--- title: "Update a policy" method: PUT path: "/v1/vaults/{vault_id}/policies/{policy_id}" tags: ["Policies"] --- # Update a policy `PUT /v1/vaults/{vault_id}/policies/{policy_id}` ## Request - Base URL: `https://api.1claw.co` - URL: `https://api.1claw.co/v1/vaults/{vault_id}/policies/{policy_id}` - Auth: HTTP bearer ## Path parameters - `vault_id` string, uuid, required - `policy_id` string, uuid, required ## Request body - UpdatePolicyRequest - `permissions` string[] - `conditions` object - `expires_at` string, date-time - `effect` 'allow' | 'deny' - `priority` integer - `attribute_conditions` object - `consensus_trigger` ConsensusTrigger - `conditions` ConsensusCondition[], required - union - object - `type` 'value_above', required - `threshold_wei` string: Value threshold in wei (arbitrary-precision string). Preferred over threshold_gwei. - `threshold_gwei` integer: Deprecated — use threshold_wei for arbitrary precision - object - `type` 'chain_in', required - `chains` string[], required - object - `type` 'to_address_in', required - `addresses` string[], required - object - `type` 'function_selector_in', required - `selectors` string[], required - object - `type` 'erc20_amount_above', required - `threshold_raw` string, required - object - `type` 'intent_type_in', required - `intent_types` string[], required - object - `type` 'always', required - object - `type` 'action_in', required - `actions` string[], required: Control-plane actions to match, e.g. policy.create, policy.update, policy.delete, signing_key.export, member.role_change, member.remove - object - `type` 'action_kind_in', required - `action_kinds` string[], required: Version-agnostic action kind groups, e.g. signing_key.*, policy.*, member.* - `approval` ApprovalRequirement, required - `min_approvals` integer, required - `required_roles` string[] - `per_role_minimums` object - `require_credential_types` string[]: At least one approval must use one of these credential types - `expiry_secs` integer - `self_approval_allowed` boolean - `skip_when` FlatConditionSet[]: When ALL conditions in ANY entry match, consensus is bypassed. Useful for exempting known-safe recipients or low-value transfers. - `value_above` string: Native value threshold in gwei (numeric string) - `chain_in` string[] - `to_address_in` string[] - `function_selector_in` string[] - `erc20_amount_above` string: ERC-20 raw token amount threshold (numeric string) - `intent_type_in` string[] - `always` boolean: When true, this entry always matches regardless of other fields - `action_in` string[]: Control-plane actions to match (e.g. policy.create, signing_key.export) - `action_kind_in` string[]: Version-agnostic action kind groups (e.g. signing_key.*, policy.*, member.*) - `require_when` FlatConditionSet[]: Consensus is ONLY required when at least one entry matches. If set and none match, consensus is skipped entirely. - `value_above` string: Native value threshold in gwei (numeric string) - `chain_in` string[] - `to_address_in` string[] - `function_selector_in` string[] - `erc20_amount_above` string: ERC-20 raw token amount threshold (numeric string) - `intent_type_in` string[] - `always` boolean: When true, this entry always matches regardless of other fields - `action_in` string[]: Control-plane actions to match (e.g. policy.create, signing_key.export) - `action_kind_in` string[]: Version-agnostic action kind groups (e.g. signing_key.*, policy.*, member.*) - `deep_inspect` boolean: When true, also evaluate conditions against inner calls extracted from wrapper transactions (multicall, Safe execTransaction, ERC-4337 handleOps). - `tx_conditions` TxConditions: Signing-time conditions on access policies (all tiers). Ignored on secret reads. Evaluated when a TransactionContext is present. Fields are combined according to `match_mode` (default AND). - `match_mode` 'all' | 'any': How individual condition fields are combined. "all" (default): every present field must match (AND). "any": at least one present field must match (OR). - `function_name_in` string[] - `function_selector_in` string[] - `erc20_amount_above` string - `value_above` string: Native value threshold in wei (arbitrary-precision string) - `eip712_primary_type_in` string[]: Match EIP-712 typed_data primaryType (case-sensitive) - `eip712_verifying_contract_in` string[]: Match EIP-712 domain.verifyingContract (case-insensitive) - `eip712_domain_name_in` string[]: Match EIP-712 domain.name - `eip712_domain_chain_id_in` integer[]: Match EIP-712 domain.chainId - `eip7702_authorized_addresses_in` string[]: Match EIP-7702 authorization_list delegate addresses (case-insensitive) - `to_address_in` string[] - `chain_in` string[] - `intent_type_in` string[] - `decode_failed` boolean - `program_id_in` string[] - `deep_inspect` boolean: When true, conditions are also evaluated against inner calls extracted from wrapper transactions (multicall, Safe execTransaction, ERC-4337 handleOps). A match on any inner call counts as an overall match. - `expression` string: Mini expression DSL for policy conditions (schema version 2+). References transaction context fields (chain, value_wei, to_address, function_selector, etc.) with boolean operators. Fail-closed on parse or evaluation errors. Example: `chain == 'ethereum' && value_wei > 1000000000000000000` - `approval_id` string, uuid: Optional completed approval ID for control-plane consensus bypass. ## Response `200` Policy updated - PolicyResponse - `id` string, uuid, required - `vault_id` string, uuid, required - `secret_path_pattern` string, required - `principal_type` string, required - `principal_id` string, required - `permissions` string[], required - `conditions` object - `expires_at` string, date-time - `created_by` string - `created_by_type` string - `created_at` string, date-time, required - `effect` 'allow' | 'deny' - `priority` integer - `attribute_conditions` object - `consensus_trigger` ConsensusTrigger - `conditions` ConsensusCondition[], required - union - object - `type` 'value_above', required - `threshold_wei` string: Value threshold in wei (arbitrary-precision string). Preferred over threshold_gwei. - `threshold_gwei` integer: Deprecated — use threshold_wei for arbitrary precision - object - `type` 'chain_in', required - `chains` string[], required - object - `type` 'to_address_in', required - `addresses` string[], required - object - `type` 'function_selector_in', required - `selectors` string[], required - object - `type` 'erc20_amount_above', required - `threshold_raw` string, required - object - `type` 'intent_type_in', required - `intent_types` string[], required - object - `type` 'always', required - object - `type` 'action_in', required - `actions` string[], required: Control-plane actions to match, e.g. policy.create, policy.update, policy.delete, signing_key.export, member.role_change, member.remove - object - `type` 'action_kind_in', required - `action_kinds` string[], required: Version-agnostic action kind groups, e.g. signing_key.*, policy.*, member.* - `approval` ApprovalRequirement, required - `min_approvals` integer, required - `required_roles` string[] - `per_role_minimums` object - `require_credential_types` string[]: At least one approval must use one of these credential types - `expiry_secs` integer - `self_approval_allowed` boolean - `skip_when` FlatConditionSet[]: When ALL conditions in ANY entry match, consensus is bypassed. Useful for exempting known-safe recipients or low-value transfers. - `value_above` string: Native value threshold in gwei (numeric string) - `chain_in` string[] - `to_address_in` string[] - `function_selector_in` string[] - `erc20_amount_above` string: ERC-20 raw token amount threshold (numeric string) - `intent_type_in` string[] - `always` boolean: When true, this entry always matches regardless of other fields - `action_in` string[]: Control-plane actions to match (e.g. policy.create, signing_key.export) - `action_kind_in` string[]: Version-agnostic action kind groups (e.g. signing_key.*, policy.*, member.*) - `require_when` FlatConditionSet[]: Consensus is ONLY required when at least one entry matches. If set and none match, consensus is skipped entirely. - `value_above` string: Native value threshold in gwei (numeric string) - `chain_in` string[] - `to_address_in` string[] - `function_selector_in` string[] - `erc20_amount_above` string: ERC-20 raw token amount threshold (numeric string) - `intent_type_in` string[] - `always` boolean: When true, this entry always matches regardless of other fields - `action_in` string[]: Control-plane actions to match (e.g. policy.create, signing_key.export) - `action_kind_in` string[]: Version-agnostic action kind groups (e.g. signing_key.*, policy.*, member.*) - `deep_inspect` boolean: When true, also evaluate conditions against inner calls extracted from wrapper transactions (multicall, Safe execTransaction, ERC-4337 handleOps). - `tx_conditions` TxConditions: Signing-time conditions on access policies (all tiers). Ignored on secret reads. Evaluated when a TransactionContext is present. Fields are combined according to `match_mode` (default AND). - `match_mode` 'all' | 'any': How individual condition fields are combined. "all" (default): every present field must match (AND). "any": at least one present field must match (OR). - `function_name_in` string[] - `function_selector_in` string[] - `erc20_amount_above` string - `value_above` string: Native value threshold in wei (arbitrary-precision string) - `eip712_primary_type_in` string[]: Match EIP-712 typed_data primaryType (case-sensitive) - `eip712_verifying_contract_in` string[]: Match EIP-712 domain.verifyingContract (case-insensitive) - `eip712_domain_name_in` string[]: Match EIP-712 domain.name - `eip712_domain_chain_id_in` integer[]: Match EIP-712 domain.chainId - `eip7702_authorized_addresses_in` string[]: Match EIP-7702 authorization_list delegate addresses (case-insensitive) - `to_address_in` string[] - `chain_in` string[] - `intent_type_in` string[] - `decode_failed` boolean - `program_id_in` string[] - `deep_inspect` boolean: When true, conditions are also evaluated against inner calls extracted from wrapper transactions (multicall, Safe execTransaction, ERC-4337 handleOps). A match on any inner call counts as an overall match. - `expression` string: Mini expression DSL for policy conditions (schema version 2+). References transaction context fields (chain, value_wei, to_address, function_selector, etc.) with boolean operators. Fail-closed on parse or evaluation errors. Example: `chain == 'ethereum' && value_wei > 1000000000000000000` - `policy_schema_version` integer: Policy schema version (1 = legacy, 2 = expression engine) ## Other responses - `404`: Resource not found --- [API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)