> For the complete documentation index, see [llms.txt](https://docs.n8n.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.n8n.io/connect/n8n-api/security-policy.md).

# Security Policy

Operations about the instance security policy settings

## Retrieve the security policy

> Retrieve the instance security policy: personal-space publishing and sharing, the execution-data redaction enforcement floor, and the read-only usage counts shown in the UI. Requires the \`securitySettings:manage\` scope and the Personal Space Policy feature to be licensed.<br>

```json
{"openapi":"3.0.0","info":{"title":"n8n Public API","version":"1.1.1"},"tags":[{"name":"SecurityPolicy","description":"Operations about the instance security policy settings"}],"servers":[{"url":"/api/v1","description":"Current n8n instance (self-hosted built-in playground)"},{"url":"{url}/api/v1","description":"Self-hosted n8n instance","variables":{"url":{"default":"https://example.com"}}}],"security":[{"ApiKeyAuth":[]},{"BearerAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-N8N-API-KEY"},"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"}},"schemas":{"security-policy":{"type":"object","additionalProperties":false,"required":["personalSpacePublishing","personalSpaceSharing","publishedPersonalWorkflowsCount","sharedPersonalWorkflowsCount","sharedPersonalCredentialsCount","redactionEnforcement"],"properties":{"personalSpacePublishing":{"type":"boolean","description":"Whether members may publish workflows and agents from their personal space."},"personalSpaceSharing":{"type":"boolean","description":"Whether members may share workflows and credentials from their personal space."},"publishedPersonalWorkflowsCount":{"type":"integer","readOnly":true,"description":"Number of currently published personal workflows, shown for awareness before tightening the policy."},"sharedPersonalWorkflowsCount":{"type":"integer","readOnly":true,"description":"Number of personal workflows currently shared with other users."},"sharedPersonalCredentialsCount":{"type":"integer","readOnly":true,"description":"Number of personal credentials currently shared with other users."},"redactionEnforcement":{"type":"object","additionalProperties":false,"required":["floor"],"properties":{"floor":{"type":"string","enum":["off","production","all"],"description":"Minimum execution-data redaction level enforced across the instance."}}}}}},"responses":{"unauthorized":{"description":"Unauthorized"},"forbidden":{"description":"Forbidden"}}},"paths":{"/settings/security-policy":{"get":{"tags":["SecurityPolicy"],"summary":"Retrieve the security policy","description":"Retrieve the instance security policy: personal-space publishing and sharing, the execution-data redaction enforcement floor, and the read-only usage counts shown in the UI. Requires the `securitySettings:manage` scope and the Personal Space Policy feature to be licensed.\n","responses":{"200":{"description":"Operation successful.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/security-policy"}}}},"401":{"$ref":"#/components/responses/unauthorized"},"403":{"$ref":"#/components/responses/forbidden"}}}}}}
```

## Set the security policy

> Replace the instance security policy with the provided full object. Every writable field must be sent. Read-only usage counts from GET are ignored if included, so a GET response can be sent back as a PUT body. The update takes effect exactly as it would from the UI, using the same validation. Requires the \`securitySettings:manage\` scope and the Personal Space Policy feature to be licensed. When the group is managed via environment variables, the write is rejected with 409 and no changes are made; a read still returns the current values.<br>

```json
{"openapi":"3.0.0","info":{"title":"n8n Public API","version":"1.1.1"},"tags":[{"name":"SecurityPolicy","description":"Operations about the instance security policy settings"}],"servers":[{"url":"/api/v1","description":"Current n8n instance (self-hosted built-in playground)"},{"url":"{url}/api/v1","description":"Self-hosted n8n instance","variables":{"url":{"default":"https://example.com"}}}],"security":[{"ApiKeyAuth":[]},{"BearerAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-N8N-API-KEY"},"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"}},"schemas":{"security-policy.update":{"type":"object","additionalProperties":false,"description":"Full security policy. All writable fields must be provided; partial updates are not supported.","required":["personalSpacePublishing","personalSpaceSharing","redactionEnforcement"],"properties":{"personalSpacePublishing":{"type":"boolean","description":"Whether members may publish workflows and agents from their personal space."},"personalSpaceSharing":{"type":"boolean","description":"Whether members may share workflows and credentials from their personal space."},"redactionEnforcement":{"type":"object","additionalProperties":false,"required":["floor"],"properties":{"floor":{"type":"string","enum":["off","production","all"],"description":"Minimum execution-data redaction level enforced across the instance."}}},"publishedPersonalWorkflowsCount":{"type":"integer","description":"Read-only usage count returned by GET. Ignored on write so a GET response can be sent back as a PUT body.\n"},"sharedPersonalWorkflowsCount":{"type":"integer","description":"Read-only usage count returned by GET. Ignored on write so a GET response can be sent back as a PUT body.\n"},"sharedPersonalCredentialsCount":{"type":"integer","description":"Read-only usage count returned by GET. Ignored on write so a GET response can be sent back as a PUT body.\n"}}},"security-policy":{"type":"object","additionalProperties":false,"required":["personalSpacePublishing","personalSpaceSharing","publishedPersonalWorkflowsCount","sharedPersonalWorkflowsCount","sharedPersonalCredentialsCount","redactionEnforcement"],"properties":{"personalSpacePublishing":{"type":"boolean","description":"Whether members may publish workflows and agents from their personal space."},"personalSpaceSharing":{"type":"boolean","description":"Whether members may share workflows and credentials from their personal space."},"publishedPersonalWorkflowsCount":{"type":"integer","readOnly":true,"description":"Number of currently published personal workflows, shown for awareness before tightening the policy."},"sharedPersonalWorkflowsCount":{"type":"integer","readOnly":true,"description":"Number of personal workflows currently shared with other users."},"sharedPersonalCredentialsCount":{"type":"integer","readOnly":true,"description":"Number of personal credentials currently shared with other users."},"redactionEnforcement":{"type":"object","additionalProperties":false,"required":["floor"],"properties":{"floor":{"type":"string","enum":["off","production","all"],"description":"Minimum execution-data redaction level enforced across the instance."}}}}}},"responses":{"badRequest":{"description":"The request is invalid or provides malformed data."},"unauthorized":{"description":"Unauthorized"},"forbidden":{"description":"Forbidden"},"conflict":{"description":"Conflict"}}},"paths":{"/settings/security-policy":{"put":{"tags":["SecurityPolicy"],"summary":"Set the security policy","description":"Replace the instance security policy with the provided full object. Every writable field must be sent. Read-only usage counts from GET are ignored if included, so a GET response can be sent back as a PUT body. The update takes effect exactly as it would from the UI, using the same validation. Requires the `securitySettings:manage` scope and the Personal Space Policy feature to be licensed. When the group is managed via environment variables, the write is rejected with 409 and no changes are made; a read still returns the current values.\n","requestBody":{"description":"The full security policy to set.","required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/security-policy.update"}}}},"responses":{"200":{"description":"Operation successful.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/security-policy"}}}},"400":{"$ref":"#/components/responses/badRequest"},"401":{"$ref":"#/components/responses/unauthorized"},"403":{"$ref":"#/components/responses/forbidden"},"409":{"$ref":"#/components/responses/conflict"}}}}}}
```