Allow or disallow mature content on this install
PATCH /admin/system/mature-content
Sets the switch. Requires the system.config.write capability
and is recorded as an admin.system.mature_content_updated
audit event.
⚠️ SWITCHING IT OFF CLEARS NOTHING. Flags already set survive, so switching it back on restores the library exactly. The switch governs ENFORCEMENT and PUBLICATION, never storage — turning it off would otherwise be a destructive operation disguised as a display preference, and an operator who flipped it to see what happened could not undo it.
With it off:
- nobody qualifies for mature content except an asset’s OWNER
and a
system.admin(ADR 0090 §2 — an artist must not lose access to their own work because an operator flipped a display switch, and an admin has to be able to moderate what the switch hid); - setting a
matureflag on an asset is REFUSED with a 400 rather than accepted-and-ignored. Clearing one is still accepted, so an operator who has just switched the feature off can unmark what was marked while it was on.
The change takes effect on the next request without a restart:
the read is deliberately uncached, because a stale true would
keep serving mature content on an install whose operator has
just switched it off.
Authorizations
Section titled “Authorizations ”Request Body required
Section titled “Request Body required ”The install-wide mature-content switch (#1116, ADR 0090 §2).
⚠️ THE WIRE FIELD IS NAMED FOR THE PERMISSIVE DIRECTION AND THE
STORED ONE IS NOT, and the difference is not an oversight. The
stored struct’s field is disallowed, so its ZERO VALUE — an
empty blob, a partial decode, an install that has never
configured this — reads as the permissive upgrade default. The
wire field is allowed, because that is the question an
operator is answering, and it is REQUIRED so no zero value is
ever in play on this side: a body that omits it is a 400, not a
silent switch-off.
object
Whether this install permits mature content at all. true
for an install that has never configured it.
Allowing shows nothing to anybody by itself — the viewer still has to be signed in and opted in, and the opt-in defaults off. DISallowing is absolute: it outranks an opted-in reader’s own preference, because the operator’s answer is about the install and the reader’s is about themselves.
Responses
Section titled “ Responses ”The updated switch
The install-wide mature-content switch (#1116, ADR 0090 §2).
⚠️ THE WIRE FIELD IS NAMED FOR THE PERMISSIVE DIRECTION AND THE
STORED ONE IS NOT, and the difference is not an oversight. The
stored struct’s field is disallowed, so its ZERO VALUE — an
empty blob, a partial decode, an install that has never
configured this — reads as the permissive upgrade default. The
wire field is allowed, because that is the question an
operator is answering, and it is REQUIRED so no zero value is
ever in play on this side: a body that omits it is a 400, not a
silent switch-off.
object
Whether this install permits mature content at all. true
for an install that has never configured it.
Allowing shows nothing to anybody by itself — the viewer still has to be signed in and opted in, and the opt-in defaults off. DISallowing is absolute: it outranks an opted-in reader’s own preference, because the operator’s answer is about the install and the reader’s is about themselves.
Malformed request
object
Human-readable error summary
Example
the request could not be completedAuthentication required, missing, or invalid
object
Human-readable error summary
Example
the request could not be completedExample
{ "error": "authentication required: sign in and retry with a valid session or API token"}Authenticated but missing required capabilities
object
Human-readable error summary
Example
the request could not be completed