# PATCH /websites/:website_id/turnstile

**Resource:** [Websites](./websites.md)  
**MCP tool:** `update_website_turnstile`  
**Scopes:** `websites:write`  
**Write operation:** yes

Update a website's bot protection: toggle the master switch on/off (enabled), change the widget mode (managed, non-interactive, invisible), or set per-surface overrides (surface_policy). The master switch protects every widget-capable surface at once; surface_policy overrides individual surfaces while the master is on, e.g. {"lead_form":"rate_limited"} keeps forms/bookings challenged but drops the Lead Form to rate limiting. Pass surface_policy: null to clear all overrides.

## Parameters

| Name | In | Type | Required | Description |
|------|----|------|----------|-------------|
| `website_id` | path | string | yes |  |
| `enabled` | body | boolean | no |  |
| `mode` | body | string | no |  |
| `surface_policy` | body | object,null | no | Per-surface overrides while the master is on. Keys: forms, bookings, lead_form, voice. Values: widget \| rate_limited \| off. A surface with no entry inherits widget while the master is on. "voice" governs in-browser AI voice calls ("Talk to the AI"): set it to widget only once the site actually renders a Turnstile widget before the call starts, otherwise every call is rejected; rate_limited leaves it guarded by the per-visitor and global call limits instead. null clears all overrides. |
| `require_approval` | body | boolean | no | Optional. Set true to route this write into the approval queue for human review instead of executing it immediately (returns 202 + an approval_id). Works even when your key/token has permission to execute directly. |

## Request example

```bash
curl -X PATCH   "https://api.trustpager.com/functions/v1/api/v1/websites/:website_id/turnstile"   -H "Authorization: Bearer YOUR_API_KEY"   -H "Content-Type: application/json"   -d '{"enabled":"...","mode":"..."}'
```

---
Base URL: `https://api.trustpager.com/functions/v1/api/v1` — Auth: `Authorization: Bearer YOUR_API_KEY`