API returns "not-required" for medical certificate despite policy setting

We have configured Personio to require a medical certificate for sick leave exceeding 3 days. However, we have noticed that this restriction does not seem to be enforced via the API.

As a test, we submitted a sick leave request for 11 days without providing a medical certificate. In the API response, the following status was returned:

"certificate": {
  "status": "not-required"
}

This contradicts our expectations, as we would have assumed the status to be "required". Could you clarify whether this is a bug or if there are additional configuration settings that influence this behavior?