---
title: "Set per-user spend policy override"
method: PUT
path: "/v1/platform/connections/{connectionId}/spend-policy"
tags: ["Platform"]
---

# Set per-user spend policy override

`PUT /v1/platform/connections/{connectionId}/spend-policy`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/platform/connections/{connectionId}/spend-policy`
- Auth: HTTP bearer

Replace the per-user spend policy for a connected user (deactivates the
previous active row, then inserts). Requires plt_ platform auth.
Optional `Idempotency-Key` header must cover the full request body — reusing
the same key with different parameters returns 409.

## Path parameters

- `connectionId` string, uuid, required

## Headers

- `Idempotency-Key` string

## Request body

- CreateSpendPolicyRequest
  - `user_id` string, uuid: Scope to a specific user (app-level policies only)
  - `to_allowlist` string[]: Permitted destination addresses (empty = unrestricted)
  - `to_denylist` string[]: Blocked destination addresses
  - `max_value_per_tx_eth` string: Maximum value per transaction in ETH (decimal string)
  - `daily_limit_eth` string: Rolling 24h spend cap in ETH (decimal string)
  - `allowed_chains` string[]: Chains the user may transact on (empty = all enabled)
  - `allowed_tokens` string[]: Permitted ERC-20 token contract addresses
  - `max_transactions_per_day` integer: Maximum number of transactions per 24h window
  - `inference_allowance_usd` string: Monthly LLM inference allowance in USD (decimal string)
  - `inference_reserved_pct` integer: Percent of allowance held in reserve (not spendable)
  - `inference_hard_stop` boolean: When true, block inference when allowance is exhausted
  - `inference_allowance_mode` 'policy' | 'credits'
  - `max_request_cost_usd` string: Maximum estimated cost per LLM request in USD
  - `human_factor_auth` object: Human factor auth requirements for send/swap/export. Fields: send, swap, export (password_or_passkey | passkey_only | passkey_required | password_only | reauth_token_only), conditional.require_passkey_above_usd, conditional.require_passkey_for_new_recipient.

## Response `200`

Spend policy set (or idempotent replay)

- SpendPolicyResponse
  - `id` string, uuid, required
  - `org_id` string, uuid, required
  - `platform_app_id` string, uuid, nullable
  - `user_id` string, uuid, nullable
  - `to_allowlist` string[]
  - `to_denylist` string[]
  - `max_value_per_tx_eth` string, nullable
  - `daily_limit_eth` string, nullable
  - `allowed_chains` string[]
  - `allowed_tokens` string[]
  - `max_transactions_per_day` integer, nullable
  - `inference_allowance_usd` string, nullable
  - `inference_reserved_pct` integer, nullable
  - `inference_hard_stop` boolean, nullable
  - `inference_allowance_mode` string, nullable
  - `max_request_cost_usd` string, nullable
  - `human_factor_auth` object, nullable
  - `is_active` boolean, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `201`: Spend policy created
- `400`: Invalid request
- `403`: Insufficient permissions
- `404`: Resource not found
- `409`: Idempotency-Key reused with different body

## Changes

- **2026-10-20** `5fa0918f3b41`: 4 breaking, 6 info
  - the response property `platform_app_id` became nullable for the status `200`
  - the response property `platform_app_id` became nullable for the status `201`
  - the response property `platform_app_id` became optional for the status `200`
  - the response property `platform_app_id` became optional for the status `201`
  - …6 more

[Operation history](https://skmtc.dev/1claw/apis/1claw-api/changes/v1/platform/connections/:connectionId/spend-policy/put.md)

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)