---
title: "Update an execution policy"
method: PUT
path: "/api/v2/actions/execution-policies/{policy_id}"
tags: ["Execution Policy"]
---

# Update an execution policy

`PUT /api/v2/actions/execution-policies/{policy_id}`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/actions/execution-policies/{policy_id}`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token`
- TypeScript: <https://skmtc.dev/datadog/apis/datadog-api-v2-collection/docs/api/v2/actions/execution-policies/:policy_id/put.ts> (a function with typed inputs; its response is checked against the schema)

Update an existing execution policy.
Returns the execution policy object when the request is successful.

## Path parameters

- `policy_id` string, required

## Request body

- ExecutionPolicyUpdateRequest: Request object that includes the execution policy to update.
  - `data` ExecutionPolicyUpdateRequestData, required: Object for a single execution policy.
    - `attributes` ExecutionPolicyWriteAttributes, required: Attributes used to create or update an execution policy.
      - `action_pattern` ExecutionPolicyActionPattern, required: The set of actions this policy applies to.
        - `action_fqns` string[], required: The fully qualified action names this policy matches. Use `*` to match all actions of the integration, or a fully qualified name prefixed with the integration's action namespace (for example `com.datadoghq.script.*` for the Script integration).
        - `integration` 'INTEGRATION_KUBERNETES' | 'INTEGRATION_SCRIPT' | 'INTEGRATION_REMOTE_ACTION' | 'INTEGRATION_SLACK', required: The integration the action pattern applies to.
      - `effect` 'allow' | 'deny', required: Whether the policy allows or denies matching actions.
      - `name` string, required: The name of the execution policy.
      - `scope` ExecutionPolicyScope: Restricts where the policy applies. At most one scope type can be set, and it must match the action pattern's integration. An empty object means the policy has no scope restriction.
        - `kubernetes` ExecutionPolicyKubernetesScope: Restricts the policy to specific Kubernetes namespaces.
          - `rules` ExecutionPolicyKubernetesScopeRule[], required: The Kubernetes scope rules.
            - `target_namespaces` string[], required: The Kubernetes namespaces this rule applies to.
        - `remote_action_rshell` ExecutionPolicyRemoteActionRshellScope: Restricts the policy to specific remote shell paths.
          - `rules` ExecutionPolicyRemoteActionRshellScopeRule[], required: The remote shell scope rules.
            - `access` 'read_only' | 'read_write', required: The level of remote shell access granted for the target paths.
            - `target_paths` string[], required: The file system paths this rule applies to.
        - `scripts` ExecutionPolicyScriptScope: Restricts the policy to specific scripts.
          - `rules` ExecutionPolicyScriptScopeRule[], required: The script scope rules.
            - `target_script_names` string[], required: The script names this rule applies to.
        - `slack` ExecutionPolicySlackScope: Restricts the policy to specific Slack private channel names.
          - `rules` ExecutionPolicySlackScopeRule[], required: The Slack scope rules.
            - `channel_name_selectors` string[], required: The private channel name selectors this rule applies to. Selectors are lowercase private channel names without the leading `#`, and can contain `*` wildcards. Use `*` alone to match any private channel name.
      - `targets` ExecutionPolicyTarget[]: The targets this policy applies to.
        - `agent_tags` string[], required: The tags identifying the target.
        - `name` string, nullable: A human-readable name for the target.
    - `id` string, required: The ID of the execution policy.
    - `type` 'execution_policy', required: The type of the resource. The value should always be `execution_policy`.

## Response `200`

OK

- ExecutionPolicyResponse: Response object that includes a single execution policy.
  - `data` ExecutionPolicyResponseData, required: Object for a single execution policy.
    - `attributes` ExecutionPolicyAttributes, required: An execution policy.
      - `action_pattern` ExecutionPolicyActionPattern, required: The set of actions this policy applies to.
        - `action_fqns` string[], required: The fully qualified action names this policy matches. Use `*` to match all actions of the integration, or a fully qualified name prefixed with the integration's action namespace (for example `com.datadoghq.script.*` for the Script integration).
        - `integration` 'INTEGRATION_KUBERNETES' | 'INTEGRATION_SCRIPT' | 'INTEGRATION_REMOTE_ACTION' | 'INTEGRATION_SLACK', required: The integration the action pattern applies to.
      - `created_at` string, date-time, required: The date and time the execution policy was created.
      - `created_by` string, required: The ID of the user who created the execution policy.
      - `effect` 'allow' | 'deny', required: Whether the policy allows or denies matching actions.
      - `name` string, required: The name of the execution policy.
      - `scope` ExecutionPolicyScope: Restricts where the policy applies. At most one scope type can be set, and it must match the action pattern's integration. An empty object means the policy has no scope restriction.
        - `kubernetes` ExecutionPolicyKubernetesScope: Restricts the policy to specific Kubernetes namespaces.
          - `rules` ExecutionPolicyKubernetesScopeRule[], required: The Kubernetes scope rules.
            - `target_namespaces` string[], required: The Kubernetes namespaces this rule applies to.
        - `remote_action_rshell` ExecutionPolicyRemoteActionRshellScope: Restricts the policy to specific remote shell paths.
          - `rules` ExecutionPolicyRemoteActionRshellScopeRule[], required: The remote shell scope rules.
            - `access` 'read_only' | 'read_write', required: The level of remote shell access granted for the target paths.
            - `target_paths` string[], required: The file system paths this rule applies to.
        - `scripts` ExecutionPolicyScriptScope: Restricts the policy to specific scripts.
          - `rules` ExecutionPolicyScriptScopeRule[], required: The script scope rules.
            - `target_script_names` string[], required: The script names this rule applies to.
        - `slack` ExecutionPolicySlackScope: Restricts the policy to specific Slack private channel names.
          - `rules` ExecutionPolicySlackScopeRule[], required: The Slack scope rules.
            - `channel_name_selectors` string[], required: The private channel name selectors this rule applies to. Selectors are lowercase private channel names without the leading `#`, and can contain `*` wildcards. Use `*` alone to match any private channel name.
      - `targets` ExecutionPolicyTarget[], required: The targets this policy applies to.
        - `agent_tags` string[], required: The tags identifying the target.
        - `name` string, nullable: A human-readable name for the target.
      - `updated_at` string, date-time, required: The date and time the execution policy was last updated.
      - `updated_by` string, required: The ID of the user who last updated the execution policy.
      - `version` integer, required: The version of the execution policy. Incremented on every update.
    - `id` string, required: The ID of the execution policy.
    - `type` 'execution_policy', required: The type of the resource. The value should always be `execution_policy`.

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `404`: Not Found
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/3f70db624329?raw)