---
title: "Update the token policy"
method: PUT
path: "/api/admin/tokens/policy"
tags: ["Token (Admin)"]
---

# Update the token policy

`PUT /api/admin/tokens/policy`

Merge-updates the token policy. Only the fields provided in the request body
are updated; unspecified fields retain their current values. Requires admin
(sudo) privileges. Changes take effect immediately for new token operations.

## Headers

- `X-EDH-USER` string, required
- `X-EDH-TOKEN` string, required

## Request body

- object
  - `max_tokens_per_user` integer — Maximum number of active tokens per user
  - `max_lifetime_hours` integer — Maximum token lifetime in hours (up to 1 year)
  - `default_lifetime_hours` integer — Default token lifetime when not specified by user
  - `max_renewals` integer — Maximum number of renewals per token
  - `renewal_allowed` boolean — Whether token renewal is allowed globally
  - `require_expiration` boolean — Whether all tokens must have an expiration
  - `global_deny` object — Paths blocked for all scoped tokens. Keys are path patterns (prefix with /api/, suffix with * for wildcard). Values are arrays of HTTP methods.

## Response `200`

Policy updated successfully (returns merged policy)

- object
  - `success` boolean
  - `message` object
    - `max_tokens_per_user` integer
    - `max_lifetime_hours` integer
    - `default_lifetime_hours` integer
    - `max_renewals` integer
    - `renewal_allowed` boolean
    - `require_expiration` boolean
    - `global_deny` object

## Other responses

- `400` — Validation error in policy values
- `401` — Not authorized (requires admin privileges)

---

[API](https://skmtc.dev/aws-samples/apis/engineering-development-hub-edh-api.md) · [All operations](https://skmtc.dev/aws-samples/apis/engineering-development-hub-edh-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/aws-samples/engineering-development-hub-edh-api/revisions/058396b8f0f1/schema)