> ## Documentation Index
> Fetch the complete documentation index at: https://docs.phosra.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Platforms & Enforcement Modes

> How GET /platforms signals honest enforcement capability — and what manual_attested means for your UI

# Platforms & enforcement modes

`GET /api/v1/platforms` returns a list of supported platforms. Each entry carries two new fields — `enforcement_mode` and `rule_support` — that tell you **honestly** what Phosra can do on that platform.

## enforcement\_mode

| Value             | What it means                                                                                    | Correct UI label               |
| ----------------- | ------------------------------------------------------------------------------------------------ | ------------------------------ |
| `dns`             | Phosra makes a live write to a DNS-provider API (NextDNS, CleanBrowsing, Control D)              | **Enforced (DNS)**             |
| `device`          | On-device enforcement via the Phosra app (Apple, Android device-sync)                            | **Enforced (requires app)**    |
| `api_write`       | Phosra calls a live third-party write API on the platform                                        | **Enforced**                   |
| `manual_attested` | No programmatic write API — Phosra emits setup steps and records the parent's signed attestation | **Parent-Configured (Guided)** |
| `coming_soon`     | Adapter not yet built                                                                            | grayed / not actionable        |

<Warning>
  **Never render "Enforced" for a `manual_attested` platform.** Netflix, Disney+, Peacock, Snapchat, gaming consoles, and other stub platforms all carry `manual_attested`. For these, Phosra generates setup steps and records a signed OCSS receipt once the parent attests — but no programmatic API write occurs. The receipt is authentic; the action is human-completed.
</Warning>

## rule\_support

Every platform response includes `rule_support`: a map from each of the **117** closed OCSS v4 rule categories to one of four honest values:

| Value         | Meaning                                                                 |
| ------------- | ----------------------------------------------------------------------- |
| `dns`         | DNS provider can filter this category via its API                       |
| `device`      | On-device enforcement handles this category                             |
| `guided`      | Platform-native category; Phosra guides the parent to apply it manually |
| `unsupported` | This category cannot be addressed on this platform                      |

### Example — Netflix (manual\_attested)

```json theme={null}
{
  "id": "netflix",
  "name": "Netflix",
  "enforcement_mode": "manual_attested",
  "rule_support": {
    "content_rating": "guided",
    "time_daily_limit": "unsupported",
    "web_safesearch": "unsupported",
    "web_category_block": "unsupported",
    "age_gate": "guided",
    "purchase_approval": "guided"
  }
}
```

No rule on Netflix returns `"dns"` or `"device"`. Only `"guided"` (where native parental controls exist) or `"unsupported"`.

### Example — NextDNS (dns)

```json theme={null}
{
  "id": "nextdns",
  "name": "NextDNS",
  "enforcement_mode": "dns",
  "rule_support": {
    "web_category_block": "dns",
    "web_safesearch": "dns",
    "web_custom_allowlist": "dns",
    "web_custom_blocklist": "dns",
    "web_filter_level": "dns",
    "content_rating": "unsupported",
    "time_daily_limit": "unsupported"
  }
}
```

Only the five web-filtering categories return `"dns"`; all others are `"unsupported"` because a DNS filter cannot enforce content ratings, screen time, or purchase rules.

## UI contract

Render platform enforcement status based on `enforcement_mode`:

```
dns          → "Enforced (DNS)"
device       → "Enforced (requires app)"
api_write    → "Enforced"
manual_attested → "Parent-Configured (Guided)"
coming_soon  → grayed / disabled
```

Render per-rule status within a platform based on `rule_support[category]`:

```
"dns"         → DNS badge
"device"      → device badge
"guided"      → guided / parent-configured badge
"unsupported" → gray out or omit
```

## Why manual\_attested platforms still matter

For `manual_attested` platforms, Phosra:

1. Translates the policy rules into human-readable setup steps
2. Guides the parent through applying them inside the platform's native parental controls
3. Records a **signed OCSS enforcement receipt** once the parent confirms they applied the steps

The `manual_steps[]` array in `EnforcementResult` is populated for these platforms. A non-empty `manual_steps` means the enforcement was guided — the parent is the actor, not the API. The OCSS receipt is authentic and satisfies many regulatory attestation requirements; it is not the same as a programmatic apply.

## Related endpoints

* `GET /api/v1/platforms` — full list with `enforcement_mode` + `rule_support`
* `GET /api/v1/platforms/{platformId}` — single platform
* `GET /api/v1/platforms/by-category?category={dns|streaming|gaming|device|browser}` — filter by type
* `GET /api/v1/platforms/by-capability?capability={web_filtering|content_rating|...}` — filter by capability