> ## Documentation Index > Fetch the complete documentation index at: https://docs.igrisecurity.com/llms.txt > Use this file to discover all available pages before exploring further. # Update a policy > Updates a policy. Send only the fields you want to change. The response is the stored row, with `updatedByUserId` instead of `lastEditedBy`. **Required permission:** `policies:write` ## OpenAPI ````yaml /api-reference/openapi.yaml patch /api/v1/policies/{id} openapi: 3.1.0 info: title: Igris Management API version: '1' description: >- REST API for managing Igris connections, policies, sessions, audit events and alerts. servers: - url: https://api.igrisecurity.com security: - bearerAuth: [] tags: - name: Connections - name: Policies - name: Sessions - name: Audit Events - name: Incidents - name: Webhooks - name: API Keys - name: Members - name: LLM Providers - name: LLM Cost - name: Observe paths: /api/v1/policies/{id}: patch: tags: - Policies summary: Update a policy description: > Updates a policy. Send only the fields you want to change. The response is the stored row, with `updatedByUserId` instead of `lastEditedBy`. **Required permission:** `policies:write` operationId: updatePolicy parameters: - $ref: '#/components/parameters/Id' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/PolicyUpdate' example: enabled: false responses: '200': description: The stored policy. content: application/json: schema: type: object properties: data: $ref: '#/components/schemas/PolicyRow' example: data: id: 7b1d4c2e-0000-4000-8000-000000000002 name: Block delete tools enabled: false updatedByUserId: usr_456 updatedAt: '2026-01-02T00:00:00Z' '401': $ref: '#/components/responses/Unauthorized' '403': description: >- Missing permission, or a plan limit (`maxRulesPerPolicy`, or a detector your plan does not include). content: application/json: schema: oneOf: - $ref: '#/components/schemas/ForbiddenError' - $ref: '#/components/schemas/PlanError' '404': $ref: '#/components/responses/NotFound' '422': description: Validation failed, as for create. content: application/json: schema: oneOf: - $ref: '#/components/schemas/Error' - $ref: '#/components/schemas/ZodValidationError' components: parameters: Id: name: id in: path required: true schema: type: string format: uuid schemas: PolicyUpdate: type: object description: All fields are optional. Sending `rules` replaces the whole list. properties: name: type: string minLength: 1 maxLength: 200 description: type: - string - 'null' maxLength: 500 rules: type: array items: $ref: '#/components/schemas/PolicyRule' enabled: type: boolean connectionSlugs: type: - array - 'null' items: type: string minLength: 1 serverId: type: string minLength: 1 PolicyRow: type: object description: >- The stored policy row, as returned by `POST` and `PATCH`. It has `createdByUserId` and `updatedByUserId` instead of `owner` and `lastEditedBy`. properties: id: type: string format: uuid organizationId: type: string serverId: type: - string - 'null' connectionSlugs: type: - array - 'null' items: type: string name: type: string description: type: - string - 'null' rules: type: array items: $ref: '#/components/schemas/PolicyRule' enabled: type: boolean createdByUserId: type: - string - 'null' updatedByUserId: type: - string - 'null' createdAt: type: string format: date-time updatedAt: type: string format: date-time ForbiddenError: type: object properties: error: type: string example: Forbidden required: type: string description: The permission the caller lacks. example: policies:write PlanError: type: object description: Plan limit or plan feature errors. See Limits and errors. properties: error: type: string example: PLAN_LIMIT_REACHED code: type: string example: PLAN_LIMIT_REACHED feature: type: string detector: type: string description: The detector your plan does not include. limit: type: string current: type: integer max: type: integer plan: type: string currentPlan: type: string upgradeTo: type: string Error: type: object required: - error properties: error: type: string ZodValidationError: type: object properties: success: type: boolean const: false error: type: object properties: name: type: string example: ZodError message: type: string description: JSON string of the validation issues. PolicyRule: type: object required: - target - action properties: target: $ref: '#/components/schemas/PolicyRuleTarget' action: type: string enum: - allow - deny - alert - redact conditions: type: object description: > When the rule applies. Keys can only be `user` or `metadata.`; any other key returns `422`. A value is a string (exact match) or one of `{ eq }`, `{ neq }`, `{ in: [...] }`, `{ nin: [...] }`. additionalProperties: oneOf: - type: string - type: object properties: eq: type: string - type: object properties: neq: type: string - type: object properties: in: type: array items: type: string - type: object properties: nin: type: array items: type: string example: user: alice@company.com metadata.env: in: - prod - staging limit: type: object description: >- Rate limit. Applies to LLM rules only; on an `mcp_tool` rule it returns `422`. required: - per properties: requests: type: number exclusiveMinimum: 0 tokens: type: number exclusiveMinimum: 0 dollars: type: number exclusiveMinimum: 0 per: type: string enum: - minute - hour - day tokenGuard: type: object properties: maxInputTokens: type: number exclusiveMinimum: 0 maxOutputTokens: type: number exclusiveMinimum: 0 maxRequestMaxTokens: type: number exclusiveMinimum: 0 contentGuard: type: object description: Content detectors to run. See [Guards](/govern/guards). required: - detectors - action properties: detectors: type: array minItems: 1 maxItems: 50 items: type: string minLength: 1 maxLength: 80 action: type: string enum: - deny - redact - alert inspectResponse: type: boolean logContent: type: boolean PolicyRuleTarget: description: What the rule matches. oneOf: - type: object title: MCP tool required: - kind - tool properties: kind: type: string const: mcp_tool tool: type: string minLength: 1 description: Tool name. `*` wildcards are allowed. example: delete_* - type: object title: LLM model required: - kind - model properties: kind: type: string const: llm_model model: type: string minLength: 1 example: gpt-4o* - type: object title: LLM endpoint required: - kind - endpoint properties: kind: type: string const: llm_endpoint endpoint: type: string enum: - chat.completions - embeddings - images.generate - audio.transcriptions - audio.speech - passthrough responses: Unauthorized: description: No valid session or API key, or the key's creator is no longer a member. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Unauthorized NotFound: description: Not found. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Not found securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: ig_... description: >- An Igris API key. It acts with the current role and permission overrides of the member who created it. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.