Hides one recommendation card for a protected domain, or brings it back. A dismissal means "I have dealt with this", not "never tell me again": the card stays listed under Recommendations.Dismissed in get-protected-domain rather than Open, and the portal forgets the dismissal once the condition behind it resolves, so if the same thing happens again it is raised fresh rather than arriving pre-silenced.

Dismissing is a decision for the whole tenant, not a personal preference - it hides the card for every member who views the domain - which is why this is a write. Pass dismissed: false to restore a card dismissed earlier. Both directions are idempotent set operations, so repeating a call or racing another caller cannot lose a dismissal.

key is the recommendation's own key in get-protected-domain and is validated against the generator's vocabulary - point_rua_at_us, publish_dmarc, rua_lost, single_legged_enforcement, material_failing_source, advance_policy, uplift_stalled, gate_progress, consider_hosted_dns, mtasts_policy_unreachable, publish_tlsrpt, and finding_ for a posture finding - so a typo cannot create a dismissal nothing will ever match. A known key may be dismissed before its card is currently shown; that simply pre-silences it.