> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Write one entry > Writes a runtime-managed entry by namespace and key. The request body must be `{"value": }`, where `` matches the shape the target key's validator accepts. A missing or invalid `value`, or a value that fails the key's validator, is rejected with `400`. When authentication is enabled, this endpoint requires the namespace's write permission (for example, `system_tenant_policy:write`). Success returns `204 No Content`. ## OpenAPI ````yaml en/openapi/v3-current/systemplane.yaml put /system/{namespace}/{key} openapi: 3.1.0 info: title: Lerian Systemplane Admin API version: v1.0.0 contact: email: contact@lerian.studio name: Lerian Studio url: https://lerian.studio license: name: Lerian Studio General License description: >- The Systemplane admin API is the shared runtime-configuration control plane that Lerian applications expose so you can inspect and change operational settings on a running service — without a restart. In regulated financial environments, taking a service down to apply a configuration change is both a compliance risk and an operational disruption; Systemplane lets you adjust the values a service safely supports while it keeps serving traffic. This surface is not a standalone service. Each application mounts the same route set onto its own HTTP host and port under an application-specific path prefix — there is no dedicated Systemplane host or port. The canonical prefix documented here is `/system`, but it varies per application (for example, Lender mounts it under `/api/v1/systemplane` and the SFN rails under `/v1/system`). Substitute the host, port, and prefix of the application whose configuration you are managing. Because the routes are registered programmatically rather than emitted by a code generator, they do not appear in each product's generated API reference — this specification documents the surface by hand. Configuration is organized into **namespaces**, each holding flat string-keyed entries. Rails and plugins use three canonical namespaces — `runtime_config` (operational knobs such as rate limits and worker intervals), `tenant_policy` (tenant-scoped policy objects), and `operational_registry` (operational lookup data). Some applications register a single application-named namespace instead. Each entry's value is untyped at the transport layer: every registered key accepts its own JSON scalar, object, or array, validated by that key's server-side validator. Authorization is **deny-all by default**. When authentication is enabled, an application enforces per-namespace role-based access control: reads require the namespace's read permission (`system_runtime_config:read`, `system_tenant_policy:read`, or `system_operational_registry:read`) and writes require the matching write permission (`system_runtime_config:write`, `system_tenant_policy:write`, or `system_operational_registry:write`). The exact permission strings can vary per application. The whole surface is gated by the `SYSTEMPLANE_ENABLED` setting, which is off by default; when it is disabled the application runs in environment-variable-only mode and these routes are not served. An optional catalog surface under the reserved `/-/catalog` path lets you discover which keys an application registers, along with each key's write contract (kind, tenant scope, redaction policy, validation rules, and examples). Errors use a flat `{"code": , "title": "", "message": ""}` envelope. Mutating operations return `204 No Content` on success. servers: - url: https://{host} description: >- The Systemplane admin API is served by each Lerian application on its own host and port under an application-specific prefix (default `/system`). Substitute the host of the application whose runtime configuration you are managing. variables: host: default: your-lerian-app.example.com description: >- The host (and port) of the application that mounts the Systemplane admin API. security: - BearerAuth: [] tags: - name: Entries description: >- List, read, write, and delete the runtime-managed configuration entries in a namespace. - name: Catalog description: >- Discover the keys an application registers and each key's expected write contract. Opt-in per application. paths: /system/{namespace}/{key}: put: tags: - Entries summary: Write one entry description: >- Writes a runtime-managed entry by namespace and key. The request body must be `{"value": }`, where `` matches the shape the target key's validator accepts. A missing or invalid `value`, or a value that fails the key's validator, is rejected with `400`. When authentication is enabled, this endpoint requires the namespace's write permission (for example, `system_tenant_policy:write`). Success returns `204 No Content`. operationId: putSystemplaneEntry parameters: - $ref: '#/components/parameters/Namespace' - $ref: '#/components/parameters/Key' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/PutRequest' responses: '204': description: The entry was written. '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalError' '503': $ref: '#/components/responses/ServiceUnavailable' security: - BearerAuth: [] components: parameters: Namespace: name: namespace in: path required: true description: >- The Systemplane namespace. Rails and plugins use `runtime_config`, `tenant_policy`, or `operational_registry`; some applications register a single application-named namespace instead. schema: type: string examples: - runtime_config Key: name: key in: path required: true description: >- The registered key within the namespace. Keys are flat, dot-delimited identifiers; a key may itself contain `/` segments. schema: type: string examples: - tenancy.ispb_organization_bindings schemas: PutRequest: type: object additionalProperties: false description: >- The write payload. `value` is intentionally untyped at the transport layer — each registered key accepts its own JSON scalar, object, or array shape, validated by that key's server-side validator. properties: value: description: >- The new value for the entry. Its accepted shape is defined by the target key's validator; consult the key's catalog contract via `GET /system/-/catalog/{namespace}/{key}`. examples: - info required: - value ErrorResponse: type: object additionalProperties: false description: >- The flat error envelope returned across the Systemplane admin surface. It carries a machine-readable HTTP status code, a short title, and a human-readable message; it never returns secret material. properties: code: type: integer description: The HTTP status code. examples: - 403 title: type: string description: A short, machine-readable title for the error class. examples: - forbidden message: type: string description: A human-readable description of what went wrong. examples: - 'systemplane admin: insufficient permissions: permission denied' required: - code - title - message responses: BadRequest: description: >- The request is caller-correctable — an unknown key, a missing or invalid `value`, a value that fails the key's validator, or a request that is not valid for the current tenancy mode. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: >- Authentication failed, or there is no trusted platform identity on the request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: >- The authorizer denied the request — the identity lacks the namespace permission required for this action, or the surface is deny-all because no authorizer is configured. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' NotFound: description: The namespace or key does not exist. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: An internal fault. Detail is logged, not returned. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ServiceUnavailable: description: >- The Systemplane store is not started or has been closed — the application is not currently able to serve the request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- A bearer JWT issued by the platform's Access Manager (plugin-auth / lib-auth). Authorization is deny-all by default: the application must be configured with an authorizer, and when authentication is enabled it enforces per-namespace role-based access control on top of a valid, platform-scoped (non-tenant) identity. Machine callers obtain a token via the Access Manager client-credentials flow. ````