API Reference
  1. Anka Secure Admin API
  2. Tenant Policies

Set tenant algorithm policy

put
https://staging.ankatech.co/api/v3/admin/tenants//policies/algorithm-availability

Creates or updates the algorithm availability policy for a specific tenant.
This operation is idempotent - it will create if not exists, or update if exists.

The tenant policy overrides the deployment-level policy for this tenant only.

Policy evaluation follows this order:

  1. explicitAlgorithms (if non-empty, immediate ALLOW)
  2. Composite test: family → category → level → standards → operations

Empty arrays ([]) mean no restriction for that dimension.

Use cases:
• Restrict tenant to quantum-safe algorithms only
• Allow specific algorithms for compliance
• Enforce higher security levels than deployment default

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Path Params
uuid
required
Body Params

Algorithm policy configuration

Request to create an algorithm availability policy

uuid

Template ID to base policy on (technical identifier)

string
length between 1 and 100
^[A-Z0-9_-]+$

Template name (human-readable alternative to templateId)

boolean | null
Defaults to false

Whether the tenant admin may modify this policy. Only meaningful when the deployment is unlocked. Set by platform admin at tenant creation or via PATCH /override-flag.

string
Defaults to 1.0

Model version

explicitAlgorithms
array of strings
length between 0 and 100

Explicit list of allowed algorithms. Each algorithm name should match the system's algorithm catalog.

explicitAlgorithms
allowedFamilies
array of strings
length between 0 and 50

Allowed algorithm families. Valid values: ML-KEM, HQC, FRODO, ML-DSA, SLH-DSA, FALCON, XMSS, LMS, EC, OKP, RSA, oct

allowedFamilies
allowedCategories
array of strings
length between 0 and 50

Allowed algorithm categories. Valid values: CLASSICAL, POST_QUANTUM

allowedCategories
allowedLevels
array of strings
length between 0 and 20

Allowed NIST security levels — canonical L-string form only. Valid values: L1, L3, L5. L0 is reserved for internal/non-template use and is REJECTED at the template surface.

allowedLevels
mandatoryStandards
array of strings
length between 0 and 20

Mandatory compliance standards. Each entry MUST name a standard declared by the platform algorithm catalogue; an unknown value is rejected with HTTP 400 (application/problem+json) whose detail enumerates the accepted values.

mandatoryStandards
allowedOperations
array of strings
length between 0 and 50

Allowed cryptographic operations. Valid values: encrypt, decrypt, sign, verify

allowedOperations
customRules
object

Custom validation rules

boolean

Deny all cryptographic operations for this policy scope (emergency lockdown). When true, no algorithm is permitted regardless of other policy fields. Cannot be combined with explicitAlgorithms. Default: false.

boolean

Require hybrid keys for PQC algorithms (except hash-based signatures). When true, standalone ML-KEM, ML-DSA, FALCON, FRODO keys are blocked. Exception: SLH-DSA, XMSS, LMS can be generated standalone per BSI/ANSSI regulations.

allowedCompositeModes
array of strings
length between 0 and 10

Allowed composite modes. Valid values: COMPOSITE_KEM_COMBINE, COMPOSITE_SIGNATURE. NULL = all modes allowed. ETSI TS 103 744 may restrict to COMPOSITE_KEM_COMBINE only.

allowedCompositeModes
allowedKdfs
array of strings
length between 0 and 10

Allowed Key Derivation Functions. Valid values: HKDF-SHA256, CatKDF, CasKDF. NULL = all KDFs allowed. ANSSI prefers HKDF-SHA256, ETSI TS 103 744 specifies CatKDF/CasKDF.

allowedKdfs
int32
enum

Minimum NIST security level (1=128-bit, 3=192-bit, 5=256-bit). BSI/ANSSI require minimum Level 3 for government/critical infrastructure.

Allowed:
string
length between 0 and 100

Regulatory framework identifier for audit/compliance reporting. Examples: BSI-TR-02102-1, ANSSI-RGS-v2, ETSI-TS-103-744, NIST-SP-800-227

string
length between 0 and 1000

Administrative notes explaining the reason for this policy change (audit trail)

Headers
string
enum
Defaults to application/json

Generated from available response content types

Allowed:
Responses

Updated 11 days ago

Did this page help you?
Language
Credentials
Bearer
JWT
URL
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json
application/problem+json

Updated 11 days ago

Did this page help you?