Fields & validation

Library (POST /knowledge-bases)

Document (create / update)

The shared-with-me update endpoint accepts only title and content with the same "update rule" above — status is never accepted there.

Assignment (POST /article-assign)

Exactly one of knowledge_article_id/knowledge_article_ids must resolve to at least one id, and exactly one of assistant_id/assistant_ids must resolve to at least one id — enforced in the controller (422 with a dedicated message), not by the validator rules above.

Sharing (invite / permission / remove)

On invite, at least one of can_view/can_edit must end up true or the request is rejected with 422.

Other endpoints

Constraints the rules cannot express

• A non–super-admin can own at most one library — POST /knowledge-bases checks for an existing owner_user_id match before validating anything else and rejects a second attempt with 422.
• Only a super admin may set audience; it is silently ignored (always assistant) for every other role.
• Only a published document can be assigned to an assistant or synced to search — both are enforced as 422s in the controller, not as validator rules.
• A document's library must have audience: assistant to be assignable to assistants at all — a builder-audience library's documents cannot be attached.
• An assignment requires the assistant and the document to belong to the same organization (reseller_id match) — checked per pair inside the assignment loop.
• status cannot go straight to archived on create (only draft or published); archived is reachable only through a later update.
• The shared-with-me update endpoint never accepts status — recipients can never publish or unpublish a document, no matter their can_edit permission.