AI DLP Presets API

Endpoints

• List AI DLP Presets - List built-in and custom DLP presets
• Get AI DLP Preset - Get a single DLP preset by name
• Create AI DLP Preset - Create a preset, or update one (built-in or custom) with the same name (upsert)
• Update AI DLP Preset - Update an existing preset, built-in or custom
• Delete AI DLP Preset - Delete a preset, built-in or custom

Authentication

All endpoints require authentication using a Personal API Access Token.

Permissions

• Admin Only - All endpoints require admin privileges (sysAdmin user or a user with the ADMIN role). Presets are a platform-level catalog; a project-scoped AI_DEVELOPMENT token is not sufficient.

Project-Scoped Surface

Besides the admin/global endpoints above (/apiops/settings/ai-dlp-presets/...), the same DLP preset family is also exposed under a project-scoped path, so a project's own AI_DEVELOPMENT token can read the effective preset catalog and manage its own custom presets without needing platform ADMIN privileges:

GET    /apiops/projects/{projectName}/ai-dlp-presets/
GET    /apiops/projects/{projectName}/ai-dlp-presets/{presetName}/
POST   /apiops/projects/{projectName}/ai-dlp-presets/{presetName}/
PUT    /apiops/projects/{projectName}/ai-dlp-presets/{presetName}/
DELETE /apiops/projects/{projectName}/ai-dlp-presets/{presetName}/

Same 5-endpoint shape, request/response bodies and field surface as the admin endpoints documented on this page — only the base path, scope resolution and permission differ:

	Admin surface (/apiops/settings/...)	Project surface (/apiops/projects/{projectName}/...)
Scope resolution	Optional ?projectId= query parameter (default admin/global scope)	{projectName} path segment, resolved to the caller's own project — never a query parameter
Permission	System admin (sysAdmin user or ADMIN role)	AI_DEVELOPMENT + VIEW (read) / MANAGE (write) in the project
Read visibility	Presets in the resolved scope only	Union of built-in presets ∪ admin-shared custom presets ∪ this project's own custom presets
Write visibility	Any preset in the resolved scope, including built-in	Only presets this project owns. A name that only resolves to a built-in or admin-shared preset is treated as not existing for this project: POST creates a new project-owned preset (and fails on the name collision), while PUT/DELETE report the preset as not found

The admin ?projectId= surface is unchanged by this addition and stays fully backward compatible; its permission requirement is not widened.

Built-in Presets Are Editable

A seeded preset (builtIn: true) is not read-only: PUT and DELETE on this surface accept it the same as a custom preset, gated by the same admin permission every endpoint here requires. Deleting one is permanent — Mongock deduplicates seed changesets by id and none of them are runAlways=true, so a deleted built-in preset does not reappear on a version upgrade; it returns only if a future release ships an explicit re-seed changeset.

Editing a built-in row marks it overridden. Unlike the other preset catalogs, the DLP catalog's built-in rows are also refreshed by a versioned rule-pack loader: a platform upgrade can ship a new pack version that updates a built-in rule's content in place (see the seed/refresh mechanism note below). The first time an admin edits a built-in row (through this API or the Manager UI), the saved row is flagged overridden: true; from that point on the loader treats it the same as a user-owned custom row and skips it on every future pack apply, so the admin's edit is never silently overwritten by a later platform upgrade. overridden is response-only — sending it in a request body has no effect — and is documented on the Get and List pages.

Related Documentation

• Authentication Guide - How to obtain and use API tokens
• Error Handling - Error response formats
• AI Privacy Presets API - Manage AI privacy (PII) presets
• AI Prompt-Guard Presets API - Manage AI prompt-guard presets
• AI Gateway Settings API - Global AI Gateway settings