The four authorable slots. extra="forbid" so an operator can't smuggle unknown keys past validation (mirrors the catalog's threshold configs).
Successful Response
Template errors are a 200 with valid=false — never a 5xx.