> ## Documentation Index > Fetch the complete documentation index at: https://docs.aitasker.co/llms.txt > Use this file to discover all available pages before exploring further. # Set Brand Visibility > Flip one advertiser between ``public`` and ``tenant_private``. ``library_visibility`` used to be fixed at mint time. It is now operator-adjustable because the census surfaced the case it was blocking: a ZOB — an advertiser minted ``tenant_private`` by an own-brand claim whose owning Brand has since been deleted — is reachable by NO tenant at all. ``advertiser_identity.visible_to_caller_predicate`` admits a ``tenant_private`` row only for a caller who owns it through a brand link, and a ZOB has no such link left. Flipping it public is the one action that returns it to the library instead of leaving it stranded. **Free for ZOB. Guarded toward ``public`` for UOB/DOB.** A row some tenant still owns or discovered is that tenant's private record; making it public publishes it to every other tenant's browse surfaces. That refusal is a 409 the caller can override with ``force: true`` — the operator sometimes genuinely means it — and a forced flip is recorded as such in the audit row rather than being indistinguishable from an unguarded one. The guard is deliberately one-directional. Flipping TO ``tenant_private`` only narrows who can see the row, so it needs no override; the exposure this endpoint has to be careful about has exactly one direction. Re-derives UOB/DOB server-side under the row lock, exactly as ``untrack_brand`` does: the census page's button state is computed from a payload that can be minutes stale, and a direct API call has no button at all. Idempotent: requesting the visibility the row already holds is a 200 with ``changed=false`` — no UPDATE, no audit row, no commit. Nothing is being exposed that was not already exposed, so the UOB/DOB guard has nothing to refuse and is not consulted. ## OpenAPI ````yaml /openapi.json patch /api/v1/admin/brand-library/brands/{advertiser_id}/visibility openapi: 3.1.0 info: title: AITasker version: 0.1.0 servers: [] security: [] paths: /api/v1/admin/brand-library/brands/{advertiser_id}/visibility: patch: tags: - Admin Brand Library - Admin summary: Set Brand Visibility description: >- Flip one advertiser between ``public`` and ``tenant_private``. ``library_visibility`` used to be fixed at mint time. It is now operator-adjustable because the census surfaced the case it was blocking: a ZOB — an advertiser minted ``tenant_private`` by an own-brand claim whose owning Brand has since been deleted — is reachable by NO tenant at all. ``advertiser_identity.visible_to_caller_predicate`` admits a ``tenant_private`` row only for a caller who owns it through a brand link, and a ZOB has no such link left. Flipping it public is the one action that returns it to the library instead of leaving it stranded. **Free for ZOB. Guarded toward ``public`` for UOB/DOB.** A row some tenant still owns or discovered is that tenant's private record; making it public publishes it to every other tenant's browse surfaces. That refusal is a 409 the caller can override with ``force: true`` — the operator sometimes genuinely means it — and a forced flip is recorded as such in the audit row rather than being indistinguishable from an unguarded one. The guard is deliberately one-directional. Flipping TO ``tenant_private`` only narrows who can see the row, so it needs no override; the exposure this endpoint has to be careful about has exactly one direction. Re-derives UOB/DOB server-side under the row lock, exactly as ``untrack_brand`` does: the census page's button state is computed from a payload that can be minutes stale, and a direct API call has no button at all. Idempotent: requesting the visibility the row already holds is a 200 with ``changed=false`` — no UPDATE, no audit row, no commit. Nothing is being exposed that was not already exposed, so the UOB/DOB guard has nothing to refuse and is not consulted. operationId: >- set_brand_visibility_api_v1_admin_brand_library_brands__advertiser_id__visibility_patch parameters: - name: advertiser_id in: path required: true schema: type: string format: uuid title: Advertiser Id requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/BrandLibraryVisibilityUpdate' responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/BrandLibraryVisibilityResult' '409': content: application/json: schema: $ref: '#/components/schemas/BrandLibraryConflictResponse' description: Conflict '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - HTTPBearer: [] components: schemas: BrandLibraryVisibilityUpdate: properties: library_visibility: type: string enum: - public - tenant_private title: Library Visibility force: type: boolean title: Force default: false type: object required: - library_visibility title: BrandLibraryVisibilityUpdate description: >- Body for ``PATCH /admin/brand-library/brands/{id}/visibility``. ``library_visibility`` is spelled as a ``Literal`` rather than validated against ``LIBRARY_VISIBILITY_VALUES`` at runtime so FastAPI rejects an unknown value with a 422 naming the allowed ones, before any handler code or row lock. The two are pinned to each other by ``LIBRARY_VISIBILITY_LITERAL_VALUES`` below, so a future third visibility cannot be added to the model without this contract noticing. ``force`` only ever matters when flipping a UOB/DOB row TO ``public`` — the one direction that can expose a tenant's private own-brand record to every other tenant's browse surfaces. It is deliberately not a query parameter: an override that widens who can see a customer's data should have to be written into a request body, not appended to a URL that ends up in a log or a browser history entry. BrandLibraryVisibilityResult: properties: advertiser_id: type: string format: uuid title: Advertiser Id library_visibility: type: string title: Library Visibility changed: type: boolean title: Changed forced: type: boolean title: Forced default: false type: object required: - advertiser_id - library_visibility - changed title: BrandLibraryVisibilityResult description: >- What the visibility flip actually left on the row. Returns the stored value rather than echoing the request so the client applies what the server committed — including on the no-op path, where the row was already at the requested visibility and nothing was written. BrandLibraryConflictResponse: properties: detail: type: string title: Detail type: object required: - detail title: BrandLibraryConflictResponse description: A server-side refusal to change a Brand Library advertiser. HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type input: title: Input ctx: type: object title: Context type: object required: - loc - msg - type title: ValidationError securitySchemes: HTTPBearer: type: http scheme: bearer ````