fix: enforce settings authority boundaries (#618)

Close generic settings authorization bypasses and enforce per-setting authority, validation, redaction, transactional config import, and route-local write rate limiting.

apps/api/src/lib/settings-policy.ts

@@ -0,0 +1,293 @@
+import { type Permission, SUPPORTED_LOCALES } from "@snapotter/shared";
+import { type ZodIssue, z } from "zod";
+import { env } from "../config.js";
+
+export type SettingAuthority = Permission | "full-admin" | "none";
+
+export interface SettingPolicy {
+  read: SettingAuthority;
+  write: SettingAuthority;
+  encrypted?: boolean;
+  redacted?: boolean;
+  schema?: z.ZodType<string, z.ZodTypeDef, unknown>;
+  storageKey?: string;
+}
+
+const booleanSetting = z
+  .union([z.boolean(), z.enum(["true", "false"])])
+  .transform((value) => String(value));
+
+function integerSetting(
+  minimum: number,
+  maximum = Number.MAX_SAFE_INTEGER,
+): z.ZodType<string, z.ZodTypeDef, unknown> {
+  return z
+    .union([z.number(), z.string()])
+    .transform((value) => (typeof value === "number" ? value : Number(value)))
+    .refine(Number.isSafeInteger, "Must be an integer")
+    .refine((value) => value >= minimum, `Must be at least ${minimum}`)
+    .refine((value) => value <= maximum, `Must be at most ${maximum}`)
+    .transform(String);
+}
+
+function finiteNumberSetting(minimumExclusive: number): z.ZodType<string, z.ZodTypeDef, unknown> {
+  return z
+    .union([z.number(), z.string()])
+    .transform((value) => (typeof value === "number" ? value : Number(value)))
+    .refine(Number.isFinite, "Must be a finite number")
+    .refine((value) => value > minimumExclusive, `Must be greater than ${minimumExclusive}`)
+    .transform(String);
+}
+
+const timestampSetting = z
+  .string()
+  .max(100)
+  .refine((value) => Number.isFinite(Date.parse(value)), "Must be an ISO-8601 timestamp")
+  .transform((value) => new Date(value).toISOString());
+
+const disabledToolsSetting = z
+  .preprocess(
+    (value) => {
+      if (typeof value !== "string") return value;
+      try {
+        return JSON.parse(value);
+      } catch {
+        return value;
+      }
+    },
+    z.array(z.string().min(1).max(200)).max(5000),
+  )
+  .transform((value) => JSON.stringify(value));
+
+const localeCodes = new Set(SUPPORTED_LOCALES.map((locale) => locale.code));
+const localeSetting = z
+  .string()
+  .refine((value) => localeCodes.has(value), "Must be a supported locale");
+
+const breakGlassUsernameSetting = z
+  .string()
+  .max(50)
+  .refine(
+    (value) => value === "" || /^[A-Za-z0-9_.-]{3,50}$/.test(value),
+    "Must be empty or a valid username",
+  );
+
+const boundedSecretSetting = z.string().max(65_536);
+
+const general = (schema: z.ZodType<string, z.ZodTypeDef, unknown>): SettingPolicy => ({
+  read: "settings:read",
+  write: "settings:write",
+  schema,
+});
+
+const security = (
+  schema: z.ZodType<string, z.ZodTypeDef, unknown>,
+  storageKey?: string,
+): SettingPolicy => ({
+  read: "security:manage",
+  write: "security:manage",
+  schema,
+  ...(storageKey ? { storageKey } : {}),
+});
+
+const compliance = (schema: z.ZodType<string, z.ZodTypeDef, unknown>): SettingPolicy => ({
+  read: "compliance:manage",
+  write: "compliance:manage",
+  schema,
+});
+
+const fullAdminSecret = (schema: z.ZodType<string, z.ZodTypeDef, unknown>): SettingPolicy => ({
+  encrypted: true,
+  read: "full-admin",
+  redacted: true,
+  write: "full-admin",
+  schema,
+});
+
+const readonly = (options: Pick<SettingPolicy, "encrypted" | "redacted"> = {}): SettingPolicy => ({
+  read: "full-admin",
+  write: "none",
+  ...options,
+});
+
+/**
+ * Closed registry for every first-party key accepted by the generic settings API.
+ * Security-sensitive keys must be added here deliberately so a new runtime
+ * consumer cannot silently inherit the coarse settings:write permission.
+ */
+const SETTING_POLICIES: Readonly<Record<string, SettingPolicy>> = {
+  defaultTheme: general(z.enum(["light", "dark", "system"])),
+  defaultLocale: general(localeSetting),
+  defaultToolView: general(z.enum(["sidebar", "fullscreen"])),
+  fileUploadLimitMb: general(finiteNumberSetting(0)),
+  tempFileMaxAgeHours: general(finiteNumberSetting(0)),
+  startupCleanup: general(booleanSetting),
+  analyticsEnabled: general(booleanSetting),
+  jobsRetentionDays: general(integerSetting(0)),
+  disabledTools: general(disabledToolsSetting),
+  enableExperimentalTools: general(booleanSetting),
+  rateLimitPerUser: general(integerSetting(0)),
+  maxConcurrentJobsPerUser: general(integerSetting(0)),
+  "feedback.install.submittedAt": general(timestampSetting),
+  "feedback.install.snoozedUntil": general(timestampSetting),
+  "feedback.install.dismissedAt": general(timestampSetting),
+  "onboarding.usageSurvey.answeredAt": general(timestampSetting),
+  "onboarding.usageSurvey.dismissedAt": general(timestampSetting),
+  "sqlite_import.dismissedAt": general(timestampSetting),
+
+  loginAttemptLimit: security(integerSetting(1)),
+  sessionIdleTimeoutMinutes: security(integerSetting(0)),
+  maxSessionsPerUser: security(integerSetting(0)),
+  mfaPolicy: security(z.enum(["optional", "admins_only", "required"])),
+  ssoEnforcement: security(booleanSetting),
+  ssoBreakGlassUsername: security(breakGlassUsernameSetting),
+  passwordMinLength: security(integerSetting(8, 128)),
+  passwordRequireUppercase: security(booleanSetting),
+  passwordRequireLowercase: security(booleanSetting),
+  passwordRequireDigit: security(booleanSetting),
+  passwordRequireNumber: security(booleanSetting, "passwordRequireDigit"),
+  passwordRequireSpecial: security(booleanSetting),
+
+  auditRetentionDays: compliance(integerSetting(0)),
+  auditArchiveMonths: compliance(integerSetting(0)),
+  auditToolOperations: compliance(booleanSetting),
+  tamperResistantAudit: compliance(booleanSetting),
+
+  oidc_client_secret: fullAdminSecret(boundedSecretSetting),
+  saml_idp_certificate: fullAdminSecret(boundedSecretSetting),
+  siem_webhook_auth: fullAdminSecret(boundedSecretSetting),
+
+  cookie_secret: readonly({ encrypted: true, redacted: true }),
+  instance_id: readonly(),
+  sqlite_import: readonly(),
+  "onboarding.firstProcessedAt": readonly(),
+  scim_token_hash: readonly({ encrypted: true, redacted: true }),
+  siem_config: readonly({ redacted: true }),
+  webhook_destinations: readonly({ redacted: true }),
+  ipAllowlist: readonly(),
+  backup_last_completed: readonly(),
+  audit_archival_state: readonly(),
+  siem_last_forwarded_at: readonly(),
+  siem_consecutive_failures: readonly(),
+};
+
+export function getSettingPolicy(key: string): SettingPolicy | undefined {
+  return SETTING_POLICIES[key];
+}
+
+export function isConfigExportableSetting(key: string): boolean {
+  const policy = getSettingPolicy(key);
+  return Boolean(
+    policy &&
+      policy.write !== "none" &&
+      !policy.redacted &&
+      (!policy.storageKey || policy.storageKey === key),
+  );
+}
+
+export type SettingsRuntimeValidation =
+  | { success: true }
+  | {
+      success: false;
+      statusCode: 400 | 403;
+      code: "DEPENDENCY_VALIDATION_FAILED" | "FEATURE_NOT_LICENSED";
+      error: string;
+      validationErrors?: string[];
+    };
+
+/** Validate constraints that depend on runtime state rather than value shape. */
+export async function validateSettingsRuntimeConstraints(
+  settings: ReadonlyArray<{ key: string; value: string }>,
+): Promise<SettingsRuntimeValidation> {
+  const enforcesMfa = settings.some(
+    ({ key, value }) => key === "mfaPolicy" && (value === "admins_only" || value === "required"),
+  );
+  if (enforcesMfa) {
+    let mfaLicensed = false;
+    try {
+      const { isFeatureEnabled } = await import("@snapotter/enterprise");
+      mfaLicensed = isFeatureEnabled("mfa");
+    } catch {
+      // Enterprise package not available.
+    }
+
+    if (!mfaLicensed) {
+      return {
+        success: false,
+        statusCode: 403,
+        error: "MFA requires an enterprise license",
+        code: "FEATURE_NOT_LICENSED",
+      };
+    }
+  }
+
+  const enforcesSso = settings.some(
+    ({ key, value }) => key === "ssoEnforcement" && value === "true",
+  );
+  if (enforcesSso && !env.OIDC_ENABLED && !env.SAML_ENABLED) {
+    const validationErrors = [
+      "ssoEnforcement is enabled but no OIDC or SAML provider is configured",
+    ];
+    return {
+      success: false,
+      statusCode: 400,
+      error: "Dependency validation failed",
+      code: "DEPENDENCY_VALIDATION_FAILED",
+      validationErrors,
+    };
+  }
+
+  return { success: true };
+}
+
+export type PreparedSetting =
+  | {
+      success: true;
+      key: string;
+      value: string;
+      policy: SettingPolicy;
+    }
+  | {
+      success: false;
+      code: "UNKNOWN_SETTING" | "VALIDATION_ERROR";
+      error: string;
+      details?: ZodIssue[];
+    };
+
+export function prepareSetting(key: string, value: unknown): PreparedSetting {
+  const policy = getSettingPolicy(key);
+  if (!policy) {
+    return {
+      success: false,
+      code: "UNKNOWN_SETTING",
+      error: `Unknown setting "${key}"`,
+    };
+  }
+
+  if (!policy.schema) {
+    const serialized = typeof value === "string" ? value : JSON.stringify(value);
+    return {
+      success: true,
+      key: policy.storageKey ?? key,
+      value: serialized ?? "",
+      policy,
+    };
+  }
+
+  const parsed = policy.schema.safeParse(value);
+  if (!parsed.success) {
+    return {
+      success: false,
+      code: "VALIDATION_ERROR",
+      error: `Invalid value for setting "${key}"`,
+      details: parsed.error.issues,
+    };
+  }
+
+  return {
+    success: true,
+    key: policy.storageKey ?? key,
+    value: parsed.data,
+    policy,
+  };
+}

apps/api/src/openapi.ar.yaml

@@ -6194,7 +6194,7 @@ paths:
       tags:
         - Settings
       summary: الحصول على جميع الإعدادات
-      description: استرداد جميع إعدادات النظام كأزواج مفتاح-قيمة. يتطلب المصادقة.
+      description: استرداد إعدادات النظام التي تسمح بها الصلاحيات الفعلية للمتصل. يتطلب `settings:read`؛ وتُرشَّح إعدادات الأمان والامتثال والمسؤول الكامل كلٌّ على حدة.
       security:
         - bearerAuth: []
       responses:
@@ -6220,7 +6220,7 @@ paths:
       tags:
         - Settings
       summary: تحديث الإعدادات
-      description: يقبل كائن JSON مسطّح من أزواج مفتاح-قيمة لضبطها. يتطلب دور المسؤول.
+      description: يقبل كائن JSON مسطّحًا يحتوي على مفاتيح إعدادات معروفة وقابلة للكتابة. يتطلب `settings:write`؛ وتتطلب مفاتيح الأمان والامتثال أيضًا الصلاحية الفعلية المطابقة، وتتطلب الإعدادات السرية صلاحية مسؤول كاملة، أما المفاتيح المخصصة أو التي يديرها الخادم فهي للقراءة فقط.
       security:
         - bearerAuth: []
       requestBody:
@@ -6267,7 +6267,7 @@ paths:
       tags:
         - Settings
       summary: الحصول على إعداد واحد
-      description: استرداد قيمة إعداد واحد بواسطة اسم مفتاحه. يُرجع القيمة والطابع الزمني لآخر تحديث.
+      description: استرداد إعداد معروف حسب المفتاح. يُرجع القيمة والطابع الزمني لآخر تحديث عندما يمتلك المتصل كلًا من `settings:read` والصلاحية الإضافية للمفتاح.
       security:
         - bearerAuth: []
       parameters:
@@ -18397,7 +18397,8 @@ paths:
       tags:
         - Enterprise
       summary: تصدير الإعدادات
-      description: تصدير إعدادات المثيل المنقّحة والأدوار المخصصة والفرق. يتطلب إذن system:health.
+      description: |
+        تصدير إعدادات المثيل المنقّحة والأدوار المخصصة والفرق. يتطلب صلاحيات فعّالة وكاملة لمسؤول مضمّن؛ لا تتأهل الأدوار المخصصة، ولا مفاتيح API التي ينقصها أي إذن من أذونات المسؤول.
       security:
         - bearerAuth: []
       responses:
@@ -18412,7 +18413,7 @@ paths:
         - Enterprise
       summary: استيراد الإعدادات
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        استيراد إعدادات المثيل والأدوار المخصصة والفرق. يتطلب صلاحيات فعّالة وكاملة لمسؤول مضمّن؛ لا تتأهل الأدوار المخصصة، ولا مفاتيح API التي ينقصها أي إذن من أذونات المسؤول.
       security:
         - bearerAuth: []
       responses:
@@ -19664,25 +19665,25 @@ x-i18n:
       provenance: machine
       outputHash: 1262280f9c6e
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: e1ec683f5e5c
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 4cfe8f3730f8
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 0023629c3617
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: c77d7bec978d
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: b76279ea2d3f
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 5fcf8f2d6008
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 11dbe8b156b5
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 095b505c1779
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21632,13 +21633,17 @@ x-i18n:
       provenance: machine
       outputHash: 9f53f3a2841a
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: cacf92da7e22
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: b83bec75dec4
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: cb053b845a9d
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: c660c73729fb
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.de.yaml

@@ -6191,7 +6191,7 @@ paths:
       tags:
         - Settings
       summary: Alle Einstellungen abrufen
-      description: Alle Systemeinstellungen als Schlüssel-Wert-Paare abrufen. Erfordert Authentifizierung.
+      description: Ruft die Systemeinstellungen ab, zu denen die effektiven Berechtigungen des Aufrufers berechtigen. Erfordert `settings:read`; Sicherheits-, Compliance- und vollständige Administratoreinstellungen werden jeweils separat gefiltert.
       security:
         - bearerAuth: []
       responses:
@@ -6217,7 +6217,7 @@ paths:
       tags:
         - Settings
       summary: Einstellungen aktualisieren
-      description: Akzeptiert ein flaches JSON-Objekt aus Schlüssel-Wert-Paaren zum Setzen. Erfordert die Admin-Rolle.
+      description: Akzeptiert ein flaches JSON-Objekt mit erkannten, beschreibbaren Einstellungsschlüsseln. Erfordert `settings:write`; Sicherheits- und Compliance-Schlüssel erfordern zusätzlich die jeweils passende effektive Berechtigung, Geheimnisse erfordern die vollständige Administratorberechtigung und dedizierte oder serververwaltete Schlüssel sind schreibgeschützt.
       security:
         - bearerAuth: []
       requestBody:
@@ -6264,7 +6264,7 @@ paths:
       tags:
         - Settings
       summary: Eine einzelne Einstellung abrufen
-      description: Einen einzelnen Einstellungswert anhand seines Schlüsselnamens abrufen. Gibt den Wert und den Zeitstempel der letzten Aktualisierung zurück.
+      description: Ruft eine erkannte Einstellung anhand ihres Schlüssels ab. Gibt den Wert und den Zeitstempel der letzten Aktualisierung zurück, wenn der Aufrufer sowohl `settings:read` als auch die zusätzliche Berechtigung des Schlüssels besitzt.
       security:
         - bearerAuth: []
       parameters:
@@ -18394,7 +18394,8 @@ paths:
       tags:
         - Enterprise
       summary: Konfiguration exportieren
-      description: Geschwärzte Instanzkonfiguration, benutzerdefinierte Rollen und Teams exportieren. Erfordert die Berechtigung system:health.
+      description: |
+        Geschwärzte Instanzkonfiguration, benutzerdefinierte Rollen und Teams exportieren. Erfordert die vollständige effektive Berechtigung eines integrierten Administrators; benutzerdefinierte Rollen sind nicht zulässig, ebenso wenig API-Schlüssel, denen auch nur eine Administratorberechtigung fehlt.
       security:
         - bearerAuth: []
       responses:
@@ -18409,7 +18410,7 @@ paths:
         - Enterprise
       summary: Konfiguration importieren
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Instanzkonfiguration, benutzerdefinierte Rollen und Teams importieren. Erfordert die vollständige effektive Berechtigung eines integrierten Administrators; benutzerdefinierte Rollen sind nicht zulässig, ebenso wenig API-Schlüssel, denen auch nur eine Administratorberechtigung fehlt.
       security:
         - bearerAuth: []
       responses:
@@ -19661,25 +19662,25 @@ x-i18n:
       provenance: machine
       outputHash: e8795091074e
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 370caf182a66
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: f104c8a3fe10
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: ae9fe22e7c45
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: ed77431f7a09
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: c8e069512be0
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 3c0291a04d61
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 1066c0dd57dd
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 28ce113c2055
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21629,13 +21630,17 @@ x-i18n:
       provenance: machine
       outputHash: f3710da98e9d
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 614419e41180
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: aaea0072c382
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 690fb30ee112
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: f353b61c4566
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.es.yaml

@@ -6195,7 +6195,7 @@ paths:
       tags:
         - Settings
       summary: Obtener todos los ajustes
-      description: Recupera todos los ajustes del sistema como pares clave-valor. Requiere autenticación.
+      description: Recupera los ajustes del sistema autorizados por los permisos efectivos del solicitante. Requiere `settings:read`; los ajustes de seguridad, cumplimiento y administrador pleno se filtran por separado.
       security:
         - bearerAuth: []
       responses:
@@ -6221,7 +6221,7 @@ paths:
       tags:
         - Settings
       summary: Actualizar ajustes
-      description: Acepta un objeto JSON plano de pares clave-valor para establecer. Requiere el rol de administrador.
+      description: Acepta un objeto JSON plano que contiene claves de ajustes reconocidas y escribibles. Requiere `settings:write`; las claves de seguridad y cumplimiento requieren además su permiso efectivo correspondiente, los secretos requieren autoridad de administrador pleno y las claves específicas o gestionadas por el servidor son de solo lectura.
       security:
         - bearerAuth: []
       requestBody:
@@ -6268,7 +6268,7 @@ paths:
       tags:
         - Settings
       summary: Obtener un solo ajuste
-      description: Recupera el valor de un solo ajuste por su nombre de clave. Devuelve el valor y la marca de tiempo de la última actualización.
+      description: Recupera un ajuste reconocido por clave. Devuelve el valor y la marca de tiempo de la última actualización cuando el solicitante tiene tanto `settings:read` como la autoridad adicional de la clave.
       security:
         - bearerAuth: []
       parameters:
@@ -18398,7 +18398,8 @@ paths:
       tags:
         - Enterprise
       summary: Exportar configuración
-      description: Exporta la configuración de instancia, los roles personalizados y los equipos con datos ocultos. Requiere el permiso system:health.
+      description: |
+        Exporta la configuración de instancia, los roles personalizados y los equipos con datos ocultos. Requiere autoridad efectiva completa de administrador integrado; los roles personalizados no cumplen el requisito, ni tampoco las claves de API a las que les falte cualquier permiso de administrador.
       security:
         - bearerAuth: []
       responses:
@@ -18413,7 +18414,7 @@ paths:
         - Enterprise
       summary: Importar configuración
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Importa la configuración de instancia, los roles personalizados y los equipos. Requiere autoridad efectiva completa de administrador integrado; los roles personalizados no cumplen el requisito, ni tampoco las claves de API a las que les falte cualquier permiso de administrador.
       security:
         - bearerAuth: []
       responses:
@@ -19665,25 +19666,25 @@ x-i18n:
       provenance: machine
       outputHash: 862c4c5821b7
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 09a24816393d
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 5944419bed64
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 3cc6d401df39
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 2f17092c37cc
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 598c9c86bd29
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 7dfd64b62ef9
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: bd49c5e3c701
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: c80feeaf5943
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21633,13 +21634,17 @@ x-i18n:
       provenance: machine
       outputHash: 9b4ebaabe258
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: c707b400987f
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: a8568826d1ae
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: b6274c66f0c5
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: e166fcc46360
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.fr.yaml

@@ -6195,7 +6195,7 @@ paths:
       tags:
         - Settings
       summary: Obtenir tous les paramètres
-      description: Récupère tous les paramètres système sous forme de paires clé-valeur. Requiert une authentification.
+      description: Récupère les paramètres système autorisés par les permissions effectives de l'appelant. Nécessite `settings:read` ; les paramètres de sécurité, de conformité et d'administrateur complet sont filtrés séparément.
       security:
         - bearerAuth: []
       responses:
@@ -6221,7 +6221,7 @@ paths:
       tags:
         - Settings
       summary: Mettre à jour les paramètres
-      description: Accepte un objet JSON plat de paires clé-valeur à définir. Requiert le rôle admin.
+      description: Accepte un objet JSON plat contenant des clés de paramètres reconnues et modifiables. Nécessite `settings:write` ; les clés de sécurité et de conformité nécessitent en plus la permission effective correspondante, les secrets nécessitent les droits d'un administrateur complet et les clés dédiées ou gérées par le serveur sont en lecture seule.
       security:
         - bearerAuth: []
       requestBody:
@@ -6268,7 +6268,7 @@ paths:
       tags:
         - Settings
       summary: Obtenir un paramètre unique
-      description: Récupère la valeur d'un paramètre unique par son nom de clé. Renvoie la valeur et l'horodatage de dernière mise à jour.
+      description: Récupère un paramètre reconnu par clé. Renvoie la valeur et l'horodatage de dernière mise à jour lorsque l'appelant possède à la fois `settings:read` et l'autorité supplémentaire de la clé.
       security:
         - bearerAuth: []
       parameters:
@@ -18378,7 +18378,8 @@ paths:
       tags:
         - Enterprise
       summary: Exporter la configuration
-      description: Exporte la configuration d'instance expurgée, les rôles personnalisés et les équipes. Requiert la permission system:health.
+      description: |
+        Exporte la configuration d'instance expurgée, les rôles personnalisés et les équipes. Requiert l'autorité effective complète d'un administrateur intégré ; les rôles personnalisés ne sont pas admissibles, pas plus que les clés API auxquelles il manque une seule permission d'administrateur.
       security:
         - bearerAuth: []
       responses:
@@ -18393,7 +18394,7 @@ paths:
         - Enterprise
       summary: Importer la configuration
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Importe la configuration d'instance, les rôles personnalisés et les équipes. Requiert l'autorité effective complète d'un administrateur intégré ; les rôles personnalisés ne sont pas admissibles, pas plus que les clés API auxquelles il manque une seule permission d'administrateur.
       security:
         - bearerAuth: []
       responses:
@@ -19645,25 +19646,25 @@ x-i18n:
       provenance: machine
       outputHash: b70c3c92d7f6
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 8720b9ff1c0c
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 2c06b77c18c0
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 74ea56ee20f2
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 3e54e8c482c9
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: dde1658a5b80
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: eedbcd4081b1
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 27ef7b78107f
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 39200ccf8e60
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21613,13 +21614,17 @@ x-i18n:
       provenance: machine
       outputHash: 1e2c987abfe2
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 51d77ffdd098
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: d56c8c1c6eff
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: a40e966d8e6e
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 1ea731aea890
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.hi.yaml

@@ -6193,7 +6193,7 @@ paths:
       tags:
         - Settings
       summary: सभी settings प्राप्त करें
-      description: सभी सिस्टम settings को key-value जोड़े के रूप में पुनर्प्राप्त करें। authentication आवश्यक है।
+      description: कॉलर की प्रभावी अनुमतियों द्वारा अधिकृत सिस्टम सेटिंग्स प्राप्त करें। `settings:read` आवश्यक है; सुरक्षा, अनुपालन और पूर्ण-एडमिन सेटिंग्स को अलग-अलग फ़िल्टर किया जाता है।
       security:
         - bearerAuth: []
       responses:
@@ -6219,7 +6219,7 @@ paths:
       tags:
         - Settings
       summary: settings अपडेट करें
-      description: सेट करने के लिए key-value जोड़ों का एक फ़्लैट JSON object स्वीकार करता है। admin role आवश्यक है।
+      description: मान्य और लिखने योग्य सेटिंग कीज़ वाला एक फ़्लैट JSON ऑब्जेक्ट स्वीकार करता है। `settings:write` आवश्यक है; सुरक्षा और अनुपालन कीज़ के लिए उनकी संबंधित प्रभावी अनुमति भी आवश्यक है, गोपनीय मानों के लिए पूर्ण-एडमिन अधिकार आवश्यक हैं, और समर्पित या सर्वर-प्रबंधित कीज़ केवल पढ़ने योग्य हैं।
       security:
         - bearerAuth: []
       requestBody:
@@ -6266,7 +6266,7 @@ paths:
       tags:
         - Settings
       summary: एकल setting प्राप्त करें
-      description: एक एकल setting मान को उसके key नाम से पुनर्प्राप्त करें। मान और अंतिम-अपडेट टाइमस्टैम्प लौटाता है।
+      description: की द्वारा एक मान्य सेटिंग प्राप्त करें। जब कॉलर के पास `settings:read` और उस की का अतिरिक्त अधिकार दोनों हों, तब मान और अंतिम-अपडेट टाइमस्टैम्प लौटाता है।
       security:
         - bearerAuth: []
       parameters:
@@ -18393,7 +18393,8 @@ paths:
       tags:
         - Enterprise
       summary: configuration निर्यात करें
-      description: redacted instance configuration, कस्टम roles, और teams निर्यात करें। system:health permission आवश्यक है।
+      description: |
+        संशोधित इंस्टेंस कॉन्फ़िगरेशन, कस्टम भूमिकाएँ और टीमें निर्यात करें। पूर्ण प्रभावी अंतर्निहित एडमिन अधिकार आवश्यक है; कस्टम भूमिकाएँ योग्य नहीं हैं और वे API कुंजियाँ भी योग्य नहीं हैं जिनमें एडमिन की कोई अनुमति अनुपलब्ध है।
       security:
         - bearerAuth: []
       responses:
@@ -18408,7 +18409,7 @@ paths:
         - Enterprise
       summary: configuration आयात करें
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        इंस्टेंस कॉन्फ़िगरेशन, कस्टम भूमिकाएँ और टीमें आयात करें। पूर्ण प्रभावी अंतर्निहित एडमिन अधिकार आवश्यक है; कस्टम भूमिकाएँ योग्य नहीं हैं और वे API कुंजियाँ भी योग्य नहीं हैं जिनमें एडमिन की कोई अनुमति अनुपलब्ध है।
       security:
         - bearerAuth: []
       responses:
@@ -19660,25 +19661,25 @@ x-i18n:
       provenance: machine
       outputHash: c6fdce15d344
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: d3e94911b256
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 970c5299cc14
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 072888ed4abc
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: b02ca90edfb4
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: aab6513a2028
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 4dde6655440e
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 9317b165aad6
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: b6fec86f5f9e
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21628,13 +21629,17 @@ x-i18n:
       provenance: machine
       outputHash: 90c5442816d3
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 95221fc9e75c
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 67b7c13336de
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: a35b2c408440
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 941451f40982
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.id.yaml

@@ -6195,7 +6195,7 @@ paths:
       tags:
         - Settings
       summary: Dapatkan semua settings
-      description: Ambil semua settings sistem sebagai pasangan key-value. Memerlukan autentikasi.
+      description: Ambil pengaturan sistem yang diizinkan oleh izin efektif pemanggil. Memerlukan `settings:read`; pengaturan keamanan, kepatuhan, dan admin penuh difilter secara terpisah.
       security:
         - bearerAuth: []
       responses:
@@ -6221,7 +6221,7 @@ paths:
       tags:
         - Settings
       summary: Perbarui settings
-      description: Menerima objek JSON datar berisi pasangan key-value untuk diatur. Memerlukan role admin.
+      description: Menerima objek JSON datar yang berisi kunci pengaturan yang dikenali dan dapat ditulis. Memerlukan `settings:write`; kunci keamanan dan kepatuhan juga memerlukan izin efektif yang sesuai, rahasia memerlukan wewenang admin penuh, dan kunci khusus atau yang dikelola server hanya dapat dibaca.
       security:
         - bearerAuth: []
       requestBody:
@@ -6268,7 +6268,7 @@ paths:
       tags:
         - Settings
       summary: Dapatkan satu setting
-      description: Ambil satu nilai setting berdasarkan nama key-nya. Mengembalikan nilai dan timestamp terakhir diperbarui.
+      description: Ambil pengaturan yang dikenali berdasarkan kunci. Mengembalikan nilai dan stempel waktu pembaruan terakhir ketika pemanggil memiliki `settings:read` serta wewenang tambahan untuk kunci tersebut.
       security:
         - bearerAuth: []
       parameters:
@@ -18398,7 +18398,8 @@ paths:
       tags:
         - Enterprise
       summary: Ekspor konfigurasi
-      description: Ekspor konfigurasi instance yang disunting, role kustom, dan teams. Memerlukan permission system:health.
+      description: |
+        Ekspor konfigurasi instans yang disunting, peran kustom, dan tim. Memerlukan kewenangan efektif penuh sebagai administrator bawaan; peran kustom tidak memenuhi syarat, demikian pula kunci API yang tidak mencakup semua izin administrator.
       security:
         - bearerAuth: []
       responses:
@@ -18413,7 +18414,7 @@ paths:
         - Enterprise
       summary: Impor konfigurasi
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Impor konfigurasi instans, peran kustom, dan tim. Memerlukan kewenangan efektif penuh sebagai administrator bawaan; peran kustom tidak memenuhi syarat, demikian pula kunci API yang tidak mencakup semua izin administrator.
       security:
         - bearerAuth: []
       responses:
@@ -19665,25 +19666,25 @@ x-i18n:
       provenance: machine
       outputHash: 1aab5d5325ae
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: e63beb9e2cdc
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 16bc43350f34
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 453963b68132
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 5a2be16b8683
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 9d7505a0cb61
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 814fbb078520
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 69883260d6ad
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: ef77c0d8af03
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21633,13 +21634,17 @@ x-i18n:
       provenance: machine
       outputHash: 3bb3de7ecbbf
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 643bd277962f
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 03167a2a49ed
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 1f25d439e461
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 66dd2399c1d1
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.it.yaml

@@ -6195,7 +6195,7 @@ paths:
       tags:
         - Settings
       summary: Ottieni tutte le impostazioni
-      description: Recupera tutte le impostazioni di sistema come coppie chiave-valore. Richiede l'autenticazione.
+      description: Recupera le impostazioni di sistema autorizzate dalle autorizzazioni effettive del chiamante. Richiede `settings:read`; le impostazioni di sicurezza, conformità e amministratore completo vengono filtrate separatamente.
       security:
         - bearerAuth: []
       responses:
@@ -6221,7 +6221,7 @@ paths:
       tags:
         - Settings
       summary: Aggiorna impostazioni
-      description: Accetta un oggetto JSON piatto di coppie chiave-valore da impostare. Richiede il ruolo admin.
+      description: Accetta un oggetto JSON piatto contenente chiavi di impostazione riconosciute e scrivibili. Richiede `settings:write`; le chiavi di sicurezza e conformità richiedono inoltre la rispettiva autorizzazione effettiva, i segreti richiedono l'autorità di amministratore completo e le chiavi dedicate o gestite dal server sono di sola lettura.
       security:
         - bearerAuth: []
       requestBody:
@@ -6268,7 +6268,7 @@ paths:
       tags:
         - Settings
       summary: Ottieni una singola impostazione
-      description: Recupera il valore di una singola impostazione tramite il nome della sua chiave. Restituisce il valore e il timestamp dell'ultimo aggiornamento.
+      description: Recupera un'impostazione riconosciuta tramite la chiave. Restituisce il valore e il timestamp dell'ultimo aggiornamento quando il chiamante dispone sia di `settings:read` sia dell'autorità aggiuntiva della chiave.
       security:
         - bearerAuth: []
       parameters:
@@ -18398,7 +18398,8 @@ paths:
       tags:
         - Enterprise
       summary: Esporta configurazione
-      description: Esporta la configurazione oscurata dell'istanza, i ruoli personalizzati e i team. Richiede il permesso system:health.
+      description: |
+        Esporta la configurazione oscurata dell'istanza, i ruoli personalizzati e i team. Richiede l'autorità effettiva completa di un amministratore integrato; i ruoli personalizzati non sono idonei, né lo sono le chiavi API prive anche di una sola autorizzazione amministrativa.
       security:
         - bearerAuth: []
       responses:
@@ -18413,7 +18414,7 @@ paths:
         - Enterprise
       summary: Importa configurazione
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Importa la configurazione dell'istanza, i ruoli personalizzati e i team. Richiede l'autorità effettiva completa di un amministratore integrato; i ruoli personalizzati non sono idonei, né lo sono le chiavi API prive anche di una sola autorizzazione amministrativa.
       security:
         - bearerAuth: []
       responses:
@@ -19665,25 +19666,25 @@ x-i18n:
       provenance: machine
       outputHash: f9cdc1e7455c
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 14097383c829
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 5cdfc3e48c16
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 14c1ddae327c
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 37bf1f7dad61
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: b6a0e1964254
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: b30db479d104
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 1c921a65d3bb
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 8583f2d1dfee
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21633,13 +21634,17 @@ x-i18n:
       provenance: machine
       outputHash: e07ab8c81b04
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: fe14c176c9e2
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 7cf25f1e1e9c
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: a5c7f6cb48a5
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 300f32c73293
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.ja.yaml

@@ -6160,7 +6160,7 @@ paths:
       tags:
         - Settings
       summary: すべての設定の取得
-      description: すべてのシステム設定をキーと値のペアとして取得します。認証が必要です。
+      description: 呼び出し元の有効な権限で許可されたシステム設定を取得します。`settings:read` が必要です。セキュリティ、コンプライアンス、完全な管理者向けの設定は、それぞれ個別にフィルタリングされます。
       security:
         - bearerAuth: []
       responses:
@@ -6186,7 +6186,7 @@ paths:
       tags:
         - Settings
       summary: 設定の更新
-      description: 設定するキーと値のペアのフラットな JSON オブジェクトを受け付けます。管理者ロールが必要です。
+      description: 認識済みで書き込み可能な設定キーを含むフラットな JSON オブジェクトを受け付けます。`settings:write` が必要です。セキュリティおよびコンプライアンスのキーには対応する有効な権限も、秘密情報には完全な管理者権限も必要で、専用またはサーバー管理のキーは読み取り専用です。
       security:
         - bearerAuth: []
       requestBody:
@@ -6233,7 +6233,7 @@ paths:
       tags:
         - Settings
       summary: 単一設定の取得
-      description: キー名で単一の設定値を取得します。値と最終更新タイムスタンプを返します。
+      description: 認識済みの設定をキーで取得します。呼び出し元が `settings:read` とそのキーに必要な追加権限の両方を持つ場合に、値と最終更新タイムスタンプを返します。
       security:
         - bearerAuth: []
       parameters:
@@ -18327,7 +18327,8 @@ paths:
       tags:
         - Enterprise
       summary: 設定のエクスポート
-      description: 編集除去済みのインスタンス設定、カスタムロール、チームをエクスポートします。system:health 権限が必要です。
+      description: |
+        秘匿化されたインスタンス設定、カスタムロール、チームをエクスポートします。完全かつ実効的な組み込み管理者権限が必要です。カスタムロールは対象外であり、管理者権限が一つでも欠けている API キーも対象外です。
       security:
         - bearerAuth: []
       responses:
@@ -18342,7 +18343,7 @@ paths:
         - Enterprise
       summary: 設定のインポート
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        インスタンス設定、カスタムロール、チームをインポートします。完全かつ実効的な組み込み管理者権限が必要です。カスタムロールは対象外であり、管理者権限が一つでも欠けている API キーも対象外です。
       security:
         - bearerAuth: []
       responses:
@@ -19594,25 +19595,25 @@ x-i18n:
       provenance: machine
       outputHash: 2d107a5eb4f3
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 307ae971697e
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 9a58dcc21002
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 98cfb65d08f6
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: d5c6d2ccac83
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 9bcfba34c986
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 48db6298cef0
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 4fa6b2c77ee2
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 6fa9dce31531
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21562,13 +21563,17 @@ x-i18n:
       provenance: machine
       outputHash: efea2136bc64
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: cf999b06bf18
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: a2674017cc21
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 9658e7ae2aa5
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: a56e90fb33e9
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.ko.yaml

@@ -6194,7 +6194,7 @@ paths:
       tags:
         - Settings
       summary: 모든 설정 가져오기
-      description: 모든 시스템 설정을 키-값 쌍으로 조회합니다. 인증이 필요합니다.
+      description: 호출자의 유효 권한으로 허용된 시스템 설정을 조회합니다. `settings:read`가 필요하며 보안, 규정 준수 및 전체 관리자 설정은 각각 별도로 필터링됩니다.
       security:
         - bearerAuth: []
       responses:
@@ -6220,7 +6220,7 @@ paths:
       tags:
         - Settings
       summary: 설정 업데이트
-      description: 설정할 키-값 쌍의 플랫 JSON 객체를 받습니다. 관리자 역할이 필요합니다.
+      description: 인식된 쓰기 가능 설정 키를 포함하는 플랫 JSON 객체를 받습니다. `settings:write`가 필요하며 보안 및 규정 준수 키에는 각각 일치하는 유효 권한도 필요합니다. 비밀 정보에는 전체 관리자 권한이 필요하고 전용 또는 서버 관리 키는 읽기 전용입니다.
       security:
         - bearerAuth: []
       requestBody:
@@ -6267,7 +6267,7 @@ paths:
       tags:
         - Settings
       summary: 단일 설정 가져오기
-      description: 키 이름으로 단일 설정 값을 조회합니다. 값과 마지막 업데이트 타임스탬프를 반환합니다.
+      description: 인식된 설정을 키로 조회합니다. 호출자에게 `settings:read`와 해당 키의 추가 권한이 모두 있는 경우 값과 마지막 업데이트 타임스탬프를 반환합니다.
       security:
         - bearerAuth: []
       parameters:
@@ -18396,7 +18396,8 @@ paths:
       tags:
         - Enterprise
       summary: 구성 내보내기
-      description: 삭제 처리된 인스턴스 구성, 사용자 정의 역할, 팀을 내보냅니다. system:health 권한이 필요합니다.
+      description: |
+        민감 정보가 제거된 인스턴스 구성, 사용자 지정 역할, 팀을 내보냅니다. 완전하고 유효한 기본 제공 관리자 권한이 필요합니다. 사용자 지정 역할은 자격이 없으며, 관리자 권한이 하나라도 누락된 API 키도 자격이 없습니다.
       security:
         - bearerAuth: []
       responses:
@@ -18411,7 +18412,7 @@ paths:
         - Enterprise
       summary: 구성 가져오기
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        인스턴스 구성, 사용자 지정 역할, 팀을 가져옵니다. 완전하고 유효한 기본 제공 관리자 권한이 필요합니다. 사용자 지정 역할은 자격이 없으며, 관리자 권한이 하나라도 누락된 API 키도 자격이 없습니다.
       security:
         - bearerAuth: []
       responses:
@@ -19663,25 +19664,25 @@ x-i18n:
       provenance: machine
       outputHash: 035764fb2a66
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 356b431c19e0
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 92e2b24a638a
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 5236b38f5ebc
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: ee2b9ad3de23
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 91196394ed7c
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: f0bbecf0a440
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 197135f3a96e
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 844244eeeb22
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21631,13 +21632,17 @@ x-i18n:
       provenance: machine
       outputHash: cae0b5d8b1da
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 3ea14ebe2434
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 57ba635adf06
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 545bc5835bce
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: eac40b873768
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.nl.yaml

@@ -6160,7 +6160,7 @@ paths:
       tags:
         - Settings
       summary: Alle instellingen ophalen
-      description: Haal alle systeeminstellingen op als sleutel-waardeparen. Vereist authenticatie.
+      description: Haalt de systeeminstellingen op waarvoor de effectieve machtigingen van de aanroeper toestemming geven. Vereist `settings:read`; beveiligings-, compliance- en volledige beheerdersinstellingen worden afzonderlijk gefilterd.
       security:
         - bearerAuth: []
       responses:
@@ -6186,7 +6186,7 @@ paths:
       tags:
         - Settings
       summary: Instellingen bijwerken
-      description: Accepteert een plat JSON-object met sleutel-waardeparen om in te stellen. Vereist de admin-rol.
+      description: Accepteert een plat JSON-object met herkende, beschrijfbare instellingssleutels. Vereist `settings:write`; beveiligings- en compliancesleutels vereisen daarnaast de bijbehorende effectieve machtiging, geheimen vereisen volledige beheerdersbevoegdheid en specifieke of door de server beheerde sleutels zijn alleen-lezen.
       security:
         - bearerAuth: []
       requestBody:
@@ -6233,7 +6233,7 @@ paths:
       tags:
         - Settings
       summary: Een enkele instelling ophalen
-      description: Haal een enkele instellingswaarde op via de sleutelnaam. Geeft de waarde en het tijdstip van laatste wijziging terug.
+      description: Haalt een herkende instelling op via de sleutel. Geeft de waarde en het tijdstip van de laatste wijziging terug wanneer de aanroeper zowel `settings:read` als de aanvullende bevoegdheid voor de sleutel bezit.
       security:
         - bearerAuth: []
       parameters:
@@ -18326,7 +18326,8 @@ paths:
       tags:
         - Enterprise
       summary: Configuratie exporteren
-      description: Exporteer geredigeerde instanceconfiguratie, aangepaste rollen en teams. Vereist de permissie system:health.
+      description: |
+        Exporteer geredigeerde instanceconfiguratie, aangepaste rollen en teams. Vereist volledige effectieve bevoegdheid van een ingebouwde beheerder; aangepaste rollen komen niet in aanmerking, evenmin als API-sleutels waaraan een beheerderspermissie ontbreekt.
       security:
         - bearerAuth: []
       responses:
@@ -18341,7 +18342,7 @@ paths:
         - Enterprise
       summary: Configuratie importeren
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Importeer instanceconfiguratie, aangepaste rollen en teams. Vereist volledige effectieve bevoegdheid van een ingebouwde beheerder; aangepaste rollen komen niet in aanmerking, evenmin als API-sleutels waaraan een beheerderspermissie ontbreekt.
       security:
         - bearerAuth: []
       responses:
@@ -19593,25 +19594,25 @@ x-i18n:
       provenance: machine
       outputHash: 666c293de44a
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 78d23fe3574e
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: a121e623e4a5
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: a8d44c68e07a
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: b2df9ad7451d
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 813e87bcde6a
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 42ada4bb9e65
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 700218f9c448
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 05c0b7d34d3b
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21561,13 +21562,17 @@ x-i18n:
       provenance: machine
       outputHash: 483802d6d88b
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 273e5733e90b
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 549dae89e5db
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: e879e533fcf9
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 0057af9b7cd9
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.pl.yaml

@@ -6195,7 +6195,7 @@ paths:
       tags:
         - Settings
       summary: Pobierz wszystkie ustawienia
-      description: Pobierz wszystkie ustawienia systemowe jako pary klucz-wartość. Wymaga uwierzytelnienia.
+      description: Pobiera ustawienia systemowe dostępne na podstawie efektywnych uprawnień wywołującego. Wymaga `settings:read`; ustawienia zabezpieczeń, zgodności i pełnego administratora są filtrowane oddzielnie.
       security:
         - bearerAuth: []
       responses:
@@ -6221,7 +6221,7 @@ paths:
       tags:
         - Settings
       summary: Aktualizuj ustawienia
-      description: Przyjmuje płaski obiekt JSON par klucz-wartość do ustawienia. Wymaga roli admina.
+      description: Przyjmuje płaski obiekt JSON zawierający rozpoznawane, zapisywalne klucze ustawień. Wymaga `settings:write`; klucze zabezpieczeń i zgodności dodatkowo wymagają odpowiedniego efektywnego uprawnienia, ustawienia tajne wymagają uprawnień pełnego administratora, a klucze dedykowane lub zarządzane przez serwer są tylko do odczytu.
       security:
         - bearerAuth: []
       requestBody:
@@ -6268,7 +6268,7 @@ paths:
       tags:
         - Settings
       summary: Pobierz pojedyncze ustawienie
-      description: Pobierz wartość pojedynczego ustawienia według nazwy klucza. Zwraca wartość i znacznik czasu ostatniej aktualizacji.
+      description: Pobiera rozpoznawane ustawienie według klucza. Zwraca wartość i znacznik czasu ostatniej aktualizacji, gdy wywołujący ma zarówno `settings:read`, jak i dodatkowe uprawnienie wymagane przez klucz.
       security:
         - bearerAuth: []
       parameters:
@@ -18398,7 +18398,11 @@ paths:
       tags:
         - Enterprise
       summary: Eksportuj konfigurację
-      description: Eksportuj ocenzurowaną konfigurację instancji, niestandardowe role i zespoły. Wymaga uprawnienia system:health.
+      description: >
+        Eksportuje zredagowaną konfigurację instancji, niestandardowe role i zespoły.
+        Wymaga pełnych efektywnych uprawnień wbudowanego administratora. Role niestandardowe
+        nie spełniają tego wymagania; nie spełniają go również klucze API, którym brakuje
+        choć jednego uprawnienia administratora.
       security:
         - bearerAuth: []
       responses:
@@ -18413,7 +18417,7 @@ paths:
         - Enterprise
       summary: Importuj konfigurację
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Importuje konfigurację instancji, niestandardowe role i zespoły. Wymaga pełnych efektywnych uprawnień wbudowanego administratora. Role niestandardowe nie spełniają tego wymagania; nie spełniają go również klucze API, którym brakuje choć jednego uprawnienia administratora.
       security:
         - bearerAuth: []
       responses:
@@ -19665,25 +19669,25 @@ x-i18n:
       provenance: machine
       outputHash: 2d3309d3d734
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 922c505e81c5
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: fde39a0b5fde
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 865cc609ce5a
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 690935d899b9
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 2f5dd782fa2d
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 75ace75129e8
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: fe175eaa6a44
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 9499a2b66ce0
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21633,13 +21637,17 @@ x-i18n:
       provenance: machine
       outputHash: 6741ae612f1a
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 783abf56dd51
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 565e220d1ee1
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 69d9e498d678
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 050e4bd70006
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.pt-BR.yaml

@@ -6195,7 +6195,7 @@ paths:
       tags:
         - Settings
       summary: Obter todas as configurações
-      description: Recupera todas as configurações do sistema como pares chave-valor. Requer autenticação.
+      description: Recupera as configurações do sistema autorizadas pelas permissões efetivas do solicitante. Requer `settings:read`; as configurações de segurança, conformidade e de administrador completo são filtradas separadamente.
       security:
         - bearerAuth: []
       responses:
@@ -6221,7 +6221,7 @@ paths:
       tags:
         - Settings
       summary: Atualizar configurações
-      description: Aceita um objeto JSON plano de pares chave-valor a definir. Requer a função admin.
+      description: Aceita um objeto JSON plano contendo chaves de configuração reconhecidas e graváveis. Requer `settings:write`; chaves de segurança e conformidade também exigem a permissão efetiva correspondente, configurações secretas exigem autoridade de administrador completo e chaves dedicadas ou gerenciadas pelo servidor são somente leitura.
       security:
         - bearerAuth: []
       requestBody:
@@ -6268,7 +6268,7 @@ paths:
       tags:
         - Settings
       summary: Obter uma única configuração
-      description: Recupera o valor de uma única configuração pelo nome da chave. Retorna o valor e o timestamp da última atualização.
+      description: Recupera uma configuração reconhecida pela chave. Retorna o valor e o horário da última atualização quando o solicitante tem `settings:read` e a autoridade adicional exigida pela chave.
       security:
         - bearerAuth: []
       parameters:
@@ -18398,7 +18398,10 @@ paths:
       tags:
         - Enterprise
       summary: Exportar configuração
-      description: Exporta a configuração redigida da instância, funções personalizadas e equipes. Requer a permissão system:health.
+      description: >
+        Exporta a configuração redigida da instância, os papéis personalizados e as equipes.
+        Requer autoridade efetiva total de administrador integrado. Papéis personalizados não
+        se qualificam, nem chaves de API que não incluam todas as permissões de administrador.
       security:
         - bearerAuth: []
       responses:
@@ -18413,7 +18416,7 @@ paths:
         - Enterprise
       summary: Importar configuração
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Importa a configuração da instância, os papéis personalizados e as equipes. Requer autoridade efetiva total de administrador integrado. Papéis personalizados não se qualificam, nem chaves de API que não incluam todas as permissões de administrador.
       security:
         - bearerAuth: []
       responses:
@@ -19665,25 +19668,25 @@ x-i18n:
       provenance: machine
       outputHash: e6f093f09f4e
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: c6fe75e15bc0
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 0001005a79ad
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 78d8117d251c
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 327f6546fdab
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 805deb038f5e
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 14b11f7a54c5
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 9881141d8b55
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 696303124fab
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21633,13 +21636,17 @@ x-i18n:
       provenance: machine
       outputHash: a29248d9ba03
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 240b4bd3ef81
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: fc97fe44d92a
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 79e7be0dfa9f
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: ecb1bd41efa8
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.ru.yaml

@@ -6197,7 +6197,7 @@ paths:
       tags:
         - Settings
       summary: Получить все настройки
-      description: Получение всех системных настроек в виде пар ключ-значение. Требует аутентификации.
+      description: Возвращает системные настройки, доступные согласно действующим разрешениям вызывающей стороны. Требуется `settings:read`; настройки безопасности, соответствия и полного администратора фильтруются отдельно.
       security:
         - bearerAuth: []
       responses:
@@ -6223,7 +6223,7 @@ paths:
       tags:
         - Settings
       summary: Обновление настроек
-      description: Принимает плоский JSON-объект пар ключ-значение для установки. Требует роль администратора.
+      description: Принимает плоский JSON-объект с распознаваемыми и доступными для записи ключами настроек. Требуется `settings:write`; для ключей безопасности и соответствия также требуется соответствующее действующее разрешение, секретные настройки требуют полномочий администратора в полном объёме, а специализированные или управляемые сервером ключи доступны только для чтения.
       security:
         - bearerAuth: []
       requestBody:
@@ -6270,7 +6270,7 @@ paths:
       tags:
         - Settings
       summary: Получить одну настройку
-      description: Получение значения одной настройки по имени ключа. Возвращает значение и временную метку последнего обновления.
+      description: Возвращает распознаваемую настройку по ключу. Значение и время последнего обновления возвращаются, если вызывающая сторона имеет `settings:read` и дополнительное полномочие, необходимое для этого ключа.
       security:
         - bearerAuth: []
       parameters:
@@ -18400,7 +18400,11 @@ paths:
       tags:
         - Enterprise
       summary: Экспорт конфигурации
-      description: Экспорт отредактированной конфигурации экземпляра, пользовательских ролей и команд. Требует разрешение system:health.
+      description: >
+        Экспортирует отредактированную конфигурацию экземпляра, пользовательские роли и команды.
+        Требуются полные действующие полномочия встроенного администратора. Пользовательские роли
+        не подходят; также не подходят ключи API, в которых отсутствует хотя бы одно разрешение
+        администратора.
       security:
         - bearerAuth: []
       responses:
@@ -18415,7 +18419,7 @@ paths:
         - Enterprise
       summary: Импорт конфигурации
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Импортирует конфигурацию экземпляра, пользовательские роли и команды. Требуются полные действующие полномочия встроенного администратора. Пользовательские роли не подходят; также не подходят ключи API, в которых отсутствует хотя бы одно разрешение администратора.
       security:
         - bearerAuth: []
       responses:
@@ -19667,25 +19671,25 @@ x-i18n:
       provenance: machine
       outputHash: 924fe311b5da
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 752016209a09
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 705b786a77be
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 603ae7d76ad5
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 7987df38d257
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: d62ac18b7a23
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 633988a54360
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 4d5189e0bab6
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 9d6ce07a3ef3
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21635,13 +21639,17 @@ x-i18n:
       provenance: machine
       outputHash: c884141b63c1
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: a56dbe5d051e
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: d41ea886abf4
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: ad05d605d6dc
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 76f839bcc1ff
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.sv.yaml

@@ -6195,7 +6195,7 @@ paths:
       tags:
         - Settings
       summary: Haamta alla installningar
-      description: Haamta alla systeminstallningar som nyckel-vardepar. Kraver autentisering.
+      description: Hämtar de systeminställningar som anroparens effektiva behörigheter medger. Kräver `settings:read`; säkerhets-, efterlevnads- och fullständiga administratörsinställningar filtreras separat.
       security:
         - bearerAuth: []
       responses:
@@ -6221,7 +6221,7 @@ paths:
       tags:
         - Settings
       summary: Uppdatera installningar
-      description: Tar emot ett platt JSON-objekt av nyckel-vardepar att stalla in. Kraver admin-roll.
+      description: Tar emot ett platt JSON-objekt med kända, skrivbara inställningsnycklar. Kräver `settings:write`; säkerhets- och efterlevnadsnycklar kräver dessutom motsvarande effektiv behörighet, hemliga inställningar kräver fullständig administratörsbehörighet och särskilda eller serverhanterade nycklar är skrivskyddade.
       security:
         - bearerAuth: []
       requestBody:
@@ -6268,7 +6268,7 @@ paths:
       tags:
         - Settings
       summary: Haamta en enskild installning
-      description: Haamta ett enskilt installningsvarde via dess nyckelnamn. Returnerar vardet och tidsstampeln for senaste uppdatering.
+      description: Hämtar en känd inställning via nyckel. Returnerar värdet och tidsstämpeln för den senaste uppdateringen när anroparen har både `settings:read` och nyckelns ytterligare behörighet.
       security:
         - bearerAuth: []
       parameters:
@@ -18397,7 +18397,10 @@ paths:
       tags:
         - Enterprise
       summary: Exportera konfiguration
-      description: Exportera redigerad instanskonfiguration, anpassade roller och team. Kraver behorigheten system:health.
+      description: >
+        Exporterar redigerad instanskonfiguration, anpassade roller och team. Kräver fullständig
+        faktisk behörighet som inbyggd administratör. Anpassade roller kvalificerar inte, och inte
+        heller API-nycklar som saknar någon administratörsbehörighet.
       security:
         - bearerAuth: []
       responses:
@@ -18412,7 +18415,7 @@ paths:
         - Enterprise
       summary: Importera konfiguration
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Importerar instanskonfiguration, anpassade roller och team. Kräver fullständig faktisk behörighet som inbyggd administratör. Anpassade roller kvalificerar inte, och inte heller API-nycklar som saknar någon administratörsbehörighet.
       security:
         - bearerAuth: []
       responses:
@@ -19664,25 +19667,25 @@ x-i18n:
       provenance: machine
       outputHash: 682cc2c07112
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 40689398e10e
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 798934885bfb
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 29711c3c4044
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 1763022012df
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: a1c1c1598466
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: f4542877281b
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 582bf0445c23
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 2d888ca899a8
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21632,13 +21635,17 @@ x-i18n:
       provenance: machine
       outputHash: b0d69bc545d5
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 0df30ed01216
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 7cde619401b4
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 44be217903e1
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: d6f32546d706
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.th.yaml

@@ -6159,7 +6159,7 @@ paths:
       tags:
         - Settings
       summary: รับการตั้งค่าทั้งหมด
-      description: ดึงการตั้งค่าระบบทั้งหมดเป็นคู่ key-value ต้องมีการยืนยันตัวตน
+      description: ดึงการตั้งค่าระบบที่สิทธิ์ที่มีผลของผู้เรียกอนุญาต ต้องมี `settings:read` โดยระบบจะกรองการตั้งค่าด้านความปลอดภัย การปฏิบัติตามข้อกำหนด และผู้ดูแลระบบเต็มรูปแบบแยกกัน
       security:
         - bearerAuth: []
       responses:
@@ -6185,7 +6185,7 @@ paths:
       tags:
         - Settings
       summary: อัปเดตการตั้งค่า
-      description: รับ JSON object แบบแบนของคู่ key-value เพื่อตั้งค่า ต้องมีบทบาทแอดมิน
+      description: รับ JSON object แบบแบนที่มีคีย์การตั้งค่าซึ่งระบบรู้จักและเขียนได้ ต้องมี `settings:write` ส่วนคีย์ด้านความปลอดภัยและการปฏิบัติตามข้อกำหนดต้องมีสิทธิ์ที่มีผลซึ่งตรงกันเพิ่มเติม การตั้งค่าที่เป็นความลับต้องมีสิทธิ์ผู้ดูแลระบบเต็มรูปแบบ และคีย์เฉพาะหรือคีย์ที่เซิร์ฟเวอร์จัดการจะเป็นแบบอ่านอย่างเดียว
       security:
         - bearerAuth: []
       requestBody:
@@ -6232,7 +6232,7 @@ paths:
       tags:
         - Settings
       summary: รับการตั้งค่ารายการเดียว
-      description: ดึงค่าการตั้งค่ารายการเดียวตามชื่อ key คืนค่าและ timestamp ที่อัปเดตล่าสุด
+      description: ดึงการตั้งค่าที่ระบบรู้จักตามคีย์ โดยจะคืนค่าและเวลาอัปเดตล่าสุดเมื่อผู้เรียกมีทั้ง `settings:read` และสิทธิ์เพิ่มเติมที่คีย์นั้นกำหนด
       security:
         - bearerAuth: []
       parameters:
@@ -18325,7 +18325,9 @@ paths:
       tags:
         - Enterprise
       summary: ส่งออกการกำหนดค่า
-      description: ส่งออกการกำหนดค่าอินสแตนซ์ที่ปิดบังแล้ว บทบาทกำหนดเอง และทีม ต้องมีสิทธิ์ system:health
+      description: >
+        ส่งออกการกำหนดค่าอินสแตนซ์ที่ปิดบังแล้ว บทบาทที่กำหนดเอง และทีม ต้องมีอำนาจผู้ดูแลระบบในตัวแบบเต็มตามสิทธิ์ที่มีผล
+        บทบาทที่กำหนดเองไม่มีคุณสมบัติ และคีย์ API ที่ขาดสิทธิ์ผู้ดูแลระบบแม้แต่รายการเดียวก็ไม่มีคุณสมบัติเช่นกัน
       security:
         - bearerAuth: []
       responses:
@@ -18340,7 +18342,7 @@ paths:
         - Enterprise
       summary: นำเข้าการกำหนดค่า
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        นำเข้าการกำหนดค่าอินสแตนซ์ บทบาทที่กำหนดเอง และทีม ต้องมีอำนาจผู้ดูแลระบบในตัวแบบเต็มตามสิทธิ์ที่มีผล บทบาทที่กำหนดเองไม่มีคุณสมบัติ และคีย์ API ที่ขาดสิทธิ์ผู้ดูแลระบบแม้แต่รายการเดียวก็ไม่มีคุณสมบัติเช่นกัน
       security:
         - bearerAuth: []
       responses:
@@ -19592,25 +19594,25 @@ x-i18n:
       provenance: machine
       outputHash: 86f2afe11a85
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 0eefc4821fa9
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 7caf2a6887b2
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 5c40ab117f50
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: d4199ba5e6bf
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: ae30d567e320
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 521ebe64be35
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 50c149751003
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 981b04469600
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21560,13 +21562,17 @@ x-i18n:
       provenance: machine
       outputHash: d214db073a3f
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: fe3be4237a3c
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 7c26f7cf8693
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: b6a1491a4fde
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: f4b1d116c50e
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.tr.yaml

@@ -6195,7 +6195,7 @@ paths:
       tags:
         - Settings
       summary: Tüm ayarları al
-      description: Tüm sistem ayarlarını anahtar-değer çiftleri olarak alın. Kimlik doğrulama gerektirir.
+      description: Çağıranın etkin izinlerinin yetkilendirdiği sistem ayarlarını getirir. `settings:read` gerektirir; güvenlik, uyumluluk ve tam yönetici ayarları ayrı ayrı filtrelenir.
       security:
         - bearerAuth: []
       responses:
@@ -6221,7 +6221,7 @@ paths:
       tags:
         - Settings
       summary: Ayarları güncelle
-      description: Ayarlanacak anahtar-değer çiftlerinin düz bir JSON nesnesini kabul eder. Yönetici rolü gerektirir.
+      description: Tanınan ve yazılabilir ayar anahtarlarını içeren düz bir JSON nesnesini kabul eder. `settings:write` gerektirir; güvenlik ve uyumluluk anahtarları ayrıca karşılık gelen etkin izni, gizli ayarlar tam yönetici yetkisini gerektirir; özel veya sunucu tarafından yönetilen anahtarlar ise salt okunurdur.
       security:
         - bearerAuth: []
       requestBody:
@@ -6268,7 +6268,7 @@ paths:
       tags:
         - Settings
       summary: Tek bir ayarı al
-      description: Tek bir ayar değerini anahtar adına göre alın. Değeri ve son güncelleme zaman damgasını döndürür.
+      description: Tanınan bir ayarı anahtarına göre getirir. Çağıran hem `settings:read` hem de anahtarın ek yetkisine sahip olduğunda değeri ve son güncelleme zaman damgasını döndürür.
       security:
         - bearerAuth: []
       parameters:
@@ -18397,7 +18397,10 @@ paths:
       tags:
         - Enterprise
       summary: Yapılandırmayı dışa aktar
-      description: Redakte edilmiş örnek yapılandırmasını, özel rolleri ve ekipleri dışa aktarın. system:health iznini gerektirir.
+      description: >
+        Redakte edilmiş örnek yapılandırmasını, özel rolleri ve ekipleri dışa aktarır. Tam etkin
+        yerleşik yönetici yetkisi gerektirir. Özel roller ve herhangi bir yönetici izni eksik olan
+        API anahtarları uygun değildir.
       security:
         - bearerAuth: []
       responses:
@@ -18412,7 +18415,7 @@ paths:
         - Enterprise
       summary: Yapılandırmayı içe aktar
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Örnek yapılandırmasını, özel rolleri ve ekipleri içe aktarır. Tam etkin yerleşik yönetici yetkisi gerektirir. Özel roller ve herhangi bir yönetici izni eksik olan API anahtarları uygun değildir.
       security:
         - bearerAuth: []
       responses:
@@ -19664,25 +19667,25 @@ x-i18n:
       provenance: machine
       outputHash: a32e241d07b6
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 3edd8247aa35
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 217e7761a265
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: ec872d75e4b1
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 20bdc243879a
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 7e7097fbe6ae
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 92329e85bfdc
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 93bf784f2848
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: b3576633b872
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21632,13 +21635,17 @@ x-i18n:
       provenance: machine
       outputHash: 78b131e59df9
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: fe29b94fea16
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: fefe5ebfe202
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 3c49ebff8d5c
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: e5a410562089
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.uk.yaml

@@ -6195,7 +6195,7 @@ paths:
       tags:
         - Settings
       summary: Отримати всі налаштування
-      description: Отримати всі системні налаштування як пари ключ-значення. Потребує автентифікації.
+      description: Повертає системні налаштування, дозволені ефективними правами викликувача. Потрібен дозвіл `settings:read`; налаштування безпеки, відповідності та повного адміністратора фільтруються окремо.
       security:
         - bearerAuth: []
       responses:
@@ -6221,7 +6221,7 @@ paths:
       tags:
         - Settings
       summary: Оновити налаштування
-      description: Приймає плоский об'єкт JSON із парами ключ-значення для встановлення. Потребує ролі адміністратора.
+      description: Приймає плоский об'єкт JSON із розпізнаваними ключами налаштувань, доступними для запису. Потрібен дозвіл `settings:write`; ключі безпеки та відповідності також вимагають відповідного ефективного дозволу, секретні налаштування вимагають повноважень повного адміністратора, а спеціалізовані або керовані сервером ключі доступні лише для читання.
       security:
         - bearerAuth: []
       requestBody:
@@ -6268,7 +6268,7 @@ paths:
       tags:
         - Settings
       summary: Отримати одне налаштування
-      description: Отримати значення одного налаштування за іменем ключа. Повертає значення та мітку часу останнього оновлення.
+      description: Повертає розпізнаване налаштування за ключем. Значення та мітка часу останнього оновлення повертаються, якщо викликувач має `settings:read` і додаткові повноваження, необхідні для цього ключа.
       security:
         - bearerAuth: []
       parameters:
@@ -18398,7 +18398,10 @@ paths:
       tags:
         - Enterprise
       summary: Експортувати конфігурацію
-      description: Експортувати приховувану конфігурацію екземпляра, власні ролі та команди. Потребує дозволу system:health.
+      description: >
+        Експортує приховану конфігурацію екземпляра, власні ролі та команди. Потрібні повні
+        фактичні повноваження вбудованого адміністратора. Власні ролі не відповідають цій вимозі;
+        так само їй не відповідають ключі API, у яких відсутній хоча б один дозвіл адміністратора.
       security:
         - bearerAuth: []
       responses:
@@ -18413,7 +18416,7 @@ paths:
         - Enterprise
       summary: Імпортувати конфігурацію
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Імпортує конфігурацію екземпляра, власні ролі та команди. Потрібні повні фактичні повноваження вбудованого адміністратора. Власні ролі не відповідають цій вимозі; так само їй не відповідають ключі API, у яких відсутній хоча б один дозвіл адміністратора.
       security:
         - bearerAuth: []
       responses:
@@ -19665,25 +19668,25 @@ x-i18n:
       provenance: machine
       outputHash: d5a2e5936382
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 5b6a5774bbc9
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: a87bf50bf0c9
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: 022d75be8a33
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 6f8bdc5f2726
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 2dae8e572dfe
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 8d466ef13a3b
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: af91370069b1
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: fb1367bdacbe
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21633,13 +21636,17 @@ x-i18n:
       provenance: machine
       outputHash: aefff1771914
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: cdae7926ad8d
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 6bf7d9f7cd87
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 9913cd1c8f54
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: b5c8cf8a0eb8
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.vi.yaml

@@ -6194,7 +6194,7 @@ paths:
       tags:
         - Settings
       summary: Lấy tất cả cài đặt
-      description: Truy xuất tất cả cài đặt hệ thống dưới dạng cặp khóa-giá trị. Yêu cầu xác thực.
+      description: Truy xuất các cài đặt hệ thống mà quyền hiệu lực của bên gọi cho phép. Yêu cầu `settings:read`; các cài đặt bảo mật, tuân thủ và dành cho quản trị viên đầy đủ được lọc riêng.
       security:
         - bearerAuth: []
       responses:
@@ -6220,7 +6220,7 @@ paths:
       tags:
         - Settings
       summary: Cập nhật cài đặt
-      description: Nhận một đối tượng JSON phẳng gồm các cặp khóa-giá trị để thiết lập. Yêu cầu vai trò admin.
+      description: Nhận một đối tượng JSON phẳng chứa các khóa cài đặt được nhận dạng và có thể ghi. Yêu cầu `settings:write`; các khóa bảo mật và tuân thủ còn yêu cầu quyền hiệu lực tương ứng, cài đặt bí mật yêu cầu quyền quản trị viên đầy đủ, còn các khóa chuyên biệt hoặc do máy chủ quản lý chỉ có thể đọc.
       security:
         - bearerAuth: []
       requestBody:
@@ -6267,7 +6267,7 @@ paths:
       tags:
         - Settings
       summary: Lấy một cài đặt đơn lẻ
-      description: Truy xuất giá trị của một cài đặt đơn lẻ theo tên khóa của nó. Trả về giá trị và dấu thời gian cập nhật lần cuối.
+      description: Truy xuất một cài đặt được nhận dạng theo khóa. Trả về giá trị và dấu thời gian cập nhật lần cuối khi bên gọi có cả `settings:read` và quyền bổ sung của khóa đó.
       security:
         - bearerAuth: []
       parameters:
@@ -18396,7 +18396,10 @@ paths:
       tags:
         - Enterprise
       summary: Xuất cấu hình
-      description: Xuất cấu hình phiên bản đã ẩn thông tin nhạy cảm, vai trò tùy chỉnh và nhóm. Yêu cầu quyền system:health.
+      description: >
+        Xuất cấu hình phiên bản đã ẩn thông tin nhạy cảm, vai trò tùy chỉnh và nhóm. Yêu cầu quyền
+        toàn bộ quyền có hiệu lực của quản trị viên tích hợp sẵn. Vai trò tùy chỉnh không đủ điều kiện; khóa API
+        thiếu bất kỳ quyền quản trị viên nào cũng vậy.
       security:
         - bearerAuth: []
       responses:
@@ -18411,7 +18414,7 @@ paths:
         - Enterprise
       summary: Nhập cấu hình
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        Nhập cấu hình phiên bản, vai trò tùy chỉnh và nhóm. Yêu cầu toàn bộ quyền có hiệu lực của quản trị viên tích hợp sẵn. Vai trò tùy chỉnh không đủ điều kiện; khóa API thiếu bất kỳ quyền quản trị viên nào cũng vậy.
       security:
         - bearerAuth: []
       responses:
@@ -19663,25 +19666,25 @@ x-i18n:
       provenance: machine
       outputHash: b726bf084992
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 897b6f0f9503
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: e273a1ca0985
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: e25578f7de79
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: 4e206969c9ca
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 2b8c06f0fcf9
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 684a7f58039a
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: a54eb9428ba8
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: 18ef15617bf5
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21631,13 +21634,17 @@ x-i18n:
       provenance: machine
       outputHash: 8858b7ade9c0
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 8794f9f12675
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 8f4838e98180
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: 626289366f67
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 2cb62977f308
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.yaml

@@ -6070,7 +6070,7 @@ paths:
       operationId: getSettings
       tags: [Settings]
       summary: Get all settings
-      description: Retrieve all system settings as key-value pairs. Requires authentication.
+      description: Retrieve the system settings authorized by the caller's effective permissions. Requires `settings:read`; security, compliance, and full-administrator settings are filtered separately.
       security:
         - bearerAuth: []
       responses:
@@ -6095,7 +6095,7 @@ paths:
       operationId: updateSettings
       tags: [Settings]
       summary: Update settings
-      description: Accepts a flat JSON object of key-value pairs to set. Requires admin role.
+      description: Accepts a flat JSON object containing recognized, writable setting keys. Requires `settings:write`; security and compliance keys additionally require their matching effective permission, secrets require full-administrator authority, and dedicated or server-managed keys are read-only.
       security:
         - bearerAuth: []
       requestBody:
@@ -6142,7 +6142,7 @@ paths:
       operationId: getSetting
       tags: [Settings]
       summary: Get a single setting
-      description: Retrieve a single setting value by its key name. Returns the value and last-updated timestamp.
+      description: Retrieve a recognized setting by key. Returns the value and last-updated timestamp when the caller has both `settings:read` and the key's additional authority.
       security:
         - bearerAuth: []
       parameters:
@@ -18001,7 +18001,10 @@ paths:
       operationId: exportEnterpriseConfig
       tags: [Enterprise]
       summary: Export configuration
-      description: Export redacted instance configuration, custom roles, and teams. Requires system:health permission.
+      description: >
+        Export redacted instance configuration, custom roles, and teams. Requires
+        full effective built-in administrator authority; custom roles and API
+        keys missing any administrator permission do not qualify.
       security:
         - bearerAuth: []
       responses:

apps/api/src/openapi.zh-CN.yaml

@@ -6159,7 +6159,7 @@ paths:
       tags:
         - Settings
       summary: 获取所有设置
-      description: 以键值对形式检索所有系统设置。需要身份验证。
+      description: 获取调用方有效权限所允许的系统设置。需要 `settings:read`；安全、合规和完整管理员设置会分别进行筛选。
       security:
         - bearerAuth: []
       responses:
@@ -6185,7 +6185,7 @@ paths:
       tags:
         - Settings
       summary: 更新设置
-      description: 接受一个扁平的键值对 JSON 对象进行设置。需要管理员角色。
+      description: 接受包含已识别且可写设置键的扁平 JSON 对象。需要 `settings:write`；安全和合规键还需要相应的有效权限，机密设置需要完整管理员权限，专用键或服务器管理的键则为只读。
       security:
         - bearerAuth: []
       requestBody:
@@ -6232,7 +6232,7 @@ paths:
       tags:
         - Settings
       summary: 获取单个设置
-      description: 按键名检索单个设置值。返回该值和最后更新时间戳。
+      description: 按键获取已识别的设置。当调用方同时拥有 `settings:read` 和该键所需的额外权限时，返回设置值和最后更新时间戳。
       security:
         - bearerAuth: []
       parameters:
@@ -18322,7 +18322,7 @@ paths:
       tags:
         - Enterprise
       summary: 导出配置
-      description: 导出已脱敏的实例配置、自定义角色和团队。需要 system:health 权限。
+      description: 导出已脱敏的实例配置、自定义角色和团队。仅限拥有完整有效权限的内置管理员；自定义角色不符合要求，缺少任何管理员权限的 API 密钥也不符合要求。
       security:
         - bearerAuth: []
       responses:
@@ -18337,7 +18337,7 @@ paths:
         - Enterprise
       summary: 导入配置
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        导入实例配置、自定义角色和团队。仅限拥有完整有效权限的内置管理员；自定义角色不符合要求，缺少任何管理员权限的 API 密钥也不符合要求。
       security:
         - bearerAuth: []
       responses:
@@ -19589,25 +19589,25 @@ x-i18n:
       provenance: machine
       outputHash: 34f14c11223a
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 6dfb9d60666b
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 3e1f6ee5b1d7
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: cb2bec93a8f8
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: e3da0c2e704d
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: bdd5282d17d9
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 18771b9d6912
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: 102be9d181fe
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: d8add1498f34
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21557,13 +21557,17 @@ x-i18n:
       provenance: machine
       outputHash: 429ea3af443d
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 845a7336b6b8
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: 075f120a03fa
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: b48b6518293a
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 0a961b761696
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/openapi.zh-TW.yaml

@@ -6159,7 +6159,7 @@ paths:
       tags:
         - Settings
       summary: 取得所有設定
-      description: 以鍵值對取得所有系統設定。需要驗證。
+      description: 取得呼叫者有效權限所允許的系統設定。需要 `settings:read`；安全性、合規性與完整管理員設定會分別篩選。
       security:
         - bearerAuth: []
       responses:
@@ -6185,7 +6185,7 @@ paths:
       tags:
         - Settings
       summary: 更新設定
-      description: 接受一個扁平的鍵值對 JSON 物件進行設定。需要 admin 角色。
+      description: 接受包含已識別且可寫入設定 key 的扁平 JSON 物件。需要 `settings:write`；安全性與合規性 key 還需要相應的有效權限，機密設定需要完整管理員權限，而專用或由伺服器管理的 key 則為唯讀。
       security:
         - bearerAuth: []
       requestBody:
@@ -6232,7 +6232,7 @@ paths:
       tags:
         - Settings
       summary: 取得單一設定
-      description: 依鍵名取得單一設定值。回傳該值與最後更新時間戳記。
+      description: 依 key 取得已識別的設定。當呼叫者同時擁有 `settings:read` 與該 key 所需的額外權限時，回傳設定值與最後更新時間戳記。
       security:
         - bearerAuth: []
       parameters:
@@ -18322,7 +18322,7 @@ paths:
       tags:
         - Enterprise
       summary: 匯出設定
-      description: 匯出已遮蔽的執行個體設定、自訂角色與團隊。需要 system:health 權限。
+      description: 匯出已遮蔽的執行個體設定、自訂角色與團隊。僅限擁有完整有效權限的內建管理員；自訂角色不符合資格，缺少任何管理員權限的 API 金鑰也不符合資格。
       security:
         - bearerAuth: []
       responses:
@@ -18337,7 +18337,7 @@ paths:
         - Enterprise
       summary: 匯入設定
       description: |
-        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
+        匯入執行個體設定、自訂角色與團隊。僅限擁有完整有效權限的內建管理員；自訂角色不符合資格，缺少任何管理員權限的 API 金鑰也不符合資格。
       security:
         - bearerAuth: []
       responses:
@@ -19589,25 +19589,25 @@ x-i18n:
       provenance: machine
       outputHash: fd62da472768
     paths./api/v1/settings.get.description:
-      sourceHash: 65d8ff0f5873
-      provenance: machine
-      outputHash: 7ff5c6bc1894
+      sourceHash: 57a4d7da3780
+      provenance: human
+      outputHash: 4514a40964cb
     paths./api/v1/settings.put.summary:
       sourceHash: 46ed69579c39
       provenance: machine
       outputHash: ba85a03bad36
     paths./api/v1/settings.put.description:
-      sourceHash: 887f8facdd94
-      provenance: machine
-      outputHash: e38f18350ac0
+      sourceHash: 0ad5adfe3216
+      provenance: human
+      outputHash: 93cb9b010e99
     paths./api/v1/settings/{key}.get.summary:
       sourceHash: 186add054525
       provenance: machine
       outputHash: 3183095c651e
     paths./api/v1/settings/{key}.get.description:
-      sourceHash: 962db9ab06a3
-      provenance: machine
-      outputHash: db9f976f5a78
+      sourceHash: ffbf8af128f0
+      provenance: human
+      outputHash: b2729853693a
     paths./api/v1/teams.get.summary:
       sourceHash: 863546c57b78
       provenance: machine
@@ -21557,13 +21557,17 @@ x-i18n:
       provenance: machine
       outputHash: 9263e6bbcdf7
     paths./api/v1/enterprise/config/export.get.description:
-      sourceHash: 8e3ce9c435f5
-      provenance: machine
-      outputHash: 4e22d51f3c31
+      sourceHash: 78e6cca796a5
+      provenance: human
+      outputHash: c8a715849282
     paths./api/v1/enterprise/config/import.post.summary:
       sourceHash: 8a507f40b80f
       provenance: machine
       outputHash: f5475897e4a5
+    paths./api/v1/enterprise/config/import.post.description:
+      sourceHash: 21367e8b3579
+      provenance: human
+      outputHash: 0141629e0b36
     paths./api/v1/enterprise/ip-allowlist.get.summary:
       sourceHash: 8756df674b27
       provenance: machine

apps/api/src/routes/enterprise/config.ts

@@ -4,23 +4,16 @@ import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
 import { z } from "zod";
 import { db, schema } from "../../db/index.js";
 import { auditFromRequest } from "../../lib/audit.js";
-import { requireFullAdmin, requirePermission } from "../../permissions.js";
+import {
+  getSettingPolicy,
+  isConfigExportableSetting,
+  prepareSetting,
+  validateSettingsRuntimeConstraints,
+} from "../../lib/settings-policy.js";
+import { requireFullAdmin } from "../../permissions.js";
 
 const CONFIG_SCHEMA_VERSION = 1;
-
-const REDACTED_KEYS = new Set([
-  "cookie_secret",
-  "instance_id",
-  "siem_config",
-  "scim_token_hash",
-  "oidc_client_secret",
-  "saml_idp_certificate",
-  "siem_last_forwarded_at",
-  "siem_consecutive_failures",
-  "audit_archival_state",
-  "backup_last_completed",
-  "webhook_destinations",
-]);
+const POSTGRES_INTEGER_MAX = 2_147_483_647;
 
 const roleNameField = z
   .string()
@@ -73,21 +66,36 @@ const importedRoleSchema = z
   })
   .strict();
 
+const importedTeamSchema = z
+  .object({
+    name: z
+      .string()
+      .transform((value) => value.trim())
+      .pipe(z.string().min(1).max(50)),
+    storageQuota: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).nullable().optional(),
+    retentionHours: z.number().int().positive().max(POSTGRES_INTEGER_MAX).nullable().optional(),
+  })
+  .strict();
+
+const BUILTIN_ROLE_NAMES = new Set(["admin", "editor", "user", "disabled"]);
+
+function findDuplicateName(names: readonly string[], caseInsensitive = false): string | undefined {
+  const seen = new Set<string>();
+  for (const name of names) {
+    const identity = caseInsensitive ? name.toLowerCase() : name;
+    if (seen.has(identity)) return name;
+    seen.add(identity);
+  }
+  return undefined;
+}
+
 const importSchema = z.object({
   dryRun: z.boolean().default(false),
   config: z.object({
     configSchemaVersion: z.number(),
     settings: z.record(z.string()).optional(),
     roles: z.array(importedRoleSchema).optional(),
-    teams: z
-      .array(
-        z.object({
-          name: z.string(),
-          storageQuota: z.number().nullable().optional(),
-          retentionHours: z.number().nullable().optional(),
-        }),
-      )
-      .optional(),
+    teams: z.array(importedTeamSchema).optional(),
   }),
 });
 
@@ -96,7 +104,7 @@ export async function registerConfigRoutes(app: FastifyInstance): Promise<void>
   app.get(
     "/api/v1/enterprise/config/export",
     async (request: FastifyRequest, reply: FastifyReply) => {
-      const user = await requirePermission("system:health")(request, reply);
+      const user = await requireFullAdmin(request, reply);
       if (!user) return;
 
       // Enterprise feature gate
@@ -127,7 +135,7 @@ export async function registerConfigRoutes(app: FastifyInstance): Promise<void>
       const allSettings = await db.select().from(schema.settings);
       const settingsMap = config.settings as Record<string, string>;
       for (const s of allSettings) {
-        if (!REDACTED_KEYS.has(s.key)) {
+        if (isConfigExportableSetting(s.key)) {
           settingsMap[s.key] = s.value;
         }
       }
@@ -201,38 +209,83 @@ export async function registerConfigRoutes(app: FastifyInstance): Promise<void>
         });
       }
 
-      // Dependency validation
-      const validationErrors: string[] = [];
+      const duplicateRoleName = findDuplicateName(config.roles?.map((role) => role.name) ?? []);
+      if (duplicateRoleName) {
+        return reply.status(400).send({
+          error: `Duplicate role name "${duplicateRoleName}" in config import`,
+          code: "VALIDATION_ERROR",
+        });
+      }
+      const reservedRoleName = config.roles?.find((role) =>
+        BUILTIN_ROLE_NAMES.has(role.name),
+      )?.name;
+      if (reservedRoleName) {
+        return reply.status(400).send({
+          error: `Built-in role "${reservedRoleName}" cannot be imported as a custom role`,
+          code: "VALIDATION_ERROR",
+        });
+      }
 
+      const duplicateTeamName = findDuplicateName(
+        config.teams?.map((team) => team.name) ?? [],
+        true,
+      );
+      if (duplicateTeamName) {
+        return reply.status(400).send({
+          error: `Duplicate team name "${duplicateTeamName}" in config import`,
+          code: "VALIDATION_ERROR",
+        });
+      }
+
+      const preparedSettings: Array<{ key: string; value: string }> = [];
+      const preparedKeys = new Set<string>();
       if (config.settings) {
-        // SSO enforcement requires OIDC or SAML to be configured
-        if (config.settings.ssoEnforcement === "true") {
-          const hasOidc = config.settings.oidcIssuer || config.settings.oidcClientId;
-          const hasSaml = config.settings.samlIdpUrl || config.settings.samlEntityId;
-          if (!hasOidc && !hasSaml) {
-            validationErrors.push(
-              "ssoEnforcement is enabled but no OIDC or SAML provider is configured in the import",
-            );
+        for (const [requestedKey, value] of Object.entries(config.settings)) {
+          const policy = getSettingPolicy(requestedKey);
+          if (!policy) {
+            return reply.status(400).send({
+              error: `Unknown setting "${requestedKey}"`,
+              code: "UNKNOWN_SETTING",
+            });
+          }
+          if (policy.write === "none") {
+            return reply.status(400).send({
+              error: `Setting "${requestedKey}" cannot be modified through config import`,
+              code: "READONLY_SETTING",
+            });
           }
-        }
 
-        // IP allowlist must have at least one CIDR
-        if (config.settings.ipAllowlist) {
-          try {
-            const cidrs = JSON.parse(config.settings.ipAllowlist);
-            if (!Array.isArray(cidrs) || cidrs.length === 0) {
-              validationErrors.push("ipAllowlist is set but contains no CIDR entries");
-            }
-          } catch {
-            validationErrors.push("ipAllowlist contains invalid JSON");
+          // Exported secrets are omitted and older exports may still contain a
+          // redaction placeholder. Preserve the established skip behavior.
+          if (policy.redacted) continue;
+
+          const prepared = prepareSetting(requestedKey, value);
+          if (!prepared.success) {
+            return reply.status(400).send({
+              error: prepared.error,
+              code: prepared.code,
+              ...(prepared.details ? { details: prepared.details } : {}),
+            });
           }
+          if (preparedKeys.has(prepared.key)) {
+            return reply.status(400).send({
+              error: `Setting "${requestedKey}" duplicates "${prepared.key}" in the same import`,
+              code: "VALIDATION_ERROR",
+            });
+          }
+          preparedKeys.add(prepared.key);
+          preparedSettings.push({ key: prepared.key, value: prepared.value });
         }
       }
 
-      if (validationErrors.length > 0) {
-        return reply.status(400).send({
-          error: "Dependency validation failed",
-          validationErrors,
+      const runtimeValidation = await validateSettingsRuntimeConstraints(preparedSettings);
+      if (!runtimeValidation.success) {
+        return reply.status(runtimeValidation.statusCode).send({
+          error: runtimeValidation.error,
+          code: runtimeValidation.code,
+          ...(runtimeValidation.validationErrors
+            ? { validationErrors: runtimeValidation.validationErrors }
+            : {}),
         });
       }
 
@@ -248,13 +301,11 @@ export async function registerConfigRoutes(app: FastifyInstance): Promise<void>
       const rolesToUpsert: Array<{ name: string; action: string }> = [];
       const teamsToUpsert: Array<{ name: string; action: string }> = [];
 
-      if (config.settings) {
+      if (preparedSettings.length > 0) {
         const existingSettings = await db.select().from(schema.settings);
         const existingKeys = new Set(existingSettings.map((s) => s.key));
 
-        for (const key of Object.keys(config.settings)) {
-          // Skip redacted keys in import as well
-          if (REDACTED_KEYS.has(key)) continue;
+        for (const { key } of preparedSettings) {
           settingsToUpdate.push({
             key,
             action: existingKeys.has(key) ? "update" : "create",
@@ -281,12 +332,12 @@ export async function registerConfigRoutes(app: FastifyInstance): Promise<void>
 
       if (config.teams) {
         const existingTeams = await db.select().from(schema.teams);
-        const existingTeamNames = new Set(existingTeams.map((t) => t.name));
+        const existingTeamNames = new Set(existingTeams.map((team) => team.name.toLowerCase()));
 
         for (const team of config.teams) {
           teamsToUpsert.push({
             name: team.name,
-            action: existingTeamNames.has(team.name) ? "update" : "create",
+            action: existingTeamNames.has(team.name.toLowerCase()) ? "update" : "create",
           });
         }
         changes.teams = teamsToUpsert.length;
@@ -307,85 +358,86 @@ export async function registerConfigRoutes(app: FastifyInstance): Promise<void>
       // Apply changes
       const now = new Date();
 
-      // Upsert settings
-      if (config.settings) {
-        const existingSettings = await db.select().from(schema.settings);
-        const existingKeys = new Set(existingSettings.map((s) => s.key));
+      await db.transaction(async (tx) => {
+        // Keep settings, roles, and teams in one transaction so any database
+        // conflict rolls back the complete imported configuration.
+        if (preparedSettings.length > 0) {
+          const existingSettings = await tx.select().from(schema.settings);
+          const existingKeys = new Set(existingSettings.map((setting) => setting.key));
 
-        for (const [key, value] of Object.entries(config.settings)) {
-          if (REDACTED_KEYS.has(key)) continue;
-
-          if (existingKeys.has(key)) {
-            await db
-              .update(schema.settings)
-              .set({ value, updatedAt: now })
-              .where(eq(schema.settings.key, key));
-          } else {
-            await db.insert(schema.settings).values({ key, value });
+          for (const { key, value } of preparedSettings) {
+            if (existingKeys.has(key)) {
+              await tx
+                .update(schema.settings)
+                .set({ value, updatedAt: now })
+                .where(eq(schema.settings.key, key));
+            } else {
+              await tx.insert(schema.settings).values({ key, value });
+            }
           }
         }
-      }
 
-      // Upsert custom roles
-      if (config.roles) {
-        const existingRoles = await db
-          .select()
-          .from(schema.roles)
-          .where(eq(schema.roles.isBuiltin, false));
-        const existingRoleMap = new Map(existingRoles.map((r) => [r.name, r]));
+        if (config.roles) {
+          const existingRoles = await tx
+            .select()
+            .from(schema.roles)
+            .where(eq(schema.roles.isBuiltin, false));
+          const existingRoleMap = new Map(existingRoles.map((role) => [role.name, role]));
 
-        for (const role of config.roles) {
-          const existing = existingRoleMap.get(role.name);
-          if (existing) {
-            await db
-              .update(schema.roles)
-              .set({
+          for (const role of config.roles) {
+            const existing = existingRoleMap.get(role.name);
+            if (existing) {
+              await tx
+                .update(schema.roles)
+                .set({
+                  description: role.description ?? "",
+                  permissions: role.permissions,
+                  toolPermissions: role.toolPermissions ?? null,
+                  updatedAt: now,
+                })
+                .where(eq(schema.roles.id, existing.id));
+            } else {
+              await tx.insert(schema.roles).values({
+                id: randomUUID(),
+                name: role.name,
                 description: role.description ?? "",
                 permissions: role.permissions,
                 toolPermissions: role.toolPermissions ?? null,
+                isBuiltin: false,
+                createdAt: now,
                 updatedAt: now,
-              })
-              .where(eq(schema.roles.id, existing.id));
-          } else {
-            await db.insert(schema.roles).values({
-              id: randomUUID(),
-              name: role.name,
-              description: role.description ?? "",
-              permissions: role.permissions,
-              toolPermissions: role.toolPermissions ?? null,
-              isBuiltin: false,
-              createdAt: now,
-              updatedAt: now,
-            });
+              });
+            }
           }
         }
-      }
 
-      // Upsert teams
-      if (config.teams) {
-        const existingTeams = await db.select().from(schema.teams);
-        const existingTeamMap = new Map(existingTeams.map((t) => [t.name, t]));
+        if (config.teams) {
+          const existingTeams = await tx.select().from(schema.teams);
+          const existingTeamMap = new Map(
+            existingTeams.map((team) => [team.name.toLowerCase(), team]),
+          );
 
-        for (const team of config.teams) {
-          const existing = existingTeamMap.get(team.name);
-          if (existing) {
-            await db
-              .update(schema.teams)
-              .set({
+          for (const team of config.teams) {
+            const existing = existingTeamMap.get(team.name.toLowerCase());
+            if (existing) {
+              await tx
+                .update(schema.teams)
+                .set({
+                  storageQuota: team.storageQuota ?? null,
+                  retentionHours: team.retentionHours ?? null,
+                })
+                .where(eq(schema.teams.id, existing.id));
+            } else {
+              await tx.insert(schema.teams).values({
+                id: randomUUID(),
+                name: team.name,
                 storageQuota: team.storageQuota ?? null,
                 retentionHours: team.retentionHours ?? null,
-              })
-              .where(eq(schema.teams.id, existing.id));
-          } else {
-            await db.insert(schema.teams).values({
-              id: randomUUID(),
-              name: team.name,
-              storageQuota: team.storageQuota ?? null,
-              retentionHours: team.retentionHours ?? null,
-            });
+              });
+            }
           }
         }
-      }
+      });
 
       await auditFromRequest(request)("CONFIG_IMPORTED", {
         adminId: user.id,

apps/api/src/routes/settings.ts

@@ -13,49 +13,37 @@ import { env } from "../config.js";
 import { db, schema } from "../db/index.js";
 import { auditFromRequest } from "../lib/audit.js";
 import { decrypt, encrypt, isEncrypted } from "../lib/encryption.js";
-import { requirePermission } from "../permissions.js";
+import {
+  getSettingPolicy,
+  prepareSetting,
+  type SettingAuthority,
+  validateSettingsRuntimeConstraints,
+} from "../lib/settings-policy.js";
+import {
+  getEffectivePermissions,
+  isFullEffectiveAdmin,
+  requirePermission,
+} from "../permissions.js";
 
 const settingsBodySchema = z.record(z.string().min(1), z.unknown());
 
 const HTML_TAG_PATTERN = /<[a-z/!?][^>]*>/i;
 
-const SENSITIVE_KEYS = new Set([
-  "cookie_secret",
-  "instance_id",
-  "oidc_client_secret",
-  "saml_idp_certificate",
-  "scim_token_hash",
-  "siem_config",
-  "siem_webhook_auth",
-  "sqlite_import",
-  "webhook_destinations",
-]);
-
-const ENCRYPTED_KEYS = new Set([
-  "cookie_secret",
-  "oidc_client_secret",
-  "saml_idp_certificate",
-  "scim_token_hash",
-  "siem_webhook_auth",
-]);
-
-const REDACTED_KEYS = new Set([
-  "cookie_secret",
-  "oidc_client_secret",
-  "saml_idp_certificate",
-  "scim_token_hash",
-  "siem_config",
-  "siem_webhook_auth",
-  "webhook_destinations",
-]);
-
-const READONLY_KEYS = new Set(["cookie_secret", "instance_id"]);
-
 async function encryptIfSensitive(key: string, value: string): Promise<string> {
-  if (!env.DATA_ENCRYPTION_KEY || !ENCRYPTED_KEYS.has(key)) return value;
+  if (!env.DATA_ENCRYPTION_KEY || !getSettingPolicy(key)?.encrypted) return value;
   return encrypt(value, env.DATA_ENCRYPTION_KEY);
 }
 
+function hasSettingAuthority(
+  authority: SettingAuthority,
+  effectivePermissions: ReadonlySet<string>,
+  fullAdmin: boolean,
+): boolean {
+  if (authority === "none") return false;
+  if (authority === "full-admin") return fullAdmin;
+  return effectivePermissions.has(authority);
+}
+
 async function decryptIfNeeded(value: string): Promise<string> {
   if (!isEncrypted(value)) return value;
   if (!env.DATA_ENCRYPTION_KEY) return value;
@@ -77,13 +65,16 @@ export async function settingsRoutes(app: FastifyInstance): Promise<void> {
       const user = await requirePermission("settings:read")(request, reply);
       if (!user) return;
 
-      const isAdmin = user.role === "admin";
+      const effectivePermissions = new Set<string>(await getEffectivePermissions(user));
+      const fullAdmin = await isFullEffectiveAdmin(user);
       const rows = await db.select().from(schema.settings);
 
       const settings: Record<string, string> = {};
       for (const row of rows) {
-        if (!isAdmin && SENSITIVE_KEYS.has(row.key)) continue;
-        if (REDACTED_KEYS.has(row.key)) {
+        const policy = getSettingPolicy(row.key);
+        if (!policy || !hasSettingAuthority(policy.read, effectivePermissions, fullAdmin)) continue;
+        if (policy.storageKey && policy.storageKey !== row.key) continue;
+        if (policy.redacted) {
           settings[row.key] = "********";
           continue;
         }
@@ -95,7 +86,7 @@ export async function settingsRoutes(app: FastifyInstance): Promise<void> {
   );
 
   // PUT /api/v1/settings — Save settings (admin only)
-  app.put("/api/v1/settings", async (request: FastifyRequest, reply: FastifyReply) => {
+  const updateSettings = async (request: FastifyRequest, reply: FastifyReply) => {
     const admin = await requirePermission("settings:write")(request, reply);
     if (!admin) return;
 
@@ -107,60 +98,87 @@ export async function settingsRoutes(app: FastifyInstance): Promise<void> {
       });
     }
     const body = parsed.data;
+    const effectivePermissions = new Set<string>(await getEffectivePermissions(admin));
+    const fullAdmin = await isFullEffectiveAdmin(admin);
 
     // Pass 1: validate all entries before writing any
     const entries: Array<{ key: string; strValue: string }> = [];
+    const canonicalKeys = new Set<string>();
 
-    for (const [key, value] of Object.entries(body)) {
-      if (typeof key !== "string" || key.length === 0) continue;
+    for (const [requestedKey, value] of Object.entries(body)) {
+      if (typeof requestedKey !== "string" || requestedKey.length === 0) continue;
+      const rawValue = typeof value === "string" ? value : (JSON.stringify(value) ?? "");
 
-      const strValue = typeof value === "string" ? value : JSON.stringify(value);
-
-      if (HTML_TAG_PATTERN.test(key) || HTML_TAG_PATTERN.test(strValue)) {
+      if (HTML_TAG_PATTERN.test(requestedKey) || HTML_TAG_PATTERN.test(rawValue)) {
         return reply.status(400).send({
           error: "Settings keys and values must not contain HTML tags",
           code: "VALIDATION_ERROR",
         });
       }
 
+      const prepared = prepareSetting(requestedKey, value);
+      if (!prepared.success) {
+        return reply.status(400).send({
+          error: prepared.error,
+          code: prepared.code,
+          ...(prepared.details ? { details: prepared.details } : {}),
+        });
+      }
+
+      const { key, value: strValue, policy } = prepared;
+
+      if (policy.write === "none") {
+        return reply.status(400).send({
+          error: `Setting "${requestedKey}" cannot be modified via the API`,
+          code: "READONLY_SETTING",
+        });
+      }
+
+      if (!hasSettingAuthority(policy.write, effectivePermissions, fullAdmin)) {
+        const fullAdminRequired = policy.write === "full-admin";
+        return reply.status(403).send({
+          error: fullAdminRequired
+            ? "Full administrator authority required"
+            : `Setting "${requestedKey}" requires ${policy.write}`,
+          code: fullAdminRequired ? "ESCALATION_DENIED" : "FORBIDDEN",
+        });
+      }
+
       // A redacted secret comes back from GET as the literal mask, so a client that
       // reads settings, edits one field, and saves the whole object echoes the mask
       // back. Treat the mask as "leave this secret unchanged" instead of encrypting
       // and persisting "********", which would destroy the real secret (e.g. the OIDC
       // client secret or SIEM webhook auth, neither of which is read-only).
-      if (REDACTED_KEYS.has(key) && strValue === "********") {
+      if (policy.redacted && strValue === "********") {
         continue;
       }
 
-      if (READONLY_KEYS.has(key)) {
+      if (canonicalKeys.has(key)) {
         return reply.status(400).send({
-          error: `Setting "${key}" cannot be modified via the API`,
-          code: "READONLY_SETTING",
+          error: `Setting "${requestedKey}" duplicates "${key}" in the same request`,
+          code: "VALIDATION_ERROR",
         });
       }
-
-      // Enforcing MFA requires a way to actually enroll, which is gated behind
-      // the "mfa" enterprise feature. Letting this save through on an unlicensed
-      // instance creates a login rule nobody can satisfy (snapotter-hq/SnapOtter#515).
-      if (key === "mfaPolicy" && (strValue === "admins_only" || strValue === "required")) {
-        let mfaLicensed = false;
-        try {
-          const { isFeatureEnabled } = await import("@snapotter/enterprise");
-          mfaLicensed = isFeatureEnabled("mfa");
-        } catch {
-          // Enterprise package not available
-        }
-        if (!mfaLicensed) {
-          return reply.status(403).send({
-            error: "MFA requires an enterprise license",
-            code: "FEATURE_NOT_LICENSED",
-          });
-        }
-      }
+      canonicalKeys.add(key);
 
       entries.push({ key, strValue });
     }
 
+    // Enforcing MFA requires a licensed enrollment path. Keep this shared with
+    // config import so no settings write path can create an unsatisfiable login rule.
+    const runtimeValidation = await validateSettingsRuntimeConstraints(
+      entries.map(({ key, strValue }) => ({ key, value: strValue })),
+    );
+    if (!runtimeValidation.success) {
+      return reply.status(runtimeValidation.statusCode).send({
+        error: runtimeValidation.error,
+        code: runtimeValidation.code,
+        ...(runtimeValidation.validationErrors
+          ? { validationErrors: runtimeValidation.validationErrors }
+          : {}),
+      });
+    }
+
     // Pass 2: write all entries now that all have passed validation
     const now = new Date();
 
@@ -206,7 +224,12 @@ export async function settingsRoutes(app: FastifyInstance): Promise<void> {
     }
 
     return reply.send({ ok: true, updatedCount: entries.length });
-  });
+  };
+  app.put(
+    "/api/v1/settings",
+    { config: { rateLimit: { max: 60, timeWindow: "1 minute" } } },
+    updateSettings,
+  );
 
   // GET /api/v1/settings/:key — Get a specific setting
   app.get(
@@ -217,12 +240,24 @@ export async function settingsRoutes(app: FastifyInstance): Promise<void> {
       if (!user) return;
 
       const { key } = request.params;
-
-      if (SENSITIVE_KEYS.has(key) && user.role !== "admin") {
+      const policy = getSettingPolicy(key);
+      if (!policy) {
+        return reply.status(404).send({
+          error: `Setting "${key}" not found`,
+          code: "NOT_FOUND",
+        });
+      }
+      const effectivePermissions = new Set<string>(await getEffectivePermissions(user));
+      const fullAdmin = await isFullEffectiveAdmin(user);
+      if (!hasSettingAuthority(policy.read, effectivePermissions, fullAdmin)) {
         return reply.status(403).send({ error: "Forbidden", code: "FORBIDDEN" });
       }
 
-      const [row] = await db.select().from(schema.settings).where(eq(schema.settings.key, key));
+      const storageKey = policy.storageKey ?? key;
+      const [row] = await db
+        .select()
+        .from(schema.settings)
+        .where(eq(schema.settings.key, storageKey));
 
       if (!row) {
         return reply.status(404).send({
@@ -232,8 +267,8 @@ export async function settingsRoutes(app: FastifyInstance): Promise<void> {
       }
 
       return reply.send({
-        key: row.key,
-        value: REDACTED_KEYS.has(row.key) ? "********" : await decryptIfNeeded(row.value),
+        key: storageKey,
+        value: policy.redacted ? "********" : await decryptIfNeeded(row.value),
         updatedAt: row.updatedAt.toISOString(),
       });
     },