--- title: "UpdateAuthorizationPolicy" method: PATCH path: "/v1/namespaces/{object.tenant_meta.namespace}/authorization-policies" tags: ["AuthorizationPolicyService"] --- # UpdateAuthorizationPolicy `PATCH /v1/namespaces/{object.tenant_meta.namespace}/authorization-policies` Updates the authorization policy for a given tenant. ## Path parameters - `object.tenant_meta.namespace` string, required ## Request body - AuthorizationPolicyServiceUpdateAuthorizationPolicyBody — Request to update an authorization policy. - `object` object — Represents an authorization policy in the system. - `meta` V1Meta — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `propagate` boolean — Indicates that the object should be visible in the child namespaces. - `spec` V1AuthorizationPolicySpec - `clause` string[], required — The list of claims that must match. This is essentially an AND operator. User claims must match all the criteria in the clause for the policy to match. For example, ["group=X", "email=user@endor.ai"] will match users of group X with this email. Clause strings must contain only allowed characters to prevent XSS attacks and ensure exact matching with incoming JWT claims. Allowed characters: letters, numbers, and the following: =@._-/: +()& (space, plus, parentheses, ampersand). - `expiration_time` string, date-time — Disables this policy after its expiration time. If expiration time is not provided, the policy will never expire. - `is_support_policy` boolean — is_support_policy indicates that the policy is a support policy and cannot be altered without using the SupportAccess API. - `permissions` V1Permissions, required — Holds a map associating each resource kind with the set of methods that are allowed for this kind. For example: - `except_resources` string[] — List of resources that should not be accounted in any * resource rules. - `roles` V1SystemRole[] - `rules` object - `propagate` boolean, required — Propagate indicates that the policy should include the children of the target namespace as well as allowed targets. - `target_namespaces` string[], required — The target namespaces of the policy. The policy can apply to one or more target namespaces. The targets can only be the current namespace or its children. - `tenant_meta` object — Authorization policies are associated with a tenant. - `uuid` string — The UUID of the AuthorizationPolicy resource. - `request` V1UpdateRequest — Message used for all update requests. - `force` boolean — Force will force the update of the resource if any checks fail. - `update_mask` string — Fields to update. Defaults to all fields. ## Response `200` A successful response. - V1AuthorizationPolicy — Represents an authorization policy in the system. - `meta` V1Meta, required — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `propagate` boolean — Indicates that the object should be visible in the child namespaces. - `spec` V1AuthorizationPolicySpec, required - `clause` string[], required — The list of claims that must match. This is essentially an AND operator. User claims must match all the criteria in the clause for the policy to match. For example, ["group=X", "email=user@endor.ai"] will match users of group X with this email. Clause strings must contain only allowed characters to prevent XSS attacks and ensure exact matching with incoming JWT claims. Allowed characters: letters, numbers, and the following: =@._-/: +()& (space, plus, parentheses, ampersand). - `expiration_time` string, date-time — Disables this policy after its expiration time. If expiration time is not provided, the policy will never expire. - `is_support_policy` boolean — is_support_policy indicates that the policy is a support policy and cannot be altered without using the SupportAccess API. - `permissions` V1Permissions, required — Holds a map associating each resource kind with the set of methods that are allowed for this kind. For example: - `except_resources` string[] — List of resources that should not be accounted in any * resource rules. - `roles` V1SystemRole[] - `rules` object - `propagate` boolean, required — Propagate indicates that the policy should include the children of the target namespace as well as allowed targets. - `target_namespaces` string[], required — The target namespaces of the policy. The policy can apply to one or more target namespaces. The targets can only be the current namespace or its children. - `tenant_meta` V1TenantMeta, required — Tenant related data for the tenant containing the resource. - `namespace` string, required — Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string — The UUID of the AuthorizationPolicy resource. ## Other responses - `default` — An unexpected error response. --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) · [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/endorlabs/endor-labs-rest-api-reference/revisions/2fe1f84213b3/schema)