> For the complete documentation index, see [llms.txt](https://docs.n8n.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.n8n.io/connect/n8n-api/security-policy.md).

# Security Policy

Operations about the instance security policy settings

## Retrieve the security policy

> Retrieve the instance security policy: personal-space publishing and sharing, the execution-data redaction enforcement floor, and the read-only usage counts shown in the UI. Requires the \`securitySettings:manage\` scope and the Personal Space Policy feature to be licensed.

```json
{"openapi":"3.0.0","info":{"title":"n8n Public API","version":"1.1.1"},"tags":[{"name":"SecurityPolicy","description":"Operations about the instance security policy settings"}],"servers":[{"url":"/api/v1","description":"Current n8n instance (self-hosted built-in playground)"},{"url":"{url}/api/v1","description":"Self-hosted n8n instance","variables":{"url":{"default":"https://example.com"}}}],"security":[{"ApiKeyAuth":[]},{"BearerAuth":[]},{"CookieAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-N8N-API-KEY"},"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"},"CookieAuth":{"type":"apiKey","in":"cookie","name":"n8n-auth"}},"schemas":{"securityPolicyPublicDto.generated":{"type":"object","properties":{"personalSpacePublishing":{"type":"boolean","description":"Whether members may publish workflows and agents from their personal space."},"personalSpaceSharing":{"type":"boolean","description":"Whether members may share workflows and credentials from their personal space."},"publishedPersonalWorkflowsCount":{"type":"integer","description":"Number of currently published personal workflows, shown for awareness before tightening the policy.","readOnly":true},"sharedPersonalWorkflowsCount":{"type":"integer","description":"Number of personal workflows currently shared with other users.","readOnly":true},"sharedPersonalCredentialsCount":{"type":"integer","description":"Number of personal credentials currently shared with other users.","readOnly":true},"redactionEnforcement":{"type":"object","properties":{"floor":{"type":"string","enum":["off","production","all"],"description":"Minimum execution-data redaction level enforced across the instance."}},"required":["floor"],"additionalProperties":false}},"required":["personalSpacePublishing","personalSpaceSharing","publishedPersonalWorkflowsCount","sharedPersonalWorkflowsCount","sharedPersonalCredentialsCount","redactionEnforcement"],"additionalProperties":false}},"responses":{"unauthorized":{"description":"Unauthorized"},"forbidden":{"description":"Forbidden"}}},"paths":{"/settings/security-policy":{"get":{"operationId":"getSecurityPolicy","tags":["SecurityPolicy"],"summary":"Retrieve the security policy","description":"Retrieve the instance security policy: personal-space publishing and sharing, the execution-data redaction enforcement floor, and the read-only usage counts shown in the UI. Requires the `securitySettings:manage` scope and the Personal Space Policy feature to be licensed.","responses":{"200":{"description":"Operation successful.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/securityPolicyPublicDto.generated"}}}},"401":{"$ref":"#/components/responses/unauthorized"},"403":{"$ref":"#/components/responses/forbidden"}}}}}}
```

## Set the security policy

> Replace the instance security policy with the provided full object. Every writable field must be sent. Read-only usage counts from GET are ignored if included, so a GET response can be sent back as a PUT body. The update takes effect exactly as it would from the UI, using the same validation. Requires the \`securitySettings:manage\` scope and the Personal Space Policy feature to be licensed. When the group is managed via environment variables, the write is rejected with 409 and no changes are made; a read still returns the current values.

```json
{"openapi":"3.0.0","info":{"title":"n8n Public API","version":"1.1.1"},"tags":[{"name":"SecurityPolicy","description":"Operations about the instance security policy settings"}],"servers":[{"url":"/api/v1","description":"Current n8n instance (self-hosted built-in playground)"},{"url":"{url}/api/v1","description":"Self-hosted n8n instance","variables":{"url":{"default":"https://example.com"}}}],"security":[{"ApiKeyAuth":[]},{"BearerAuth":[]},{"CookieAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-N8N-API-KEY"},"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"},"CookieAuth":{"type":"apiKey","in":"cookie","name":"n8n-auth"}},"schemas":{"securityPolicyPublicDto.generated":{"type":"object","properties":{"personalSpacePublishing":{"type":"boolean","description":"Whether members may publish workflows and agents from their personal space."},"personalSpaceSharing":{"type":"boolean","description":"Whether members may share workflows and credentials from their personal space."},"publishedPersonalWorkflowsCount":{"type":"integer","description":"Number of currently published personal workflows, shown for awareness before tightening the policy.","readOnly":true},"sharedPersonalWorkflowsCount":{"type":"integer","description":"Number of personal workflows currently shared with other users.","readOnly":true},"sharedPersonalCredentialsCount":{"type":"integer","description":"Number of personal credentials currently shared with other users.","readOnly":true},"redactionEnforcement":{"type":"object","properties":{"floor":{"type":"string","enum":["off","production","all"],"description":"Minimum execution-data redaction level enforced across the instance."}},"required":["floor"],"additionalProperties":false}},"required":["personalSpacePublishing","personalSpaceSharing","publishedPersonalWorkflowsCount","sharedPersonalWorkflowsCount","sharedPersonalCredentialsCount","redactionEnforcement"],"additionalProperties":false}},"responses":{"badRequest":{"description":"The request is invalid or provides malformed data."},"unauthorized":{"description":"Unauthorized"},"forbidden":{"description":"Forbidden"},"conflict":{"description":"Conflict"},"unsupportedMediaType":{"description":"Unsupported media type."}}},"paths":{"/settings/security-policy":{"put":{"operationId":"updateSecurityPolicy","tags":["SecurityPolicy"],"summary":"Set the security policy","description":"Replace the instance security policy with the provided full object. Every writable field must be sent. Read-only usage counts from GET are ignored if included, so a GET response can be sent back as a PUT body. The update takes effect exactly as it would from the UI, using the same validation. Requires the `securitySettings:manage` scope and the Personal Space Policy feature to be licensed. When the group is managed via environment variables, the write is rejected with 409 and no changes are made; a read still returns the current values.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"personalSpacePublishing":{"type":"boolean","description":"Whether members may publish workflows and agents from their personal space."},"personalSpaceSharing":{"type":"boolean","description":"Whether members may share workflows and credentials from their personal space."},"redactionEnforcement":{"type":"object","properties":{"floor":{"type":"string","enum":["off","production","all"],"description":"Minimum execution-data redaction level enforced across the instance."}},"required":["floor"],"additionalProperties":false},"publishedPersonalWorkflowsCount":{"type":"integer","description":"Read-only usage count returned by GET. Ignored on write so a GET response can be sent back as a PUT body."},"sharedPersonalWorkflowsCount":{"type":"integer","description":"Read-only usage count returned by GET. Ignored on write so a GET response can be sent back as a PUT body."},"sharedPersonalCredentialsCount":{"type":"integer","description":"Read-only usage count returned by GET. Ignored on write so a GET response can be sent back as a PUT body."}},"required":["personalSpacePublishing","personalSpaceSharing","redactionEnforcement"],"additionalProperties":false,"description":"Full security policy. All writable fields must be provided; partial updates are not supported."}}}},"responses":{"200":{"description":"Operation successful.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/securityPolicyPublicDto.generated"}}}},"400":{"$ref":"#/components/responses/badRequest"},"401":{"$ref":"#/components/responses/unauthorized"},"403":{"$ref":"#/components/responses/forbidden"},"409":{"$ref":"#/components/responses/conflict"},"415":{"$ref":"#/components/responses/unsupportedMediaType"}}}}}}
```