Require a Turnstile token on this book's public door

The humanity check, and YOU turn it on. The widget lives on your page and we never see it; all this platform can do is verify the token it produces. IT IS OFF BY DEFAULT AND THAT IS DELIBERATE. Switching it on for everybody at deploy time would break every complaint form that exists, because none of them sends a token yet — and the failure would land on a consumer in the middle of filing a complaint. So it is off until you say your form is ready. ONCE ON, IT FAILS CLOSED. A door that demands the check and a deployment with no Turnstile secret bound answers 503 rather than accepting the complaint unchecked: you asked for protection, and serving a promise nobody is keeping is worse than saying so. A ROTATION CARRIES IT FORWARD. A fresh identifier with the check switched off would open the door at exactly the moment somebody rotated it, which is almost always the moment it was receiving spam. Turning it back off is allowed and easy on purpose: a company whose site key was rotated needs their legal complaint form to keep working while they fix it. Requires complaints:manage, the same capability as rotating, because the consequence is the same class — a form that stops working.

curl -X POST "https://example.com/api/v2/complaint-books/protection" \  -H "Authorization: Bearer apf_v2_tu_credencial" \  -H "Content-Type: application/json" \  -d '{    "requiresTurnstile": true  }'

{  "schemaVersion": "2.0",  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",  "bookId": "710266f4-0087-48f9-97e1-4b13ac48f353",  "createdAt": "2019-08-24T14:15:22Z",  "intakeUrl": "string"}