---
title: "Set a tool's approval policy"
method: PATCH
path: "/tool_policies"
tags: ["Approvals"]
---

# Set a tool's approval policy

`PATCH /tool_policies`

## Request

- Base URL: `https://api.crevio.co/v1`
- URL: `https://api.crevio.co/v1/tool_policies`
- Auth: API key in header `Authorization`

Sets the approval policy for one tool, addressed by its role (e.g. `crevioApi.createProduct`, `pdGmail.sendEmail`): `off` refuses it, `always_ask` freezes each call as an approval, `always_allow` runs it. Covers Crevio API endpoints, platform tools, connected apps and MCP servers. A choice is kept even when it equals the default. A tool that moves money or changes access (`x-crevio-locked` on a Crevio API operation, this endpoint included) is never set to `always_allow`: the call answers 422 `policy_locked`.

## Request body

- object
  - `role` string, required: The tool's role, as the agent calls it (namespace.function).
  - `policy` 'off' | 'always_ask' | 'always_allow', required

## Response `200`

Success

- object
  - `object` 'tool_policy', required
  - `role` string, required
  - `policy` 'off' | 'always_ask' | 'always_allow', required

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Forbidden
- `404`: Resource not found
- `422`: Validation error
- `429`: Rate limit exceeded — 600 requests per minute per credential. Retry after the number of seconds in `Retry-After`.
- `500`: Internal server error

---

[API](https://skmtc.dev/crevio/apis/crevio-api-v1.md) · [All operations](https://skmtc.dev/crevio/apis/crevio-api-v1/llms.txt) · [OpenAPI document](https://skmtc.dev/crevio/apis/crevio-api-v1/revisions/2219f18ad651?raw)