings.ipAllowlist);
-            if (!Array.isArray(cidrs) || cidrs.length === 0) {
-              validationErrors.push("ipAllowlist is set but contains no CIDR entries");
-            }
-          } catch {
-            validationErrors.push("ipAllowlist contains invalid JSON");
+          // Exported secrets are omitted and older exports may still contain a
+          // redaction placeholder. Preserve the established skip behavior.
+          if (policy.redacted) continue;
+
+          const prepared = prepareSetting(requestedKey, value);
+          if (!prepared.success) {
+            return reply.status(400).send({
+              error: prepared.error,
+              code: prepared.code,
+              ...(prepared.details ? { details: prepared.details } : {}),
+            });
           }
+          if (preparedKeys.has(prepared.key)) {
+            return reply.status(400).send({
+              error: `Setting "${requestedKey}" duplicates "${prepared.key}" in the same import`,
+              code: "VALIDATION_ERROR",
+            });
+          }
+          preparedKeys.add(prepared.key);
+          preparedSettings.push({ key: prepared.key, value: prepared.value });
         }
       }
 
-      if (validationErrors.length > 0) {
-        return reply.status(400).send({
-          error: "Dependency validation failed",
-          validationErrors,
+      const runtimeValidation = await validateSettingsRuntimeConstraints(preparedSettings);
+      if (!runtimeValidation.success) {
+        return reply.status(runtimeValidation.statusCode).send({
+          error: runtimeValidation.error,
+          code: runtimeValidation.code,
+          ...(runtimeValidation.validationErrors
+            ? { validationErrors: runtimeValidation.validationErrors }
+            : {}),
         });
       }
 
@@ -248,13 +301,11 @@ export async function registerConfigRoutes(app: FastifyInstance): Promise<void>
       const rolesToUpsert: Array<{ name: string; action: string }> = [];
       const teamsToUpsert: Array<{ name: string; action: string }> = [];
 
-      if (config.settings) {
+      if (preparedSettings.length > 0) {
         const existingSettings = await db.select().from(schema.settings);
         const existingKeys = new Set(existingSettings.map((s) => s.key));
 
-        for (const key of Object.keys(config.settings)) {
-          // Skip redacted keys in import as well
-          if (REDACTED_KEYS.has(key)) continue;
+        for (const { key } of preparedSettings) {
           settingsToUpdate.push({
             key,
             action: existingKeys.has(key) ? "update" : "create",
@@ -281,12 +332,12 @@ export async function registerConfigRoutes(app: FastifyInstance): Promise<void>
 
       if (config.teams) {
         const existingTeams = await db.select().from(schema.teams);
-        const existingTeamNames = new Set(existingTeams.map((t) => t.name));
+        const existingTeamNames = new Set(existingTeams.map((team) => team.name.toLowerCase()));
 
         for (const team of config.teams) {
           teamsToUpsert.push({
             name: team.name,
-            action: existingTeamNames.has(team.name) ? "update" : "create",
+            action: existingTeamNames.has(team.name.toLowerCase()) ? "update" : "create",
           });
         }
         changes.teams = teamsToUpsert.length;
@@ -307,85 +358,86 @@ export async function registerConfigRoutes(app: FastifyInstance): Promise<void>
       // Apply changes
       const now = new Date();
 
-      // Upsert settings
-      if (config.settings) {
-        const existingSettings = await db.select().from(schema.settings);
-        const existingKeys = new Set(existingSettings.map((s) => s.key));
+      await db.transaction(async (tx) => {
+        // Keep settings, roles, and teams in one transaction so any database
+        // conflict rolls back the complete imported configuration.
+        if (preparedSettings.length > 0) {
+          const existingSettings = await tx.select().from(schema.settings);
+          const existingKeys = new Set(existingSettings.map((setting) => setting.key));
 
-        for (const [key, value] of Object.entries(config.settings)) {
-          if (REDACTED_KEYS.has(key)) continue;
-
-          if (existingKeys.has(key)) {
-            await db
-              .update(schema.settings)
-              .set({ value, updatedAt: now })
-              .where(eq(schema.settings.key, key));
-          } else {
-            await db.insert(schema.settings).values({ key, value });
+          for (const { key, value } of preparedSettings) {
+            if (existingKeys.has(key)) {
+              await tx
+                .update(schema.settings)
+                .set({ value, updatedAt: now })
+                .where(eq(schema.settings.key, key));
+            } else {
+              await tx.insert(schema.settings).values({ key, value });
+            }
           }
         }
-      }
 
-      // Upsert custom roles
-      if (config.roles) {
-        const existingRoles = await db
-          .select()
-          .from(schema.roles)
-          .where(eq(schema.roles.isBuiltin, false));
-        const existingRoleMap = new Map(existingRoles.map((r) => [r.name, r]));
+        if (config.roles) {
+          const existingRoles = await tx
+            .select()
+            .from(schema.roles)
+            .where(eq(schema.roles.isBuiltin, false));
+          const existingRoleMap = new Map(existingRoles.map((role) => [role.name, role]));
 
-        for (const role of config.roles) {
-          const existing = existingRoleMap.get(role.name);
-          if (existing) {
-            await db
-              .update(schema.roles)
-              .set({
+          for (const role of config.roles) {
+            const existing = existingRoleMap.get(role.name);
+            if (existing) {
+              await tx
+                .update(schema.roles)
+                .set({
+                  description: role.description ?? "",
+                  permissions: role.permissions,
+                  toolPermissions: role.toolPermissions ?? null,
+                  updatedAt: now,
+                })
+                .where(eq(schema.roles.id, existing.id));
+            } else {
+              await tx.insert(schema.roles).values({
+                id: randomUUID(),
+                name: role.name,
                 description: role.description ?? "",
                 permissions: role.permissions,
                 toolPermissions: role.toolPermissions ?? null,
+                isBuiltin: false,
+                createdAt: now,
                 updatedAt: now,
-              })
-              .where(eq(schema.roles.id, existing.id));
-          } else {
-            await db.insert(schema.roles).values({
-              id: randomUUID(),
-              name: role.name,
-              description: role.description ?? "",
-              permissions: role.permissions,
-              toolPermissions: role.toolPermissions ?? null,
-              isBuiltin: false,
-              createdAt: now,
-              updatedAt: now,
-            });
+              });
+            }
           }
         }
-      }
 
-      // Upsert teams
-      if (config.teams) {
-        const existingTeams = await db.select().from(schema.teams);
-        const existingTeamMap = new Map(existingTeams.map((t) => [t.name, t]));
+        if (config.teams) {
+          const existingTeams = await tx.select().from(schema.teams);
+          const existingTeamMap = new Map(
+            existingTeams.map((team) => [team.name.toLowerCase(), team]),
+          );
 
-        for (const team of config.teams) {
-          const existing = existingTeamMap.get(team.name);
-          if (existing) {
-            await db
-              .update(schema.teams)
-              .set({
+          for (const team of config.teams) {
+            const existing = existingTeamMap.get(team.name.toLowerCase());
+            if (existing) {
+              await tx
+                .update(schema.teams)
+                .set({
+                  storageQuota: team.storageQuota ?? null,
+                  retentionHours: team.retentionHours ?? null,
+                })
+                .where(eq(schema.teams.id, existing.id));
+            } else {
+              await tx.insert(schema.teams).values({
+                id: randomUUID(),
+                name: team.name,
                 storageQuota: team.storageQuota ?? null,
                 retentionHours: team.retentionHours ?? null,
-              })
-              .where(eq(schema.teams.id, existing.id));
-          } else {
-            await db.insert(schema.teams).values({
-              id: randomUUID(),
-              name: team.name,
-              storageQuota: team.storageQuota ?? null,
-              retentionHours: team.retentionHours ?? null,
-            });
+              });
+            }
           }
         }
-      }
+      });
 
       await auditFromRequest(request)("CONFIG_IMPORTED", {
         adminId: user.id,

apps/api/src/routes/settings.ts

@@ -13,49 +13,37 @@ import { env } from "../config.js";
 import { db, schema } from "../db/index.js";
 import { auditFromRequest } from "../lib/audit.js";
 import { decrypt, encrypt, isEncrypted } from "../lib/encryption.js";
-import { requirePermission } from "../permissions.js";
+import {
+  getSettingPolicy,
+  prepareSetting,
+  type SettingAuthority,
+  validateSettingsRuntimeConstraints,
+} from "../lib/settings-policy.js";
+import {
+  getEffectivePermissions,
+  isFullEffectiveAdmin,
+  requirePermission,
+} from "../permissions.js";
 
 const settingsBodySchema = z.record(z.string().min(1), z.unknown());
 
 const HTML_TAG_PATTERN = /<[a-z/!?][^>]*>/i;
 
-const SENSITIVE_KEYS = new Set([
-  "cookie_secret",
-  "instance_id",
-  "oidc_client_secret",
-  "saml_idp_certificate",
-  "scim_token_hash",
-  "siem_config",
-  "siem_webhook_auth",
-  "sqlite_import",
-  "webhook_destinations",
-]);
-
-const ENCRYPTED_KEYS = new Set([
-  "cookie_secret",
-  "oidc_client_secret",
-  "saml_idp_certificate",
-  "scim_token_hash",
-  "siem_webhook_auth",
-]);
-
-const REDACTED_KEYS = new Set([
-  "cookie_secret",
-  "oidc_client_secret",
-  "saml_idp_certificate",
-  "scim_token_hash",
-  "siem_config",
-  "siem_webhook_auth",
-  "webhook_destinations",
-]);
-
-const READONLY_KEYS = new Set(["cookie_secret", "instance_id"]);
-
 async function encryptIfSensitive(key: string, value: string): Promise<string> {
-  if (!env.DATA_ENCRYPTION_KEY || !ENCRYPTED_KEYS.has(key)) return value;
+  if (!env.DATA_ENCRYPTION_KEY || !getSettingPolicy(key)?.encrypted) return value;
   return encrypt(value, env.DATA_ENCRYPTION_KEY);
 }
 
+function hasSettingAuthority(
+  authority: SettingAuthority,
+  effectivePermissions: ReadonlySet<string>,
+  fullAdmin: boolean,
+): boolean {
+  if (authority === "none") return false;
+  if (authority === "full-admin") return fullAdmin;
+  return effectivePermissions.has(authority);
+}
+
 async function decryptIfNeeded(value: string): Promise<string> {
   if (!isEncrypted(value)) return value;
   if (!env.DATA_ENCRYPTION_KEY) return value;
@@ -77,13 +65,16 @@ export async function settingsRoutes(app: FastifyInstance): Promise<void> {
       const user = await requirePermission("settings:read")(request, reply);
       if (!user) return;
 
-      const isAdmin = user.role === "admin";
+      const effectivePermissions = new Set<string>(await getEffectivePermissions(user));
+      const fullAdmin = await isFullEffectiveAdmin(user);
       const rows = await db.select().from(schema.settings);
 
       const settings: Record<string, string> = {};
       for (const row of rows) {
-        if (!isAdmin && SENSITIVE_KEYS.has(row.key)) continue;
-        if (REDACTED_KEYS.has(row.key)) {
+        const policy = getSettingPolicy(row.key);
+        if (!policy || !hasSettingAuthority(policy.read, effectivePermissions, fullAdmin)) continue;
+        if (policy.storageKey && policy.storageKey !== row.key) continue;
+        if (policy.redacted) {
           settings[row.key] = "********";
           continue;
         }
@@ -95,7 +86,7 @@ export async function settingsRoutes(app: FastifyInstance): Promise<void> {
   );
 
   // PUT /api/v1/settings — Save settings (admin only)
-  app.put("/api/v1/settings", async (request: FastifyRequest, reply: FastifyReply) => {
+  const updateSettings = async (request: FastifyRequest, reply: FastifyReply) => {
     const admin = await requirePermission("settings:write")(request, reply);
     if (!admin) return;
 
@@ -107,60 +98,87 @@ export async function settingsRoutes(app: FastifyInstance): Promise<void> {
       });
     }
     const body = parsed.data;
+    const effectivePermissions = new Set<string>(await getEffectivePermissions(admin));
+    const fullAdmin = await isFullEffectiveAdmin(admin);
 
     // Pass 1: validate all entries before writing any
     const entries: Array<{ key: string; strValue: string }> = [];
+    const canonicalKeys = new Set<string>();
 
-    for (const [key, value] of Object.entries(body)) {
-      if (typeof key !== "string" || key.length === 0) continue;
+    for (const [requestedKey, value] of Object.entries(body)) {
+      if (typeof requestedKey !== "string" || requestedKey.length === 0) continue;
+      const rawValue = typeof value === "string" ? value : (JSON.stringify(value) ?? "");
 
-      const strValue = typeof value === "string" ? value : JSON.stringify(value);
-
-      if (HTML_TAG_PATTERN.test(key) || HTML_TAG_PATTERN.test(strValue)) {
+      if (HTML_TAG_PATTERN.test(requestedKey) || HTML_TAG_PATTERN.test(rawValue)) {
         return reply.status(400).send({
           error: "Settings keys and values must not contain HTML tags",
           code: "VALIDATION_ERROR",
         });
       }
 
+      const prepared = prepareSetting(requestedKey, value);
+      if (!prepared.success) {
+        return reply.status(400).send({
+          error: prepared.error,
+          code: prepared.code,
+          ...(prepared.details ? { details: prepared.details } : {}),
+        });
+      }
+
+      const { key, value: strValue, policy } = prepared;
+
+      if (policy.write === "none") {
+        return reply.status(400).send({
+          error: `Setting "${requestedKey}" cannot be modified via the API`,
+          code: "READONLY_SETTING",
+        });
+      }
+
+      if (!hasSettingAuthority(policy.write, effectivePermissions, fullAdmin)) {
+        const fullAdminRequired = policy.write === "full-admin";
+        return reply.status(403).send({
+          error: fullAdminRequired
+            ? "Full administrator authority required"
+            : `Setting "${requestedKey}" requires ${policy.write}`,
+          code: fullAdminRequired ? "ESCALATION_DENIED" : "FORBIDDEN",
+        });
+      }
+
       // A redacted secret comes back from GET as the literal mask, so a client that
       // reads settings, edits one field, and saves the whole object echoes the mask
       // back. Treat the mask as "leave this secret unchanged" instead of encrypting
       // and persisting "********", which would destroy the real secret (e.g. the OIDC
       // client secret or SIEM webhook auth, neither of which is read-only).
-      if (REDACTED_KEYS.has(key) && strValue === "********") {
+      if (policy.redacted && strValue === "********") {
         continue;
       }
 
-      if (READONLY_KEYS.has(key)) {
+      if (canonicalKeys.has(key)) {
         return reply.status(400).send({
-          error: `Setting "${key}" cannot be modified via the API`,
-          code: "READONLY_SETTING",
+          error: `Setting "${requestedKey}" duplicates "${key}" in the same request`,
+          code: "VALIDATION_ERROR",
         });
       }
-
-      // Enforcing MFA requires a way to actually enroll, which is gated behind
-      // the "mfa" enterprise feature. Letting this save through on an unlicensed
-      // instance creates a login rule nobody can satisfy (snapotter-hq/SnapOtter#515).
-      if (key === "mfaPolicy" && (strValue === "admins_only" || strValue === "required")) {
-        let mfaLicensed = false;
-        try {
-          const { isFeatureEnabled } = await import("@snapotter/enterprise");
-          mfaLicensed = isFeatureEnabled("mfa");
-        } catch {
-          // Enterprise package not available
-        }
-        if (!mfaLicensed) {
-          return reply.status(403).send({
-            error: "MFA requires an enterprise license",
-            code: "FEATURE_NOT_LICENSED",
-          });
-        }
-      }
+      canonicalKeys.add(key);
 
       entries.push({ key, strValue });
     }
 
+    // Enforcing MFA requires a licensed enrollment path. Keep this shared with
+    // config import so no settings write path can create an unsatisfiable login rule.
+    const runtimeValidation = await validateSettingsRuntimeConstraints(
+      entries.map(({ key, strValue }) => ({ key, value: strValue })),
+    );
+    if (!runtimeValidation.success) {
+      return reply.status(runtimeValidation.statusCode).send({
+        error: runtimeValidation.error,
+        code: runtimeValidation.code,
+        ...(runtimeValidation.validationErrors
+          ? { validationErrors: runtimeValidation.validationErrors }
+          : {}),
+      });
+    }
+
     // Pass 2: write all entries now that all have passed validation
     const now = new Date();
 
@@ -206,7 +224,12 @@ export async function settingsRoutes(app: FastifyInstance): Promise<void> {
     }
 
     return reply.send({ ok: true, updatedCount: entries.length });
-  });
+  };
+  app.put(
+    "/api/v1/settings",
+    { config: { rateLimit: { max: 60, timeWindow: "1 minute" } } },
+    updateSettings,
+  );
 
   // GET /api/v1/settings/:key — Get a specific setting
   app.get(
@@ -217,12 +240,24 @@ export async function settingsRoutes(app: FastifyInstance): Promise<void> {
       if (!user) return;
 
       const { key } = request.params;
-
-      if (SENSITIVE_KEYS.has(key) && user.role !== "admin") {
+      const policy = getSettingPolicy(key);
+      if (!policy) {
+        return reply.status(404).send({
+          error: `Setting "${key}" not found`,
+          code: "NOT_FOUND",
+        });
+      }
+      const effectivePermissions = new Set<string>(await getEffectivePermissions(user));
+      const fullAdmin = await isFullEffectiveAdmin(user);
+      if (!hasSettingAuthority(policy.read, effectivePermissions, fullAdmin)) {
         return reply.status(403).send({ error: "Forbidden", code: "FORBIDDEN" });
       }
 
-      const [row] = await db.select().from(schema.settings).where(eq(schema.settings.key, key));
+      const storageKey = policy.storageKey ?? key;
+      const [row] = await db
+        .select()
+        .from(schema.settings)
+        .where(eq(schema.settings.key, storageKey));
 
       if (!row) {
         return reply.status(404).send({
@@ -232,8 +267,8 @@ export async function settingsRoutes(app: FastifyInstance): Promise<void> {
       }
 
       return reply.send({
-        key: row.key,
-        value: REDACTED_KEYS.has(row.key) ? "********" : await decryptIfNeeded(row.value),
+        key: storageKey,
+        value: policy.redacted ? "********" : await decryptIfNeeded(row.value),
         updatedAt: row.updatedAt.toISOString(),
       });
     },

apps/demo/src/mock-api.ts

@@ -467,7 +467,7 @@ const db: {
     ssoBreakGlassUsername: "",
     passwordMinLength: "8",
     passwordRequireUppercase: "true",
-    passwordRequireNumber: "true",
+    passwordRequireDigit: "true",
     passwordRequireSpecial: "false",
     disabledTools: "[]",
     enableExperimentalTools: "false",

apps/docs/api/rest.md

@@ -530,7 +530,7 @@ To auto-save a tool result to the library, include `fileId` as a multipart form
 
 ## Settings {#settings}
 
-Runtime key-value configuration (read by any authenticated user, write by admin only).
+Runtime configuration uses a closed set of recognized keys. Reading requires `settings:read` and writing requires `settings:write`; security and compliance keys additionally require `security:manage` or `compliance:manage`. Secret settings require full-administrator authority, while credentials and state owned by dedicated endpoints are read-only here. Bulk updates are validated before any value is written.
 
 | Method | Path | Description |
 |--------|------|-------------|
@@ -538,7 +538,7 @@ Runtime key-value configuration (read by any authenticated user, write by admin
 | `PUT` | `/api/v1/settings` | Bulk update settings (JSON body with key-value pairs) |
 | `GET` | `/api/v1/settings/:key` | Get a specific setting by key |
 
-Known keys: `disabledTools` (JSON array of tool IDs), `enableExperimentalTools` (bool string), `loginAttemptLimit` (number).
+Representative keys: `disabledTools` (JSON array of tool IDs), `enableExperimentalTools` (boolean), `loginAttemptLimit` (security policy), and `auditRetentionDays` (compliance policy). Unknown keys are rejected.
 
 ## Preferences {#preferences}
 
@@ -640,7 +640,7 @@ These routes are license-gated by their related enterprise feature. They still r
 | Method | Path | Access | Description |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | Admin (`audit:read`) | Export audit entries as JSON or CSV with filters |
-| `GET` | `/api/v1/enterprise/config/export` | Admin (`system:health`) | Export redacted instance config, custom roles, and teams |
+| `GET` | `/api/v1/enterprise/config/export` | Full built-in admin | Export redacted instance config, custom roles, and teams |
 | `POST` | `/api/v1/enterprise/config/import` | Full built-in admin | Import config, with optional dry run |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Read configured CIDR allowlist |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Update CIDR allowlist with self-lockout prevention |

apps/docs/ar/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "مرجع REST API الكامل. نقاط نهاية الأدوات، والمعالجة الدفعية، وخطوط المعالجة، ومكتبة الملفات، والمصادقة، والفرق، وعمليات الإدارة."
 i18n_output_hash: 89f2ba5743eb
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ data: {"jobId":"...","type":"batch","status":"processing","completedFiles":2,"to
 
 ## الإعدادات {#settings}
 
-تهيئة مفتاح-قيمة أثناء التشغيل (يقرؤها أي مستخدم مصادَق، ويكتبها المسؤول فقط).
+يستخدم تكوين وقت التشغيل مجموعة مغلقة من المفاتيح المعروفة. تتطلب القراءة `settings:read` وتتطلب الكتابة `settings:write`؛ كما تتطلب مفاتيح الأمان والامتثال على التوالي `security:manage` أو `compliance:manage`. تتطلب الإعدادات السرية صلاحية مسؤول كاملة، بينما تكون بيانات الاعتماد والحالة التي تديرها نقاط نهاية مخصصة للقراءة فقط هنا. يتم التحقق من صحة التحديثات المجمّعة قبل كتابة أي قيمة.
 
 | الطريقة | المسار | الوصف |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ data: {"jobId":"...","type":"batch","status":"processing","completedFiles":2,"to
 | `PUT` | `/api/v1/settings` | تحديث الإعدادات جماعيًا (نص JSON مع أزواج مفتاح-قيمة) |
 | `GET` | `/api/v1/settings/:key` | الحصول على إعداد محدد بالمفتاح |
 
-المفاتيح المعروفة: `disabledTools` (مصفوفة JSON من معرّفات الأدوات)، `enableExperimentalTools` (سلسلة منطقية)، `loginAttemptLimit` (رقم).
+مفاتيح نموذجية: `disabledTools` (مصفوفة JSON من معرّفات الأدوات)، و`enableExperimentalTools` (قيمة منطقية)، و`loginAttemptLimit` (سياسة أمان)، و`auditRetentionDays` (سياسة امتثال). تُرفض المفاتيح غير المعروفة.
 
 ## التفضيلات {#preferences}
 
@@ -636,11 +636,13 @@ curl -X POST http://localhost:1349/api/v1/admin/features/import \
 
 هذه المسارات مقيَّدة بالترخيص عبر ميزة المؤسسة المرتبطة بها. وما زالت تتطلب إذن SnapOtter المُدرَج.
 
+**المسؤول المضمّن بكامل الصلاحيات** يعني أن الجهة المصادق عليها تحمل دور `admin` وتمتلك مجموعة أذونات المسؤول الفعّالة بالكامل. لا يتأهل نطاق مفتاح API إذا أغفل أي إذن من أذونات المسؤول.
+
 | الطريقة | المسار | الوصول | الوصف |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | مسؤول (`audit:read`) | تصدير مدخلات التدقيق كـ JSON أو CSV مع مرشحات |
-| `GET` | `/api/v1/enterprise/config/export` | مسؤول (`system:health`) | تصدير تهيئة مثيل الخادم المُنقَّحة والأدوار المخصصة والفرق |
-| `POST` | `/api/v1/enterprise/config/import` | مسؤول (`system:health`) | استيراد التهيئة، مع تشغيل تجريبي اختياري |
+| `GET` | `/api/v1/enterprise/config/export` | مسؤول مضمّن بكامل الصلاحيات | تصدير تهيئة مثيل الخادم المُنقَّحة والأدوار المخصصة والفرق |
+| `POST` | `/api/v1/enterprise/config/import` | مسؤول مضمّن بكامل الصلاحيات | استيراد التهيئة، مع تشغيل تجريبي اختياري |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | مسؤول (`security:manage`) | قراءة قائمة CIDR المسموح بها المهيَّأة |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | مسؤول (`security:manage`) | تحديث قائمة CIDR المسموح بها مع منع الإقفال الذاتي |
 | `GET` | `/api/v1/enterprise/legal-hold` | مسؤول (`compliance:manage`) | سرد الحجوزات القانونية للمستخدمين والفرق |

apps/docs/de/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "Vollständige REST-API-Referenz. Tool-Endpunkte, Stapelverarbeitung, Pipelines, Dateibibliothek, Authentifizierung, Teams und Admin-Operationen."
 i18n_output_hash: 8efd33eca67a
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ Um ein Tool-Ergebnis automatisch in der Bibliothek zu speichern, fügen Sie `fil
 
 ## Einstellungen {#settings}
 
-Laufzeit-Schlüssel-Wert-Konfiguration (von jedem authentifizierten Benutzer lesbar, nur vom Admin schreibbar).
+Die Laufzeitkonfiguration verwendet eine geschlossene Menge erkannter Schlüssel. Zum Lesen ist `settings:read` und zum Schreiben `settings:write` erforderlich; Sicherheits- und Compliance-Schlüssel erfordern zusätzlich `security:manage` bzw. `compliance:manage`. Geheime Einstellungen erfordern die vollständige Administratorberechtigung, während Zugangsdaten und Zustände, die von dedizierten Endpunkten verwaltet werden, hier schreibgeschützt sind. Massenaktualisierungen werden vollständig validiert, bevor ein Wert geschrieben wird.
 
 | Methode | Pfad | Beschreibung |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ Laufzeit-Schlüssel-Wert-Konfiguration (von jedem authentifizierten Benutzer les
 | `PUT` | `/api/v1/settings` | Einstellungen massenhaft aktualisieren (JSON-Body mit Schlüssel-Wert-Paaren) |
 | `GET` | `/api/v1/settings/:key` | Eine bestimmte Einstellung nach Schlüssel abrufen |
 
-Bekannte Schlüssel: `disabledTools` (JSON-Array von Tool-IDs), `enableExperimentalTools` (bool-String), `loginAttemptLimit` (Zahl).
+Beispielschlüssel: `disabledTools` (JSON-Array von Tool-IDs), `enableExperimentalTools` (boolescher Wert), `loginAttemptLimit` (Sicherheitsrichtlinie) und `auditRetentionDays` (Compliance-Richtlinie). Unbekannte Schlüssel werden abgelehnt.
 
 ## Einstellungen (Preferences) {#preferences}
 
@@ -636,11 +636,13 @@ Operative Endpunkte für Observability, Support, Nutzungsberichte und Backup-Sta
 
 Diese Routen sind durch das zugehörige Enterprise-Feature lizenzgesteuert. Sie erfordern weiterhin die aufgeführte SnapOtter-Berechtigung.
 
+**Vollständiger integrierter Admin** bedeutet, dass der authentifizierte Akteur die Rolle `admin` und den vollständigen effektiven Satz von Admin-Berechtigungen besitzt. Ein API-Schlüsselbereich, der auch nur eine Admin-Berechtigung auslässt, erfüllt die Anforderungen nicht.
+
 | Methode | Pfad | Zugriff | Beschreibung |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | Admin (`audit:read`) | Audit-Einträge als JSON oder CSV mit Filtern exportieren |
-| `GET` | `/api/v1/enterprise/config/export` | Admin (`system:health`) | Redigierte Instanzkonfiguration, benutzerdefinierte Rollen und Teams exportieren |
-| `POST` | `/api/v1/enterprise/config/import` | Admin (`system:health`) | Konfiguration importieren, mit optionalem Probelauf |
+| `GET` | `/api/v1/enterprise/config/export` | Vollständiger integrierter Admin | Redigierte Instanzkonfiguration, benutzerdefinierte Rollen und Teams exportieren |
+| `POST` | `/api/v1/enterprise/config/import` | Vollständiger integrierter Admin | Konfiguration importieren, mit optionalem Probelauf |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Konfigurierte CIDR-Erlaubnisliste lesen |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | CIDR-Erlaubnisliste mit Selbstsperrungs-Prävention aktualisieren |
 | `GET` | `/api/v1/enterprise/legal-hold` | Admin (`compliance:manage`) | Legal Holds für Benutzer und Teams auflisten |

apps/docs/es/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "Referencia completa de la API REST. Endpoints de herramientas, procesamiento por lotes, pipelines, biblioteca de archivos, autenticación, equipos y operaciones de administración."
 i18n_output_hash: a9129e12a29c
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ Para guardar automáticamente el resultado de una herramienta en la biblioteca,
 
 ## Ajustes {#settings}
 
-Configuración clave-valor en tiempo de ejecución (legible por cualquier usuario autenticado, escribible solo por el administrador).
+La configuración en tiempo de ejecución utiliza un conjunto cerrado de claves reconocidas. La lectura requiere `settings:read` y la escritura, `settings:write`; las claves de seguridad y cumplimiento requieren además `security:manage` o `compliance:manage`, respectivamente. Los ajustes secretos requieren autoridad de administrador pleno, mientras que las credenciales y el estado gestionados por endpoints específicos son aquí de solo lectura. Las actualizaciones en bloque se validan antes de escribir cualquier valor.
 
 | Método | Ruta | Descripción |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ Configuración clave-valor en tiempo de ejecución (legible por cualquier usuari
 | `PUT` | `/api/v1/settings` | Actualizar ajustes en bloque (cuerpo JSON con pares clave-valor) |
 | `GET` | `/api/v1/settings/:key` | Obtener un ajuste específico por clave |
 
-Claves conocidas: `disabledTools` (array JSON de ID de herramienta), `enableExperimentalTools` (cadena bool), `loginAttemptLimit` (número).
+Claves representativas: `disabledTools` (array JSON de ID de herramientas), `enableExperimentalTools` (booleano), `loginAttemptLimit` (política de seguridad) y `auditRetentionDays` (política de cumplimiento). Las claves desconocidas se rechazan.
 
 ## Preferencias {#preferences}
 
@@ -636,11 +636,13 @@ Endpoints operativos para observabilidad, soporte, informes de uso y estado de l
 
 Estas rutas están limitadas por licencia según su función enterprise relacionada. Aun así requieren el permiso de SnapOtter indicado.
 
+**Administrador integrado completo** significa que el actor autenticado tiene el rol `admin` y el conjunto efectivo completo de permisos de administrador. Un ámbito de clave de API que omita cualquier permiso de administrador no cumple el requisito.
+
 | Método | Ruta | Acceso | Descripción |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | Admin (`audit:read`) | Exportar entradas de auditoría como JSON o CSV con filtros |
-| `GET` | `/api/v1/enterprise/config/export` | Admin (`system:health`) | Exportar la configuración de instancia censurada, los roles personalizados y los equipos |
-| `POST` | `/api/v1/enterprise/config/import` | Admin (`system:health`) | Importar configuración, con ejecución de prueba opcional |
+| `GET` | `/api/v1/enterprise/config/export` | Administrador integrado completo | Exportar la configuración de instancia censurada, los roles personalizados y los equipos |
+| `POST` | `/api/v1/enterprise/config/import` | Administrador integrado completo | Importar configuración, con ejecución de prueba opcional |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Leer la lista de permitidos CIDR configurada |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Actualizar la lista de permitidos CIDR con prevención de autobloqueo |
 | `GET` | `/api/v1/enterprise/legal-hold` | Admin (`compliance:manage`) | Listar las retenciones legales de usuarios y equipos |

apps/docs/fr/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "Référence complète de l'API REST. Points de terminaison des outils, traitement par lots, pipelines, bibliothèque de fichiers, authentification, équipes et opérations d'administration."
 i18n_output_hash: 450fd529e479
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ Pour enregistrer automatiquement le résultat d'un outil dans la bibliothèque,
 
 ## Paramètres {#settings}
 
-Configuration clé-valeur d'exécution (lecture par tout utilisateur authentifié, écriture par l'administrateur uniquement).
+La configuration d'exécution utilise un ensemble fermé de clés reconnues. La lecture nécessite `settings:read` et l'écriture `settings:write` ; les clés de sécurité et de conformité nécessitent en plus, respectivement, `security:manage` ou `compliance:manage`. Les paramètres secrets nécessitent les droits d'un administrateur complet, tandis que les identifiants et l'état gérés par des endpoints dédiés sont ici en lecture seule. Les mises à jour groupées sont validées avant l'écriture de toute valeur.
 
 | Méthode | Chemin | Description |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ Configuration clé-valeur d'exécution (lecture par tout utilisateur authentifi
 | `PUT` | `/api/v1/settings` | Met à jour en masse les paramètres (corps JSON avec des paires clé-valeur) |
 | `GET` | `/api/v1/settings/:key` | Récupère un paramètre spécifique par clé |
 
-Clés connues : `disabledTools` (tableau JSON d'ID d'outils), `enableExperimentalTools` (chaîne booléenne), `loginAttemptLimit` (nombre).
+Clés représentatives : `disabledTools` (tableau JSON d'ID d'outils), `enableExperimentalTools` (booléen), `loginAttemptLimit` (politique de sécurité) et `auditRetentionDays` (politique de conformité). Les clés inconnues sont rejetées.
 
 ## Préférences {#preferences}
 
@@ -636,11 +636,13 @@ Points de terminaison opérationnels pour l'observabilité, l'assistance, les ra
 
 Ces routes sont verrouillées par licence selon leur fonctionnalité d'entreprise associée. Elles exigent toujours l'autorisation SnapOtter indiquée.
 
+**Administrateur intégré complet** signifie que l'acteur authentifié possède le rôle `admin` et l'ensemble complet des permissions d'administrateur effectives. Une portée de clé API qui omet une permission d'administrateur n'est pas admissible.
+
 | Méthode | Chemin | Accès | Description |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | Admin (`audit:read`) | Exporte les entrées d'audit au format JSON ou CSV avec des filtres |
-| `GET` | `/api/v1/enterprise/config/export` | Admin (`system:health`) | Exporte la configuration d'instance caviardée, les rôles personnalisés et les équipes |
-| `POST` | `/api/v1/enterprise/config/import` | Admin (`system:health`) | Importe une configuration, avec exécution à blanc optionnelle |
+| `GET` | `/api/v1/enterprise/config/export` | Administrateur intégré complet | Exporte la configuration d'instance caviardée, les rôles personnalisés et les équipes |
+| `POST` | `/api/v1/enterprise/config/import` | Administrateur intégré complet | Importe une configuration, avec exécution à blanc optionnelle |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Lit la liste d'autorisation CIDR configurée |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Met à jour la liste d'autorisation CIDR avec prévention de l'auto-verrouillage |
 | `GET` | `/api/v1/enterprise/legal-hold` | Admin (`compliance:manage`) | Liste les blocages juridiques des utilisateurs et des équipes |

apps/docs/hi/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "संपूर्ण REST API संदर्भ। टूल एंडपॉइंट, बैच प्रोसेसिंग, पाइपलाइन, फ़ाइल लाइब्रेरी, प्रमाणीकरण, टीमें और एडमिन संचालन।"
 i18n_output_hash: 40efba210bee
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ data: {"jobId":"...","type":"batch","status":"processing","completedFiles":2,"to
 
 ## सेटिंग्स {#settings}
 
-रनटाइम की-वैल्यू कॉन्फ़िगरेशन (किसी भी प्रमाणित उपयोगकर्ता द्वारा पढ़ी जाती है, केवल एडमिन द्वारा लिखी जाती है)।
+रनटाइम कॉन्फ़िगरेशन मान्य कीज़ के एक बंद सेट का उपयोग करता है। पढ़ने के लिए `settings:read` और लिखने के लिए `settings:write` आवश्यक है; सुरक्षा और अनुपालन कीज़ के लिए क्रमशः `security:manage` या `compliance:manage` भी आवश्यक है। गोपनीय सेटिंग्स के लिए पूर्ण एडमिन अधिकार आवश्यक हैं, जबकि समर्पित एंडपॉइंट द्वारा प्रबंधित क्रेडेंशियल और स्थिति यहाँ केवल पढ़ने योग्य हैं। कोई भी मान लिखे जाने से पहले बल्क अपडेट को पूरी तरह मान्य किया जाता है।
 
 | मेथड | पथ | विवरण |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ data: {"jobId":"...","type":"batch","status":"processing","completedFiles":2,"to
 | `PUT` | `/api/v1/settings` | सेटिंग्स बल्क में अपडेट करें (की-वैल्यू जोड़ों के साथ JSON बॉडी) |
 | `GET` | `/api/v1/settings/:key` | की के आधार पर एक विशिष्ट सेटिंग प्राप्त करें |
 
-ज्ञात कीज़: `disabledTools` (टूल ID का JSON ऐरे), `enableExperimentalTools` (bool स्ट्रिंग), `loginAttemptLimit` (number)।
+प्रतिनिधि कीज़: `disabledTools` (टूल ID का JSON ऐरे), `enableExperimentalTools` (बूलियन), `loginAttemptLimit` (सुरक्षा नीति), और `auditRetentionDays` (अनुपालन नीति)। अज्ञात कीज़ अस्वीकार की जाती हैं।
 
 ## प्राथमिकताएँ {#preferences}
 
@@ -636,11 +636,13 @@ arm64 पर `linux-arm64-cpu-py311` संग्रह का उपयोग
 
 ये रूट अपने संबंधित एंटरप्राइज़ फ़ीचर द्वारा लाइसेंस-गेटेड हैं। इनके लिए अभी भी सूचीबद्ध SnapOtter अनुमति आवश्यक है।
 
+**पूर्ण अंतर्निहित एडमिन** का अर्थ है कि प्रमाणित कर्ता के पास `admin` भूमिका और एडमिन अनुमतियों का पूरा प्रभावी सेट है। ऐसा API कुंजी स्कोप जिसमें एडमिन की एक भी अनुमति छूट गई हो, योग्य नहीं है।
+
 | मेथड | पथ | पहुँच | विवरण |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | एडमिन (`audit:read`) | फ़िल्टर के साथ ऑडिट प्रविष्टियों को JSON या CSV के रूप में निर्यात करें |
-| `GET` | `/api/v1/enterprise/config/export` | एडमिन (`system:health`) | संपादित इंस्टेंस कॉन्फ़िग, कस्टम भूमिकाएँ, और टीमें निर्यात करें |
-| `POST` | `/api/v1/enterprise/config/import` | एडमिन (`system:health`) | कॉन्फ़िग आयात करें, वैकल्पिक ड्राई रन के साथ |
+| `GET` | `/api/v1/enterprise/config/export` | पूर्ण अंतर्निहित एडमिन | संपादित इंस्टेंस कॉन्फ़िग, कस्टम भूमिकाएँ, और टीमें निर्यात करें |
+| `POST` | `/api/v1/enterprise/config/import` | पूर्ण अंतर्निहित एडमिन | कॉन्फ़िग आयात करें, वैकल्पिक ड्राई रन के साथ |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | एडमिन (`security:manage`) | कॉन्फ़िगर किया गया CIDR अनुमति-सूची पढ़ें |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | एडमिन (`security:manage`) | सेल्फ़-लॉकआउट रोकथाम के साथ CIDR अनुमति-सूची अपडेट करें |
 | `GET` | `/api/v1/enterprise/legal-hold` | एडमिन (`compliance:manage`) | उपयोगकर्ता और टीम लीगल होल्ड की सूची बनाएँ |

apps/docs/id/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "Referensi REST API lengkap. Endpoint tool, pemrosesan batch, pipeline, pustaka file, autentikasi, tim, dan operasi admin."
 i18n_output_hash: 7793faea1aad
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ Untuk menyimpan otomatis hasil tool ke pustaka, sertakan `fileId` sebagai field
 
 ## Pengaturan {#settings}
 
-Konfigurasi kunci-nilai runtime (dibaca oleh pengguna terautentikasi mana pun, ditulis hanya oleh admin).
+Konfigurasi runtime menggunakan kumpulan tertutup kunci yang dikenali. Pembacaan memerlukan `settings:read` dan penulisan memerlukan `settings:write`; kunci keamanan dan kepatuhan juga masing-masing memerlukan `security:manage` atau `compliance:manage`. Pengaturan rahasia memerlukan wewenang admin penuh, sedangkan kredensial dan status yang dikelola endpoint khusus hanya dapat dibaca di sini. Pembaruan massal divalidasi sebelum nilai apa pun ditulis.
 
 | Method | Path | Deskripsi |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ Konfigurasi kunci-nilai runtime (dibaca oleh pengguna terautentikasi mana pun, d
 | `PUT` | `/api/v1/settings` | Perbarui pengaturan secara massal (body JSON dengan pasangan kunci-nilai) |
 | `GET` | `/api/v1/settings/:key` | Dapatkan pengaturan tertentu berdasarkan kunci |
 
-Kunci yang diketahui: `disabledTools` (array JSON dari ID tool), `enableExperimentalTools` (string bool), `loginAttemptLimit` (number).
+Kunci representatif: `disabledTools` (array JSON berisi ID alat), `enableExperimentalTools` (boolean), `loginAttemptLimit` (kebijakan keamanan), dan `auditRetentionDays` (kebijakan kepatuhan). Kunci yang tidak dikenal ditolak.
 
 ## Preferensi {#preferences}
 
@@ -636,11 +636,13 @@ Endpoint operasional untuk observabilitas, dukungan, pelaporan penggunaan, dan s
 
 Rute ini dibatasi lisensi oleh fitur enterprise terkaitnya. Rute ini tetap memerlukan izin SnapOtter yang tercantum.
 
+**Admin bawaan penuh** berarti aktor yang diautentikasi memiliki peran `admin` dan seluruh rangkaian izin admin yang efektif. Cakupan kunci API yang tidak mencakup semua izin admin tidak memenuhi syarat.
+
 | Method | Path | Akses | Deskripsi |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | Admin (`audit:read`) | Ekspor entri audit sebagai JSON atau CSV dengan filter |
-| `GET` | `/api/v1/enterprise/config/export` | Admin (`system:health`) | Ekspor konfigurasi instans, peran kustom, dan tim yang disunting |
-| `POST` | `/api/v1/enterprise/config/import` | Admin (`system:health`) | Impor konfigurasi, dengan dry run opsional |
+| `GET` | `/api/v1/enterprise/config/export` | Admin bawaan penuh | Ekspor konfigurasi instans, peran kustom, dan tim yang disunting |
+| `POST` | `/api/v1/enterprise/config/import` | Admin bawaan penuh | Impor konfigurasi, dengan dry run opsional |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Baca allowlist CIDR yang dikonfigurasi |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Perbarui allowlist CIDR dengan pencegahan penguncian diri |
 | `GET` | `/api/v1/enterprise/legal-hold` | Admin (`compliance:manage`) | Daftar legal hold pengguna dan tim |

apps/docs/it/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "Riferimento completo dell'API REST. Endpoint degli strumenti, elaborazione batch, pipeline, libreria file, autenticazione, team e operazioni di amministrazione."
 i18n_output_hash: 1fa1fec30f47
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ Per salvare automaticamente il risultato di uno strumento nella libreria, includ
 
 ## Impostazioni {#settings}
 
-Configurazione runtime a coppie chiave-valore (letta da qualsiasi utente autenticato, scritta solo dagli amministratori).
+La configurazione di runtime usa un insieme chiuso di chiavi riconosciute. La lettura richiede `settings:read` e la scrittura `settings:write`; le chiavi di sicurezza e conformità richiedono inoltre, rispettivamente, `security:manage` o `compliance:manage`. Le impostazioni segrete richiedono l'autorità di amministratore completo, mentre le credenziali e lo stato gestiti da endpoint dedicati sono qui di sola lettura. Gli aggiornamenti in blocco vengono convalidati prima che sia scritto qualsiasi valore.
 
 | Metodo | Percorso | Descrizione |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ Configurazione runtime a coppie chiave-valore (letta da qualsiasi utente autenti
 | `PUT` | `/api/v1/settings` | Aggiorna in blocco le impostazioni (corpo JSON con coppie chiave-valore) |
 | `GET` | `/api/v1/settings/:key` | Ottiene un'impostazione specifica per chiave |
 
-Chiavi note: `disabledTools` (array JSON di ID degli strumenti), `enableExperimentalTools` (stringa bool), `loginAttemptLimit` (numero).
+Chiavi rappresentative: `disabledTools` (array JSON di ID degli strumenti), `enableExperimentalTools` (booleano), `loginAttemptLimit` (criterio di sicurezza) e `auditRetentionDays` (criterio di conformità). Le chiavi sconosciute vengono rifiutate.
 
 ## Preferenze {#preferences}
 
@@ -636,11 +636,13 @@ Endpoint operativi per l'osservabilità, il supporto, la reportistica sull'utili
 
 Queste route sono soggette a licenza in base alla loro funzionalità enterprise correlata. Richiedono comunque il permesso SnapOtter elencato.
 
+**Amministratore integrato completo** significa che l'attore autenticato ha il ruolo `admin` e l'intero insieme effettivo di autorizzazioni amministrative. Un ambito di chiave API che omette anche una sola autorizzazione amministrativa non è idoneo.
+
 | Metodo | Percorso | Accesso | Descrizione |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | Admin (`audit:read`) | Esporta le voci del registro di controllo come JSON o CSV con filtri |
-| `GET` | `/api/v1/enterprise/config/export` | Admin (`system:health`) | Esporta la configurazione dell'istanza oscurata, i ruoli personalizzati e i team |
-| `POST` | `/api/v1/enterprise/config/import` | Admin (`system:health`) | Importa la configurazione, con esecuzione a vuoto facoltativa |
+| `GET` | `/api/v1/enterprise/config/export` | Amministratore integrato completo | Esporta la configurazione dell'istanza oscurata, i ruoli personalizzati e i team |
+| `POST` | `/api/v1/enterprise/config/import` | Amministratore integrato completo | Importa la configurazione, con esecuzione a vuoto facoltativa |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Legge l'allowlist CIDR configurata |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Aggiorna l'allowlist CIDR con prevenzione dell'autoesclusione |
 | `GET` | `/api/v1/enterprise/legal-hold` | Admin (`compliance:manage`) | Elenca i blocchi legali di utenti e team |

apps/docs/ja/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "完全な REST API リファレンス。ツールエンドポイント、バッチ処理、パイプライン、ファイルライブラリ、認証、チーム、管理者操作。"
 i18n_output_hash: aa42f6d4ddbe
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ data: {"jobId":"...","type":"batch","status":"processing","completedFiles":2,"to
 
 ## 設定 {#settings}
 
-ランタイムのキー・バリュー設定（認証済みユーザーは誰でも読み取り可能、書き込みは管理者のみ）。
+ランタイム設定では、認識済みキーの閉じた集合を使用します。読み取りには `settings:read`、書き込みには `settings:write` が必要です。また、セキュリティおよびコンプライアンスのキーには、それぞれ `security:manage` または `compliance:manage` も必要です。秘密の設定には完全な管理者権限が必要で、専用エンドポイントが管理する認証情報と状態は、ここでは読み取り専用です。一括更新は、いずれかの値が書き込まれる前に検証されます。
 
 | メソッド | パス | 説明 |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ data: {"jobId":"...","type":"batch","status":"processing","completedFiles":2,"to
 | `PUT` | `/api/v1/settings` | 設定を一括更新（キー・バリューのペアを含む JSON ボディ） |
 | `GET` | `/api/v1/settings/:key` | キーで特定の設定を取得 |
 
-既知のキー: `disabledTools`（ツール ID の JSON 配列）, `enableExperimentalTools`（bool 文字列）, `loginAttemptLimit`（数値）。
+代表的なキー: `disabledTools`（ツール ID の JSON 配列）、`enableExperimentalTools`（ブール値）、`loginAttemptLimit`（セキュリティポリシー）、`auditRetentionDays`（コンプライアンスポリシー）。認識されていないキーは拒否されます。
 
 ## 環境設定 {#preferences}
 
@@ -636,11 +636,13 @@ arm64 の `linux-arm64-cpu-py311` アーカイブを使用します。別のタ
 
 これらのルートは、関連するエンタープライズ機能によってライセンスゲートされています。それでも、記載された SnapOtter のパーミッションを必要とします。
 
+**完全な組み込み管理者**とは、認証された主体が `admin` ロールを持ち、管理者権限の完全かつ実効的なセットを保持していることを意味します。管理者権限が一つでも欠ける API キーのスコープは対象外です。
+
 | メソッド | パス | アクセス | 説明 |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | Admin（`audit:read`） | 監査エントリをフィルタ付きで JSON または CSV としてエクスポート |
-| `GET` | `/api/v1/enterprise/config/export` | Admin（`system:health`） | 秘匿化されたインスタンス設定、カスタムロール、チームをエクスポート |
-| `POST` | `/api/v1/enterprise/config/import` | Admin（`system:health`） | 設定をインポート（オプションのドライラン付き） |
+| `GET` | `/api/v1/enterprise/config/export` | 完全な組み込み管理者 | 秘匿化されたインスタンス設定、カスタムロール、チームをエクスポート |
+| `POST` | `/api/v1/enterprise/config/import` | 完全な組み込み管理者 | 設定をインポート（オプションのドライラン付き） |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | Admin（`security:manage`） | 設定された CIDR 許可リストを読み取る |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | Admin（`security:manage`） | 自己ロックアウト防止付きで CIDR 許可リストを更新 |
 | `GET` | `/api/v1/enterprise/legal-hold` | Admin（`compliance:manage`） | ユーザーおよびチームのリーガルホールドを一覧表示 |

apps/docs/ko/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "전체 REST API 레퍼런스. 도구 엔드포인트, 배치 처리, 파이프라인, 파일 라이브러리, 인증, 팀, 관리 작업."
 i18n_output_hash: a4289adc1b56
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ data: {"jobId":"...","type":"batch","status":"processing","completedFiles":2,"to
 
 ## 설정 {#settings}
 
-런타임 키-값 구성(인증된 모든 사용자가 읽기, 관리자만 쓰기).
+런타임 구성은 인식된 키의 닫힌 집합을 사용합니다. 읽기에는 `settings:read`, 쓰기에는 `settings:write`가 필요하며, 보안 및 규정 준수 키에는 각각 `security:manage` 또는 `compliance:manage`도 필요합니다. 비밀 설정에는 전체 관리자 권한이 필요하고, 전용 엔드포인트가 관리하는 자격 증명과 상태는 여기서 읽기 전용입니다. 일괄 업데이트는 값을 쓰기 전에 검증됩니다.
 
 | 메서드 | 경로 | 설명 |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ data: {"jobId":"...","type":"batch","status":"processing","completedFiles":2,"to
 | `PUT` | `/api/v1/settings` | 설정 일괄 업데이트(키-값 쌍을 담은 JSON 본문) |
 | `GET` | `/api/v1/settings/:key` | 키로 특정 설정 획득 |
 
-알려진 키: `disabledTools`(도구 ID의 JSON 배열), `enableExperimentalTools`(bool 문자열), `loginAttemptLimit`(number).
+대표 키: `disabledTools`(도구 ID의 JSON 배열), `enableExperimentalTools`(불리언), `loginAttemptLimit`(보안 정책), `auditRetentionDays`(규정 준수 정책). 알 수 없는 키는 거부됩니다.
 
 ## 환경설정 {#preferences}
 
@@ -636,11 +636,13 @@ curl -X POST http://localhost:1349/api/v1/admin/features/import \
 
 이 경로들은 관련 엔터프라이즈 기능에 의해 라이선스 게이트가 적용됩니다. 여전히 나열된 SnapOtter 권한이 필요합니다.
 
+**전체 권한의 기본 제공 관리자**는 인증된 주체가 `admin` 역할과 전체 유효 관리자 권한 집합을 보유함을 의미합니다. 관리자 권한이 하나라도 누락된 API 키 범위는 자격이 없습니다.
+
 | 메서드 | 경로 | 접근 권한 | 설명 |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | 관리자(`audit:read`) | 필터와 함께 감사 항목을 JSON 또는 CSV로 내보내기 |
-| `GET` | `/api/v1/enterprise/config/export` | 관리자(`system:health`) | 편집된 인스턴스 구성, 커스텀 역할, 팀 내보내기 |
-| `POST` | `/api/v1/enterprise/config/import` | 관리자(`system:health`) | 선택적 드라이런과 함께 구성 가져오기 |
+| `GET` | `/api/v1/enterprise/config/export` | 전체 권한의 기본 제공 관리자 | 편집된 인스턴스 구성, 커스텀 역할, 팀 내보내기 |
+| `POST` | `/api/v1/enterprise/config/import` | 전체 권한의 기본 제공 관리자 | 선택적 드라이런과 함께 구성 가져오기 |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | 관리자(`security:manage`) | 구성된 CIDR 허용 목록 읽기 |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | 관리자(`security:manage`) | 자기 잠금 방지와 함께 CIDR 허용 목록 업데이트 |
 | `GET` | `/api/v1/enterprise/legal-hold` | 관리자(`compliance:manage`) | 사용자 및 팀 법적 보존 목록 |

apps/docs/nl/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "Volledige REST API-referentie. Tool-endpoints, batchverwerking, pipelines, bestandsbibliotheek, authenticatie, teams en beheerbewerkingen."
 i18n_output_hash: 8f6eabc592c0
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ Om een tool-resultaat automatisch op te slaan in de bibliotheek, voeg je `fileId
 
 ## Instellingen {#settings}
 
-Runtime key-value-configuratie (leesbaar door elke geauthenticeerde gebruiker, alleen schrijfbaar door admin).
+De runtimeconfiguratie gebruikt een gesloten verzameling herkende sleutels. Lezen vereist `settings:read` en schrijven vereist `settings:write`; beveiligings- en compliancesleutels vereisen daarnaast respectievelijk `security:manage` of `compliance:manage`. Geheime instellingen vereisen volledige beheerdersbevoegdheid, terwijl referenties en status die door specifieke endpoints worden beheerd hier alleen-lezen zijn. Bulkwijzigingen worden gevalideerd voordat een waarde wordt geschreven.
 
 | Methode | Pad | Beschrijving |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ Runtime key-value-configuratie (leesbaar door elke geauthenticeerde gebruiker, a
 | `PUT` | `/api/v1/settings` | Instellingen in bulk bijwerken (JSON-body met key-value-paren) |
 | `GET` | `/api/v1/settings/:key` | Een specifieke instelling ophalen op sleutel |
 
-Bekende sleutels: `disabledTools` (JSON-array van tool-ID's), `enableExperimentalTools` (bool-string), `loginAttemptLimit` (getal).
+Representatieve sleutels: `disabledTools` (JSON-array van tool-ID's), `enableExperimentalTools` (booleaanse waarde), `loginAttemptLimit` (beveiligingsbeleid) en `auditRetentionDays` (compliancebeleid). Onbekende sleutels worden geweigerd.
 
 ## Voorkeuren {#preferences}
 
@@ -636,11 +636,13 @@ Operationele endpoints voor observability, support, gebruiksrapportage en backup
 
 Deze routes zijn licentiegebonden door de bijbehorende enterprise-functie. Ze vereisen nog steeds de vermelde SnapOtter-permissie.
 
+**Volledige ingebouwde beheerder** betekent dat de geauthenticeerde actor de rol `admin` en de volledige effectieve set beheerderspermissies heeft. Een API-sleutelbereik dat ook maar één beheerderspermissie weglaat, komt niet in aanmerking.
+
 | Methode | Pad | Toegang | Beschrijving |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | Admin (`audit:read`) | Auditvermeldingen exporteren als JSON of CSV met filters |
-| `GET` | `/api/v1/enterprise/config/export` | Admin (`system:health`) | Geredigeerde instance-configuratie, aangepaste rollen en teams exporteren |
-| `POST` | `/api/v1/enterprise/config/import` | Admin (`system:health`) | Configuratie importeren, met optionele dry run |
+| `GET` | `/api/v1/enterprise/config/export` | Volledige ingebouwde beheerder | Geredigeerde instance-configuratie, aangepaste rollen en teams exporteren |
+| `POST` | `/api/v1/enterprise/config/import` | Volledige ingebouwde beheerder | Configuratie importeren, met optionele dry run |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Geconfigureerde CIDR-allowlist lezen |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | CIDR-allowlist bijwerken met bescherming tegen zelf-buitensluiting |
 | `GET` | `/api/v1/enterprise/legal-hold` | Admin (`compliance:manage`) | Legal holds voor gebruikers en teams weergeven |

apps/docs/pl/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "Kompletna dokumentacja API REST. Punkty końcowe narzędzi, przetwarzanie wsadowe, potoki, biblioteka plików, uwierzytelnianie, zespoły i operacje administracyjne."
 i18n_output_hash: 4b25a4ffd694
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ Aby automatycznie zapisać wynik narzędzia w bibliotece, dołącz `fileId` jako
 
 ## Ustawienia {#settings}
 
-Konfiguracja klucz-wartość w czasie działania (odczyt przez każdego uwierzytelnionego użytkownika, zapis tylko przez administratora).
+Konfiguracja środowiska uruchomieniowego używa zamkniętego zbioru rozpoznawanych kluczy. Odczyt wymaga uprawnienia `settings:read`, a zapis — `settings:write`; klucze zabezpieczeń i zgodności dodatkowo wymagają uprawnienia `security:manage` lub `compliance:manage`. Ustawienia tajne wymagają uprawnień pełnego administratora, natomiast poświadczenia i stan zarządzane przez dedykowane punkty końcowe są tutaj tylko do odczytu. Aktualizacje zbiorcze są weryfikowane przed zapisaniem jakiejkolwiek wartości.
 
 | Metoda | Ścieżka | Opis |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ Konfiguracja klucz-wartość w czasie działania (odczyt przez każdego uwierzyt
 | `PUT` | `/api/v1/settings` | Zbiorczo zaktualizuj ustawienia (treść JSON z parami klucz-wartość) |
 | `GET` | `/api/v1/settings/:key` | Pobierz konkretne ustawienie według klucza |
 
-Znane klucze: `disabledTools` (tablica JSON identyfikatorów narzędzi), `enableExperimentalTools` (ciąg bool), `loginAttemptLimit` (liczba).
+Przykładowe klucze: `disabledTools` (tablica JSON identyfikatorów narzędzi), `enableExperimentalTools` (wartość logiczna), `loginAttemptLimit` (zasady zabezpieczeń) oraz `auditRetentionDays` (zasady zgodności). Nieznane klucze są odrzucane.
 
 ## Preferencje {#preferences}
 
@@ -636,11 +636,13 @@ Operacyjne punkty końcowe do obserwowalności, wsparcia, raportowania użycia i
 
 Te trasy są bramkowane licencją przez powiązaną z nimi funkcję enterprise. Nadal wymagają wymienionego uprawnienia SnapOtter.
 
+**Wbudowany administrator z pełnymi uprawnieniami** oznacza uwierzytelnionego użytkownika z rolą `admin` i pełnym zestawem efektywnych uprawnień administratora. Klucz API, któremu brakuje choć jednego uprawnienia administratora, nie spełnia tego wymagania.
+
 | Metoda | Ścieżka | Dostęp | Opis |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | Administrator (`audit:read`) | Eksportuj wpisy audytu jako JSON lub CSV z filtrami |
-| `GET` | `/api/v1/enterprise/config/export` | Administrator (`system:health`) | Eksportuj zredagowaną konfigurację instancji, niestandardowe role i zespoły |
-| `POST` | `/api/v1/enterprise/config/import` | Administrator (`system:health`) | Zaimportuj konfigurację, z opcjonalnym przebiegiem próbnym |
+| `GET` | `/api/v1/enterprise/config/export` | Wbudowany administrator z pełnymi uprawnieniami | Eksportuj zredagowaną konfigurację instancji, niestandardowe role i zespoły |
+| `POST` | `/api/v1/enterprise/config/import` | Wbudowany administrator z pełnymi uprawnieniami | Zaimportuj konfigurację, z opcjonalnym przebiegiem próbnym |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | Administrator (`security:manage`) | Odczytaj skonfigurowaną listę dozwolonych CIDR |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | Administrator (`security:manage`) | Zaktualizuj listę dozwolonych CIDR z ochroną przed zablokowaniem samego siebie |
 | `GET` | `/api/v1/enterprise/legal-hold` | Administrator (`compliance:manage`) | Lista blokad prawnych użytkowników i zespołów |

apps/docs/pt-BR/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "Referência completa da API REST. Endpoints de ferramentas, processamento em lote, pipelines, biblioteca de arquivos, autenticação, times e operações administrativas."
 i18n_output_hash: cf7876adfe84
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ Para salvar automaticamente o resultado de uma ferramenta na biblioteca, inclua
 
 ## Configurações {#settings}
 
-Configuração de tempo de execução em pares chave-valor (leitura por qualquer usuário autenticado, gravação apenas por admin).
+A configuração de execução usa um conjunto fechado de chaves reconhecidas. A leitura exige `settings:read` e a gravação exige `settings:write`; as chaves de segurança e conformidade também exigem `security:manage` ou `compliance:manage`. Configurações secretas exigem autoridade de administrador completo, enquanto credenciais e estados controlados por endpoints dedicados são somente leitura aqui. As atualizações em massa são validadas antes que qualquer valor seja gravado.
 
 | Método | Caminho | Descrição |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ Configuração de tempo de execução em pares chave-valor (leitura por qualquer
 | `PUT` | `/api/v1/settings` | Atualiza configurações em massa (corpo JSON com pares chave-valor) |
 | `GET` | `/api/v1/settings/:key` | Obtém uma configuração específica pela chave |
 
-Chaves conhecidas: `disabledTools` (array JSON de IDs de ferramentas), `enableExperimentalTools` (string bool), `loginAttemptLimit` (número).
+Chaves representativas: `disabledTools` (array JSON de IDs de ferramentas), `enableExperimentalTools` (booleano), `loginAttemptLimit` (política de segurança) e `auditRetentionDays` (política de conformidade). Chaves desconhecidas são rejeitadas.
 
 ## Preferências {#preferences}
 
@@ -636,11 +636,13 @@ Endpoints operacionais para observabilidade, suporte, relatório de uso e status
 
 Essas rotas são restritas por licença de acordo com o recurso enterprise relacionado. Elas ainda exigem a permissão SnapOtter listada.
 
+**Administrador integrado com autoridade total** significa que a identidade autenticada possui o papel `admin` e o conjunto completo de permissões efetivas de administrador. Um escopo de chave de API que omita qualquer permissão de administrador não se qualifica.
+
 | Método | Caminho | Acesso | Descrição |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | Admin (`audit:read`) | Exporta entradas de auditoria como JSON ou CSV com filtros |
-| `GET` | `/api/v1/enterprise/config/export` | Admin (`system:health`) | Exporta a configuração da instância redigida, os papéis personalizados e os times |
-| `POST` | `/api/v1/enterprise/config/import` | Admin (`system:health`) | Importa a configuração, com dry run opcional |
+| `GET` | `/api/v1/enterprise/config/export` | Administrador integrado com autoridade total | Exporta a configuração da instância redigida, os papéis personalizados e os times |
+| `POST` | `/api/v1/enterprise/config/import` | Administrador integrado com autoridade total | Importa a configuração, com dry run opcional |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Lê a lista de permissões CIDR configurada |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Atualiza a lista de permissões CIDR com prevenção de autobloqueio |
 | `GET` | `/api/v1/enterprise/legal-hold` | Admin (`compliance:manage`) | Lista as retenções legais de usuários e times |

apps/docs/ru/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "Полный справочник REST API. Эндпоинты инструментов, пакетная обработка, конвейеры, файловая библиотека, аутентификация, команды и административные операции."
 i18n_output_hash: b2ec4e36cb9f
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ data: {"jobId":"...","type":"batch","status":"processing","completedFiles":2,"to
 
 ## Настройки {#settings}
 
-Конфигурация «ключ-значение» во время выполнения (чтение любым аутентифицированным пользователем, запись только администратором).
+Конфигурация среды выполнения использует закрытый набор распознаваемых ключей. Для чтения требуется `settings:read`, а для записи — `settings:write`; для ключей безопасности и соответствия дополнительно требуются `security:manage` или `compliance:manage`. Секретные настройки требуют полномочий администратора в полном объёме, а учётные данные и состояние, управляемые специализированными конечными точками, здесь доступны только для чтения. Пакетные обновления проверяются до записи любого значения.
 
 | Метод | Путь | Описание |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ data: {"jobId":"...","type":"batch","status":"processing","completedFiles":2,"to
 | `PUT` | `/api/v1/settings` | Массовое обновление настроек (тело JSON с парами «ключ-значение») |
 | `GET` | `/api/v1/settings/:key` | Получить конкретную настройку по ключу |
 
-Известные ключи: `disabledTools` (JSON-массив ID инструментов), `enableExperimentalTools` (строка bool), `loginAttemptLimit` (число).
+Примеры ключей: `disabledTools` (JSON-массив идентификаторов инструментов), `enableExperimentalTools` (логическое значение), `loginAttemptLimit` (политика безопасности) и `auditRetentionDays` (политика соответствия). Неизвестные ключи отклоняются.
 
 ## Предпочтения {#preferences}
 
@@ -636,11 +636,13 @@ curl -X POST http://localhost:1349/api/v1/admin/features/import \
 
 Эти маршруты ограничены лицензией через связанную с ними enterprise-функцию. Они по-прежнему требуют указанного разрешения SnapOtter.
 
+**Встроенный администратор с полными правами** — это прошедший аутентификацию субъект с ролью `admin` и полным набором действующих разрешений администратора. Область действия ключа API, в которой отсутствует хотя бы одно разрешение администратора, не соответствует этому требованию.
+
 | Метод | Путь | Доступ | Описание |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | Admin (`audit:read`) | Экспорт записей аудита в JSON или CSV с фильтрами |
-| `GET` | `/api/v1/enterprise/config/export` | Admin (`system:health`) | Экспорт отредактированной конфигурации экземпляра, пользовательских ролей и команд |
-| `POST` | `/api/v1/enterprise/config/import` | Admin (`system:health`) | Импорт конфигурации, с необязательным пробным запуском |
+| `GET` | `/api/v1/enterprise/config/export` | Встроенный администратор с полными правами | Экспорт отредактированной конфигурации экземпляра, пользовательских ролей и команд |
+| `POST` | `/api/v1/enterprise/config/import` | Встроенный администратор с полными правами | Импорт конфигурации, с необязательным пробным запуском |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Прочитать настроенный список разрешённых CIDR |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Обновить список разрешённых CIDR с предотвращением самоблокировки |
 | `GET` | `/api/v1/enterprise/legal-hold` | Admin (`compliance:manage`) | Список правовых блокировок пользователей и команд |

apps/docs/sv/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "Fullständig REST API-referens. Verktygsslutpunkter, batchbearbetning, pipelines, filbibliotek, autentisering, team och adminåtgärder."
 i18n_output_hash: 4756237a0bdc
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ För att automatiskt spara ett verktygsresultat till biblioteket, inkludera `fil
 
 ## Inställningar {#settings}
 
-Körtidskonfiguration i nyckel-värde-format (läses av alla autentiserade användare, skrivs endast av admin).
+Körtidskonfigurationen använder en sluten uppsättning kända nycklar. Läsning kräver `settings:read` och skrivning kräver `settings:write`; säkerhets- och efterlevnadsnycklar kräver dessutom `security:manage` eller `compliance:manage`. Hemliga inställningar kräver fullständig administratörsbehörighet, medan autentiseringsuppgifter och tillstånd som hanteras av särskilda slutpunkter är skrivskyddade här. Massuppdateringar valideras innan något värde skrivs.
 
 | Metod | Sökväg | Beskrivning |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ Körtidskonfiguration i nyckel-värde-format (läses av alla autentiserade anvä
 | `PUT` | `/api/v1/settings` | Massuppdatera inställningar (JSON-kropp med nyckel-värde-par) |
 | `GET` | `/api/v1/settings/:key` | Hämta en specifik inställning via nyckel |
 
-Kända nycklar: `disabledTools` (JSON-array av verktygs-ID:n), `enableExperimentalTools` (bool-sträng), `loginAttemptLimit` (nummer).
+Representativa nycklar: `disabledTools` (JSON-array med verktygs-ID:n), `enableExperimentalTools` (booleskt värde), `loginAttemptLimit` (säkerhetspolicy) och `auditRetentionDays` (efterlevnadspolicy). Okända nycklar avvisas.
 
 ## Inställningar (per användare) {#preferences}
 
@@ -636,11 +636,13 @@ Driftsslutpunkter för observerbarhet, support, användningsrapportering och bac
 
 Dessa rutter är licensgrindade av sin relaterade enterprise-funktion. De kräver fortfarande den angivna SnapOtter-behörigheten.
 
+**Inbyggd administratör med full behörighet** betyder att den autentiserade aktören har rollen `admin` och hela den effektiva uppsättningen administratörsbehörigheter. Ett API-nyckelomfång som saknar någon administratörsbehörighet kvalificerar inte.
+
 | Metod | Sökväg | Åtkomst | Beskrivning |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | Admin (`audit:read`) | Exportera granskningsposter som JSON eller CSV med filter |
-| `GET` | `/api/v1/enterprise/config/export` | Admin (`system:health`) | Exportera redigerad instanskonfiguration, anpassade roller och team |
-| `POST` | `/api/v1/enterprise/config/import` | Admin (`system:health`) | Importera konfiguration, med valfri torrkörning |
+| `GET` | `/api/v1/enterprise/config/export` | Inbyggd administratör med full behörighet | Exportera redigerad instanskonfiguration, anpassade roller och team |
+| `POST` | `/api/v1/enterprise/config/import` | Inbyggd administratör med full behörighet | Importera konfiguration, med valfri torrkörning |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Läs konfigurerad CIDR-tillåtningslista |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Uppdatera CIDR-tillåtningslista med förhindrande av självutlåsning |
 | `GET` | `/api/v1/enterprise/legal-hold` | Admin (`compliance:manage`) | Lista rättsliga spärrar för användare och team |

apps/docs/th/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "เอกสารอ้างอิง REST API ฉบับสมบูรณ์ เอนด์พอยต์ของเครื่องมือ การประมวลผลแบบแบตช์ ไปป์ไลน์ คลังไฟล์ การยืนยันตัวตน ทีม และการดำเนินงานของผู้ดูแลระบบ"
 i18n_output_hash: 34c52fe6305e
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ data: {"jobId":"...","type":"batch","status":"processing","completedFiles":2,"to
 
 ## การตั้งค่า {#settings}
 
-การกำหนดค่าคีย์-ค่าแบบรันไทม์ (อ่านได้โดยผู้ใช้ที่ยืนยันตัวตนแล้วทุกคน เขียนได้โดยผู้ดูแลระบบเท่านั้น)
+การกำหนดค่าขณะรันใช้ชุดคีย์ที่ระบบรู้จักแบบปิด การอ่านต้องมี `settings:read` และการเขียนต้องมี `settings:write` ส่วนคีย์ด้านความปลอดภัยและการปฏิบัติตามข้อกำหนดยังต้องมี `security:manage` หรือ `compliance:manage` เพิ่มเติม การตั้งค่าที่เป็นความลับต้องมีสิทธิ์ผู้ดูแลระบบเต็มรูปแบบ ส่วนข้อมูลประจำตัวและสถานะที่จัดการโดย endpoint เฉพาะจะเป็นแบบอ่านอย่างเดียวที่นี่ ระบบจะตรวจสอบการอัปเดตแบบกลุ่มทั้งหมดก่อนเขียนค่าใด ๆ
 
 | Method | Path | คำอธิบาย |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ data: {"jobId":"...","type":"batch","status":"processing","completedFiles":2,"to
 | `PUT` | `/api/v1/settings` | อัปเดตการตั้งค่าแบบกลุ่ม (JSON body พร้อมคู่คีย์-ค่า) |
 | `GET` | `/api/v1/settings/:key` | รับการตั้งค่าที่ระบุตามคีย์ |
 
-คีย์ที่รู้จัก: `disabledTools` (อาร์เรย์ JSON ของ tool ID), `enableExperimentalTools` (สตริง bool), `loginAttemptLimit` (ตัวเลข)
+ตัวอย่างคีย์: `disabledTools` (อาร์เรย์ JSON ของ ID เครื่องมือ), `enableExperimentalTools` (ค่าบูลีน), `loginAttemptLimit` (นโยบายความปลอดภัย) และ `auditRetentionDays` (นโยบายการปฏิบัติตามข้อกำหนด) ระบบจะปฏิเสธคีย์ที่ไม่รู้จัก
 
 ## ค่าปรับตั้ง {#preferences}
 
@@ -636,11 +636,13 @@ curl -X POST http://localhost:1349/api/v1/admin/features/import \
 
 เส้นทางเหล่านี้ถูกเกตด้วยไลเซนส์ตามฟีเจอร์ enterprise ที่เกี่ยวข้อง ยังคงต้องมีสิทธิ์ SnapOtter ที่ระบุไว้
 
+**ผู้ดูแลระบบในตัวที่มีสิทธิ์เต็มรูปแบบ** หมายถึงผู้ดำเนินการที่ผ่านการยืนยันตัวตนซึ่งมีบทบาท `admin` และมีชุดสิทธิ์ผู้ดูแลระบบที่มีผลครบทั้งหมด ขอบเขตคีย์ API ที่ขาดสิทธิ์ผู้ดูแลระบบแม้แต่รายการเดียวจะไม่เข้าเงื่อนไข
+
 | Method | Path | สิทธิ์เข้าถึง | คำอธิบาย |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | ผู้ดูแลระบบ (`audit:read`) | ส่งออกรายการการตรวจสอบเป็น JSON หรือ CSV พร้อมตัวกรอง |
-| `GET` | `/api/v1/enterprise/config/export` | ผู้ดูแลระบบ (`system:health`) | ส่งออกการกำหนดค่าอินสแตนซ์ บทบาทกำหนดเอง และทีมที่ปกปิดข้อมูลแล้ว |
-| `POST` | `/api/v1/enterprise/config/import` | ผู้ดูแลระบบ (`system:health`) | นำเข้าการกำหนดค่า พร้อมการทดลองรันที่ไม่บังคับ |
+| `GET` | `/api/v1/enterprise/config/export` | ผู้ดูแลระบบในตัวที่มีสิทธิ์เต็มรูปแบบ | ส่งออกการกำหนดค่าอินสแตนซ์ บทบาทกำหนดเอง และทีมที่ปกปิดข้อมูลแล้ว |
+| `POST` | `/api/v1/enterprise/config/import` | ผู้ดูแลระบบในตัวที่มีสิทธิ์เต็มรูปแบบ | นำเข้าการกำหนดค่า พร้อมการทดลองรันที่ไม่บังคับ |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | ผู้ดูแลระบบ (`security:manage`) | อ่านรายการอนุญาต CIDR ที่กำหนดค่าไว้ |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | ผู้ดูแลระบบ (`security:manage`) | อัปเดตรายการอนุญาต CIDR พร้อมการป้องกันการล็อกตัวเองออก |
 | `GET` | `/api/v1/enterprise/legal-hold` | ผู้ดูแลระบบ (`compliance:manage`) | แสดงรายการการระงับทางกฎหมายของผู้ใช้และทีม |

apps/docs/tr/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "Eksiksiz REST API başvurusu. Araç uç noktaları, toplu işleme, işlem hatları, dosya kitaplığı, kimlik doğrulama, ekipler ve yönetici işlemleri."
 i18n_output_hash: 4ae115bf377e
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ Bir araç sonucunu kitaplığa otomatik kaydetmek için, mevcut bir kitaplık do
 
 ## Ayarlar {#settings}
 
-Çalışma zamanı anahtar-değer yapılandırması (kimliği doğrulanmış herhangi bir kullanıcı okur, yalnızca yönetici yazar).
+Çalışma zamanı yapılandırması, tanınan anahtarlardan oluşan kapalı bir küme kullanır. Okuma `settings:read`, yazma ise `settings:write` gerektirir; güvenlik ve uyumluluk anahtarları ayrıca `security:manage` veya `compliance:manage` gerektirir. Gizli ayarlar tam yönetici yetkisi gerektirirken özel uç noktaların yönettiği kimlik bilgileri ve durum burada salt okunurdur. Toplu güncellemeler herhangi bir değer yazılmadan önce doğrulanır.
 
 | Yöntem | Yol | Açıklama |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ Bir araç sonucunu kitaplığa otomatik kaydetmek için, mevcut bir kitaplık do
 | `PUT` | `/api/v1/settings` | Ayarları toplu güncelle (anahtar-değer çiftleriyle JSON gövdesi) |
 | `GET` | `/api/v1/settings/:key` | Anahtara göre belirli bir ayarı al |
 
-Bilinen anahtarlar: `disabledTools` (araç kimliklerinin JSON dizisi), `enableExperimentalTools` (bool dizesi), `loginAttemptLimit` (sayı).
+Temsili anahtarlar: `disabledTools` (araç kimliklerinden oluşan JSON dizisi), `enableExperimentalTools` (boole değeri), `loginAttemptLimit` (güvenlik politikası) ve `auditRetentionDays` (uyumluluk politikası). Bilinmeyen anahtarlar reddedilir.
 
 ## Tercihler {#preferences}
 
@@ -636,11 +636,13 @@ Gözlemlenebilirlik, destek, kullanım raporlama ve yedekleme durumu için opera
 
 Bu yollar, ilgili kurumsal özellikleri tarafından lisans kapılıdır. Yine de listelenen SnapOtter iznini gerektirirler.
 
+**Tam yetkili yerleşik yönetici**, kimliği doğrulanmış aktörün `admin` rolüne ve etkin yönetici izinlerinin tamamına sahip olduğu anlamına gelir. Herhangi bir yönetici iznini içermeyen API anahtarı kapsamı bu koşulu sağlamaz.
+
 | Yöntem | Yol | Erişim | Açıklama |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | Yönetici (`audit:read`) | Denetim girdilerini filtrelerle JSON veya CSV olarak dışa aktar |
-| `GET` | `/api/v1/enterprise/config/export` | Yönetici (`system:health`) | Redakte edilmiş örnek yapılandırmasını, özel rolleri ve ekipleri dışa aktar |
-| `POST` | `/api/v1/enterprise/config/import` | Yönetici (`system:health`) | Yapılandırmayı içe aktar, isteğe bağlı deneme çalışmasıyla |
+| `GET` | `/api/v1/enterprise/config/export` | Tam yetkili yerleşik yönetici | Redakte edilmiş örnek yapılandırmasını, özel rolleri ve ekipleri dışa aktar |
+| `POST` | `/api/v1/enterprise/config/import` | Tam yetkili yerleşik yönetici | Yapılandırmayı içe aktar, isteğe bağlı deneme çalışmasıyla |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | Yönetici (`security:manage`) | Yapılandırılmış CIDR izin listesini oku |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | Yönetici (`security:manage`) | CIDR izin listesini kendini kilitleme önlemesiyle güncelle |
 | `GET` | `/api/v1/enterprise/legal-hold` | Yönetici (`compliance:manage`) | Kullanıcı ve ekip yasal saklamalarını listele |

apps/docs/uk/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "Повний довідник REST API. Кінцеві точки інструментів, пакетна обробка, конвеєри, бібліотека файлів, автентифікація, команди й адміністративні операції."
 i18n_output_hash: 20d37040e8ea
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ data: {"jobId":"...","type":"batch","status":"processing","completedFiles":2,"to
 
 ## Налаштування {#settings}
 
-Конфігурація ключ-значення в реальному часі (читає будь-який автентифікований користувач, записує лише адмін).
+Конфігурація середовища виконання використовує закритий набір розпізнаваних ключів. Для читання потрібен дозвіл `settings:read`, а для запису — `settings:write`; ключі безпеки та відповідності додатково вимагають `security:manage` або `compliance:manage`. Секретні налаштування вимагають повноважень повного адміністратора, а облікові дані та стан, якими керують спеціалізовані кінцеві точки, тут доступні лише для читання. Пакетні оновлення перевіряються до запису будь-якого значення.
 
 | Метод | Шлях | Опис |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ data: {"jobId":"...","type":"batch","status":"processing","completedFiles":2,"to
 | `PUT` | `/api/v1/settings` | Масове оновлення налаштувань (тіло JSON з парами ключ-значення) |
 | `GET` | `/api/v1/settings/:key` | Отримати конкретне налаштування за ключем |
 
-Відомі ключі: `disabledTools` (JSON-масив ID інструментів), `enableExperimentalTools` (bool-рядок), `loginAttemptLimit` (число).
+Приклади ключів: `disabledTools` (JSON-масив ідентифікаторів інструментів), `enableExperimentalTools` (логічне значення), `loginAttemptLimit` (політика безпеки) та `auditRetentionDays` (політика відповідності). Невідомі ключі відхиляються.
 
 ## Уподобання {#preferences}
 
@@ -636,11 +636,13 @@ curl -X POST http://localhost:1349/api/v1/admin/features/import \
 
 Ці маршрути ліцензійно обмежені пов'язаною корпоративною можливістю. Вони все одно потребують зазначеного дозволу SnapOtter.
 
+**Вбудований адміністратор із повними правами** означає, що автентифікований суб’єкт має роль `admin` і повний набір фактичних дозволів адміністратора. Область дії ключа API, у якій відсутній хоча б один дозвіл адміністратора, не відповідає цій вимозі.
+
 | Метод | Шлях | Доступ | Опис |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | Адмін (`audit:read`) | Експортувати записи аудиту як JSON або CSV з фільтрами |
-| `GET` | `/api/v1/enterprise/config/export` | Адмін (`system:health`) | Експортувати відредаговану конфігурацію екземпляра, власні ролі й команди |
-| `POST` | `/api/v1/enterprise/config/import` | Адмін (`system:health`) | Імпортувати конфігурацію, з необов'язковим пробним запуском |
+| `GET` | `/api/v1/enterprise/config/export` | Вбудований адміністратор із повними правами | Експортувати відредаговану конфігурацію екземпляра, власні ролі й команди |
+| `POST` | `/api/v1/enterprise/config/import` | Вбудований адміністратор із повними правами | Імпортувати конфігурацію, з необов'язковим пробним запуском |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | Адмін (`security:manage`) | Прочитати налаштований білий список CIDR |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | Адмін (`security:manage`) | Оновити білий список CIDR із запобіганням самоблокуванню |
 | `GET` | `/api/v1/enterprise/legal-hold` | Адмін (`compliance:manage`) | Список правових утримань користувачів і команд |

apps/docs/vi/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "Tài liệu tham khảo REST API đầy đủ. Endpoint công cụ, xử lý hàng loạt, pipeline, thư viện tệp, xác thực, nhóm và các thao tác quản trị."
 i18n_output_hash: a2d3795ef769
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ Lưu trữ tệp bền vững kèm lịch sử phiên bản.
 
 ## Cài đặt {#settings}
 
-Cấu hình khóa-giá trị lúc chạy (bất kỳ người dùng đã xác thực nào cũng đọc được, chỉ admin ghi được).
+Cấu hình thời gian chạy sử dụng một tập hợp đóng gồm các khóa được nhận dạng. Việc đọc yêu cầu `settings:read` và việc ghi yêu cầu `settings:write`; các khóa bảo mật và tuân thủ còn yêu cầu `security:manage` hoặc `compliance:manage`. Cài đặt bí mật yêu cầu quyền quản trị viên đầy đủ, còn thông tin xác thực và trạng thái do các điểm cuối chuyên biệt quản lý chỉ có thể đọc tại đây. Các bản cập nhật hàng loạt được xác thực trước khi ghi bất kỳ giá trị nào.
 
 | Phương thức | Đường dẫn | Mô tả |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ Cấu hình khóa-giá trị lúc chạy (bất kỳ người dùng đã xác th
 | `PUT` | `/api/v1/settings` | Cập nhật hàng loạt cài đặt (thân JSON với các cặp khóa-giá trị) |
 | `GET` | `/api/v1/settings/:key` | Lấy một cài đặt cụ thể theo khóa |
 
-Các khóa đã biết: `disabledTools` (mảng JSON gồm các ID công cụ), `enableExperimentalTools` (chuỗi bool), `loginAttemptLimit` (số).
+Các khóa tiêu biểu: `disabledTools` (mảng JSON gồm các ID công cụ), `enableExperimentalTools` (giá trị boolean), `loginAttemptLimit` (chính sách bảo mật) và `auditRetentionDays` (chính sách tuân thủ). Các khóa không xác định sẽ bị từ chối.
 
 ## Tùy chọn {#preferences}
 
@@ -636,11 +636,13 @@ Các endpoint vận hành cho quan sát, hỗ trợ, báo cáo sử dụng và t
 
 Các route này bị khóa theo giấy phép của tính năng enterprise liên quan. Chúng vẫn yêu cầu quyền hạn SnapOtter được liệt kê.
 
+**Quản trị viên tích hợp sẵn có đầy đủ quyền** nghĩa là chủ thể đã xác thực có vai trò `admin` và toàn bộ tập quyền quản trị viên có hiệu lực. Phạm vi khóa API thiếu bất kỳ quyền quản trị viên nào sẽ không đủ điều kiện.
+
 | Phương thức | Đường dẫn | Quyền truy cập | Mô tả |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | Admin (`audit:read`) | Xuất các mục kiểm toán dưới dạng JSON hoặc CSV với bộ lọc |
-| `GET` | `/api/v1/enterprise/config/export` | Admin (`system:health`) | Xuất cấu hình instance, vai trò tùy chỉnh và nhóm đã ẩn thông tin |
-| `POST` | `/api/v1/enterprise/config/import` | Admin (`system:health`) | Nhập cấu hình, với chạy thử tùy chọn |
+| `GET` | `/api/v1/enterprise/config/export` | Quản trị viên tích hợp sẵn có đầy đủ quyền | Xuất cấu hình instance, vai trò tùy chỉnh và nhóm đã ẩn thông tin |
+| `POST` | `/api/v1/enterprise/config/import` | Quản trị viên tích hợp sẵn có đầy đủ quyền | Nhập cấu hình, với chạy thử tùy chọn |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Đọc danh sách cho phép CIDR đã cấu hình |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | Admin (`security:manage`) | Cập nhật danh sách cho phép CIDR với cơ chế ngăn tự khóa mình ra ngoài |
 | `GET` | `/api/v1/enterprise/legal-hold` | Admin (`compliance:manage`) | Liệt kê các lệnh giữ pháp lý của người dùng và nhóm |

apps/docs/zh-CN/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "完整的 REST API 参考。工具端点、批处理、流水线、文件库、身份验证、团队以及管理操作。"
 i18n_output_hash: c43973438a42
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ data: {"jobId":"...","type":"batch","status":"processing","completedFiles":2,"to
 
 ## 设置 {#settings}
 
-运行时键值配置（任何已验证用户可读，仅管理员可写）。
+运行时配置仅使用一组封闭的已识别键。读取需要 `settings:read`，写入需要 `settings:write`；安全和合规键还分别需要 `security:manage` 或 `compliance:manage`。机密设置需要完整管理员权限，而由专用端点管理的凭据和状态在此处为只读。批量更新会在写入任何值之前完成验证。
 
 | 方法 | 路径 | 说明 |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ data: {"jobId":"...","type":"batch","status":"processing","completedFiles":2,"to
 | `PUT` | `/api/v1/settings` | 批量更新设置（带键值对的 JSON 请求体） |
 | `GET` | `/api/v1/settings/:key` | 按键获取指定设置 |
 
-已知键：`disabledTools`（工具 ID 的 JSON 数组）、`enableExperimentalTools`（bool 字符串）、`loginAttemptLimit`（数字）。
+代表性键包括：`disabledTools`（工具 ID 的 JSON 数组）、`enableExperimentalTools`（布尔值）、`loginAttemptLimit`（安全策略）和 `auditRetentionDays`（合规策略）。未知键会被拒绝。
 
 ## 偏好设置 {#preferences}
 
@@ -636,11 +636,13 @@ curl -X POST http://localhost:1349/api/v1/admin/features/import \
 
 这些路由由其相关的企业版功能进行许可证限制。它们仍需要列出的 SnapOtter 权限。
 
+**拥有完整权限的内置管理员**是指经过身份验证的主体拥有 `admin` 角色以及完整的有效管理员权限集。若 API 密钥的权限范围缺少任何管理员权限，则不符合此要求。
+
 | 方法 | 路径 | 访问权限 | 说明 |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | 管理员（`audit:read`） | 带过滤器将审计条目导出为 JSON 或 CSV |
-| `GET` | `/api/v1/enterprise/config/export` | 管理员（`system:health`） | 导出已脱敏的实例配置、自定义角色和团队 |
-| `POST` | `/api/v1/enterprise/config/import` | 管理员（`system:health`） | 导入配置，可选试运行 |
+| `GET` | `/api/v1/enterprise/config/export` | 拥有完整权限的内置管理员 | 导出已脱敏的实例配置、自定义角色和团队 |
+| `POST` | `/api/v1/enterprise/config/import` | 拥有完整权限的内置管理员 | 导入配置，可选试运行 |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | 管理员（`security:manage`） | 读取已配置的 CIDR 允许列表 |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | 管理员（`security:manage`） | 更新 CIDR 允许列表，并防止自我锁定 |
 | `GET` | `/api/v1/enterprise/legal-hold` | 管理员（`compliance:manage`） | 列出用户和团队的法律保留 |

apps/docs/zh-TW/api/rest.md

@@ -1,7 +1,7 @@
 ---
 description: "完整的 REST API 參考。工具端點、批次處理、管線、檔案庫、驗證、團隊與管理操作。"
 i18n_output_hash: 9fa4a9a91996
-i18n_source_hash: b89b5df16af5
+i18n_source_hash: 7e0a0db4abe0
 i18n_provenance: human
 ---
 
@@ -533,7 +533,7 @@ data: {"jobId":"...","type":"batch","status":"processing","completedFiles":2,"to
 
 ## 設定 {#settings}
 
-執行時的鍵值設定（任何已驗證使用者可讀取，僅管理員可寫入）。
+執行階段設定僅使用一組封閉的已識別 key。讀取需要 `settings:read`，寫入需要 `settings:write`；安全性和合規性 key 還分別需要 `security:manage` 或 `compliance:manage`。機密設定需要完整管理員權限，而由專用端點管理的憑證與狀態在此處為唯讀。系統會先驗證整批更新，再寫入任何值。
 
 | Method | Path | 說明 |
 |--------|------|-------------|
@@ -541,7 +541,7 @@ data: {"jobId":"...","type":"batch","status":"processing","completedFiles":2,"to
 | `PUT` | `/api/v1/settings` | 批次更新設定（帶有鍵值對的 JSON 主體） |
 | `GET` | `/api/v1/settings/:key` | 依 key 取得特定設定 |
 
-已知的 key：`disabledTools`（工具 ID 的 JSON 陣列）、`enableExperimentalTools`（bool 字串）、`loginAttemptLimit`（number）。
+代表性 key 包括：`disabledTools`（工具 ID 的 JSON 陣列）、`enableExperimentalTools`（布林值）、`loginAttemptLimit`（安全性政策），以及 `auditRetentionDays`（合規性政策）。未知的 key 會遭到拒絕。
 
 ## 偏好設定 {#preferences}
 
@@ -636,11 +636,13 @@ curl -X POST http://localhost:1349/api/v1/admin/features/import \
 
 這些路由受其相關企業功能的授權控管。它們仍需要所列的 SnapOtter 權限。
 
+**擁有完整權限的內建管理員**是指已驗證的主體具有 `admin` 角色以及完整的有效管理員權限集。若 API 金鑰的權限範圍缺少任何管理員權限，則不符合此要求。
+
 | Method | Path | 存取權限 | 說明 |
 |--------|------|--------|-------------|
 | `GET` | `/api/v1/enterprise/audit/export` | Admin（`audit:read`） | 以 JSON 或 CSV 匯出稽核項目，可加篩選 |
-| `GET` | `/api/v1/enterprise/config/export` | Admin（`system:health`） | 匯出已遮蔽的執行個體設定、自訂角色與團隊 |
-| `POST` | `/api/v1/enterprise/config/import` | Admin（`system:health`） | 匯入設定，可選乾跑 |
+| `GET` | `/api/v1/enterprise/config/export` | 擁有完整權限的內建管理員 | 匯出已遮蔽的執行個體設定、自訂角色與團隊 |
+| `POST` | `/api/v1/enterprise/config/import` | 擁有完整權限的內建管理員 | 匯入設定，可選乾跑 |
 | `GET` | `/api/v1/enterprise/ip-allowlist` | Admin（`security:manage`） | 讀取已設定的 CIDR 允許清單 |
 | `PUT` | `/api/v1/enterprise/ip-allowlist` | Admin（`security:manage`） | 更新 CIDR 允許清單，並防止自我鎖定 |
 | `GET` | `/api/v1/enterprise/legal-hold` | Admin（`compliance:manage`） | 列出使用者與團隊的法律保留 |

apps/web/src/components/settings/settings-dialog.tsx

@@ -531,7 +531,7 @@ function GeneralSection() {
 
 function SystemSection() {
   const { t } = useTranslation();
-  const { role } = useAuth();
+  const { role, hasPermission } = useAuth();
   const analyticsConfig = useAnalyticsStore((s) => s.config);
   const analyticsConfigLoaded = useAnalyticsStore((s) => s.configLoaded);
   const [settings, setSettings] = useState<Record<string, string>>({});
@@ -686,20 +686,22 @@ function SystemSection() {
         </select>
       </SettingRow>
 
-      <SettingRow
-        label={t.settings.system.loginAttemptLimitLabel}
-        description={t.settings.system.loginAttemptLimitDescription}
-      >
-        <input
-          type="number"
-          value={settings.loginAttemptLimit || "5"}
-          onChange={(e) => updateSetting("loginAttemptLimit", e.target.value)}
-          aria-label={t.settings.system.loginAttemptLimitLabel}
-          className="px-3 py-1.5 rounded-lg border border-border bg-background text-sm text-foreground w-24"
-          min={1}
-          max={100}
-        />
-      </SettingRow>
+      {hasPermission("security:manage") && (
+        <SettingRow
+          label={t.settings.system.loginAttemptLimitLabel}
+          description={t.settings.system.loginAttemptLimitDescription}
+        >
+          <input
+            type="number"
+            value={settings.loginAttemptLimit || "5"}
+            onChange={(e) => updateSetting("loginAttemptLimit", e.target.value)}
+            aria-label={t.settings.system.loginAttemptLimitLabel}
+            className="px-3 py-1.5 rounded-lg border border-border bg-background text-sm text-foreground w-24"
+            min={1}
+            max={100}
+          />
+        </SettingRow>
+      )}
 
       <div className="pt-4 border-t border-border">
         <h4 className="text-sm font-semibold text-foreground mb-3">
@@ -807,19 +809,21 @@ function SystemSection() {
           min={0}
         />
       </SettingRow>
-      <SettingRow
-        label={t.settings.dataRetention.auditRetentionDays}
-        description={t.settings.dataRetention.auditRetentionDaysDesc}
-      >
-        <input
-          type="number"
-          value={settings.auditRetentionDays || "0"}
-          onChange={(e) => updateSetting("auditRetentionDays", e.target.value)}
-          aria-label={t.settings.dataRetention.auditRetentionDays}
-          className="px-3 py-1.5 rounded-lg border border-border bg-background text-sm text-foreground w-24"
-          min={0}
-        />
-      </SettingRow>
+      {hasPermission("compliance:manage") && (
+        <SettingRow
+          label={t.settings.dataRetention.auditRetentionDays}
+          description={t.settings.dataRetention.auditRetentionDaysDesc}
+        >
+          <input
+            type="number"
+            value={settings.auditRetentionDays || "0"}
+            onChange={(e) => updateSetting("auditRetentionDays", e.target.value)}
+            aria-label={t.settings.dataRetention.auditRetentionDays}
+            className="px-3 py-1.5 rounded-lg border border-border bg-background text-sm text-foreground w-24"
+            min={0}
+          />
+        </SettingRow>
+      )}
 
       <div className="flex items-center gap-3 pt-2">
         <button
@@ -1065,7 +1069,9 @@ function SecuritySection() {
 
       <TwoFactorSettings />
 
-      {hasPermission("settings:write") && <AdminSecuritySettings />}
+      {hasPermission("settings:write") && hasPermission("security:manage") && (
+        <AdminSecuritySettings />
+      )}
     </div>
   );
 }
@@ -1235,7 +1241,7 @@ export function AdminSecuritySettings() {
           onChange={(e) => updateSetting("passwordMinLength", e.target.value)}
           aria-label={t.settings.security.passwordMinLength}
           className="px-3 py-1.5 rounded-lg border border-border bg-background text-sm text-foreground w-24"
-          min={1}
+          min={8}
           max={128}
         />
       </SettingRow>
@@ -1276,23 +1282,23 @@ export function AdminSecuritySettings() {
         <button
           type="button"
           role="switch"
-          aria-checked={settings.passwordRequireNumber !== "false"}
+          aria-checked={settings.passwordRequireDigit !== "false"}
           aria-label={t.settings.security.passwordRequireNumber}
           onClick={() =>
             updateSetting(
-              "passwordRequireNumber",
-              settings.passwordRequireNumber === "false" ? "true" : "false",
+              "passwordRequireDigit",
+              settings.passwordRequireDigit === "false" ? "true" : "false",
             )
           }
           className={cn(
             "w-11 h-6 rounded-full transition-colors relative",
-            settings.passwordRequireNumber !== "false" ? "bg-primary" : "bg-muted-foreground/30",
+            settings.passwordRequireDigit !== "false" ? "bg-primary" : "bg-muted-foreground/30",
           )}
         >
           <span
             className={cn(
               "block w-4 h-4 rounded-full bg-white absolute top-1 transition-transform",
-              settings.passwordRequireNumber !== "false" ? "translate-x-6" : "translate-x-1",
+              settings.passwordRequireDigit !== "false" ? "translate-x-6" : "translate-x-1",
             )}
           />
         </button>

apps/web/src/lib/settings-payload.ts

@@ -1,8 +1,20 @@
-// PUT /v1/settings rejects server-managed read-only keys (instance_id, cookie_secret)
-// with 400 READONLY_SETTING, and GET returns redacted secrets as the literal "********".
-// Echoing either back breaks the save or overwrites a real secret with the mask, so strip
-// both before any bulk save.
-const READONLY_SETTING_KEYS = new Set(["instance_id", "cookie_secret"]);
+// PUT /v1/settings rejects server-managed and dedicated-endpoint keys. GET can still
+// return some of them to a full administrator for status display, so strip them from
+// every generic bulk save along with redacted secret masks.
+const READONLY_SETTING_KEYS = new Set([
+  "instance_id",
+  "cookie_secret",
+  "sqlite_import",
+  "onboarding.firstProcessedAt",
+  "scim_token_hash",
+  "siem_config",
+  "webhook_destinations",
+  "ipAllowlist",
+  "backup_last_completed",
+  "audit_archival_state",
+  "siem_last_forwarded_at",
+  "siem_consecutive_failures",
+]);
 
 export function writableSettings(settings: Record<string, string>): Record<string, string> {
   return Object.fromEntries(