--- title: "UpdatePackageFirewallPolicy" method: PATCH path: "/v1/namespaces/{object.tenant_meta.namespace}/package-firewall-policies" tags: ["PackageFirewallPolicyService"] --- # UpdatePackageFirewallPolicy `PATCH /v1/namespaces/{object.tenant_meta.namespace}/package-firewall-policies` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{object.tenant_meta.namespace}/package-firewall-policies` - Auth: none declared Updates the fields of a policy that the field mask names. ## Path parameters - `object.tenant_meta.namespace` string, required ## Request body - PackageFirewallPolicyServiceUpdatePackageFirewallPolicyBody: Request to update a Package Firewall policy. - `object` object: The policy to update. - `meta` V1Meta: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `propagate` boolean: Whether child namespaces see this object in List. - `spec` V1PackageFirewallPolicySpec: Spec mirrors SystemConfig.PackageFirewallConfig field for field, so the two share one wire format. - `cvss_severity_action` 'PACKAGE_FIREWALL_ACTION_UNSPECIFIED' | 'PACKAGE_FIREWALL_ACTION_BLOCK' | 'PACKAGE_FIREWALL_ACTION_WARN' | 'PACKAGE_FIREWALL_ACTION_CURATED': PackageFirewallAction defines how the package firewall responds when a check is triggered. Used in both configuration (what to do) and audit logs (what was done). - PACKAGE_FIREWALL_ACTION_BLOCK: Block the request and return HTTP 403. - PACKAGE_FIREWALL_ACTION_WARN: Log a warning audit event and allow the request to proceed. - PACKAGE_FIREWALL_ACTION_CURATED: One or more versions were removed from the package metadata response as part of package curation. The package manager resolves to the best remaining safe version without seeing the curated-out versions. - `cvss_severity_threshold` 'CVSS_SEVERITY_LEVEL_UNSPECIFIED' | 'CVSS_SEVERITY_LEVEL_NONE' | 'CVSS_SEVERITY_LEVEL_LOW' | 'CVSS_SEVERITY_LEVEL_MEDIUM' | 'CVSS_SEVERITY_LEVEL_HIGH' | 'CVSS_SEVERITY_LEVEL_CRITICAL': Common severity level enum used across different CVSS versions. - `ecosystem_package_manager_uuid` object: UUID of the PackageManager that serves an ecosystem, keyed by Ecosystem enum name such as "ECOSYSTEM_NPM". An ecosystem absent from the map keeps its public registry. - `exceptions` PackageFirewallPolicyExceptionRule[]: Exception rules. If any exception matches the request, all checks are skipped. - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE', required: - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `exact_versions` string[]: Exact version strings to except. - `package_name` string, required: Name of the excepted package, without version or ecosystem prefix (e.g. "lodash"). - `version_ranges` PackageFirewallPolicyExceptionVersionRange[]: Version ranges to except. With no exact_versions either, all versions are excepted. - `end` string: Exclusive upper bound (e.g. "2.0.0"). Omit to match to the end. - `start` string: Inclusive lower bound (e.g. "1.0.0"). Omit to match from the beginning. - `fail_closed` boolean: Whether to fail closed when a firewall decision cannot be reached. - `malware_action` 'PACKAGE_FIREWALL_ACTION_UNSPECIFIED' | 'PACKAGE_FIREWALL_ACTION_BLOCK' | 'PACKAGE_FIREWALL_ACTION_WARN' | 'PACKAGE_FIREWALL_ACTION_CURATED': PackageFirewallAction defines how the package firewall responds when a check is triggered. Used in both configuration (what to do) and audit logs (what was done). - PACKAGE_FIREWALL_ACTION_BLOCK: Block the request and return HTTP 403. - PACKAGE_FIREWALL_ACTION_WARN: Log a warning audit event and allow the request to proceed. - PACKAGE_FIREWALL_ACTION_CURATED: One or more versions were removed from the package metadata response as part of package curation. The package manager resolves to the best remaining safe version without seeing the curated-out versions. - `min_age_action` 'PACKAGE_FIREWALL_ACTION_UNSPECIFIED' | 'PACKAGE_FIREWALL_ACTION_BLOCK' | 'PACKAGE_FIREWALL_ACTION_WARN' | 'PACKAGE_FIREWALL_ACTION_CURATED': PackageFirewallAction defines how the package firewall responds when a check is triggered. Used in both configuration (what to do) and audit logs (what was done). - PACKAGE_FIREWALL_ACTION_BLOCK: Block the request and return HTTP 403. - PACKAGE_FIREWALL_ACTION_WARN: Log a warning audit event and allow the request to proceed. - PACKAGE_FIREWALL_ACTION_CURATED: One or more versions were removed from the package metadata response as part of package curation. The package manager resolves to the best remaining safe version without seeing the curated-out versions. - `min_age_hours` integer: Minimum age in hours for a package to be allowed (0 = disabled). - `notification_rules` PackageFirewallPolicyNotificationRule[]: Rules that send a Slack message to notification targets when the firewall blocks or warns. - `name` string: Display name of the rule. - `notification_target_uuids` string[]: UUIDs of the notification targets to send to. - `on_actions` V1PackageFirewallAction[]: Firewall actions that trigger this rule. Empty matches all actions. - `reasons` V1PackageFirewallReason[]: Firewall reasons that trigger this rule. Empty matches all reasons. - `restricted_license_action` 'PACKAGE_FIREWALL_ACTION_UNSPECIFIED' | 'PACKAGE_FIREWALL_ACTION_BLOCK' | 'PACKAGE_FIREWALL_ACTION_WARN' | 'PACKAGE_FIREWALL_ACTION_CURATED': PackageFirewallAction defines how the package firewall responds when a check is triggered. Used in both configuration (what to do) and audit logs (what was done). - PACKAGE_FIREWALL_ACTION_BLOCK: Block the request and return HTTP 403. - PACKAGE_FIREWALL_ACTION_WARN: Log a warning audit event and allow the request to proceed. - PACKAGE_FIREWALL_ACTION_CURATED: One or more versions were removed from the package metadata response as part of package curation. The package manager resolves to the best remaining safe version without seeing the curated-out versions. - `restricted_licenses` string[]: Restricted SPDX license identifiers, subject to restricted_license_action. - `tenant_meta` object: Namespace that owns the policy. One policy per namespace. - `uuid` string: UUID of the policy. - `request` V1UpdateRequest: Message used for all update requests. - `force` boolean: Force will force the update of the resource if any checks fail. - `update_mask` string: Fields to update. Defaults to all fields. ## Response `200` A successful response. - V1PackageFirewallPolicy: PackageFirewallPolicy is the Package Firewall policy of one namespace. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `propagate` boolean: Whether child namespaces see this object in List. - `spec` V1PackageFirewallPolicySpec, required: Spec mirrors SystemConfig.PackageFirewallConfig field for field, so the two share one wire format. - `cvss_severity_action` 'PACKAGE_FIREWALL_ACTION_UNSPECIFIED' | 'PACKAGE_FIREWALL_ACTION_BLOCK' | 'PACKAGE_FIREWALL_ACTION_WARN' | 'PACKAGE_FIREWALL_ACTION_CURATED': PackageFirewallAction defines how the package firewall responds when a check is triggered. Used in both configuration (what to do) and audit logs (what was done). - PACKAGE_FIREWALL_ACTION_BLOCK: Block the request and return HTTP 403. - PACKAGE_FIREWALL_ACTION_WARN: Log a warning audit event and allow the request to proceed. - PACKAGE_FIREWALL_ACTION_CURATED: One or more versions were removed from the package metadata response as part of package curation. The package manager resolves to the best remaining safe version without seeing the curated-out versions. - `cvss_severity_threshold` 'CVSS_SEVERITY_LEVEL_UNSPECIFIED' | 'CVSS_SEVERITY_LEVEL_NONE' | 'CVSS_SEVERITY_LEVEL_LOW' | 'CVSS_SEVERITY_LEVEL_MEDIUM' | 'CVSS_SEVERITY_LEVEL_HIGH' | 'CVSS_SEVERITY_LEVEL_CRITICAL': Common severity level enum used across different CVSS versions. - `ecosystem_package_manager_uuid` object: UUID of the PackageManager that serves an ecosystem, keyed by Ecosystem enum name such as "ECOSYSTEM_NPM". An ecosystem absent from the map keeps its public registry. - `exceptions` PackageFirewallPolicyExceptionRule[]: Exception rules. If any exception matches the request, all checks are skipped. - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE', required: - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `exact_versions` string[]: Exact version strings to except. - `package_name` string, required: Name of the excepted package, without version or ecosystem prefix (e.g. "lodash"). - `version_ranges` PackageFirewallPolicyExceptionVersionRange[]: Version ranges to except. With no exact_versions either, all versions are excepted. - `end` string: Exclusive upper bound (e.g. "2.0.0"). Omit to match to the end. - `start` string: Inclusive lower bound (e.g. "1.0.0"). Omit to match from the beginning. - `fail_closed` boolean: Whether to fail closed when a firewall decision cannot be reached. - `malware_action` 'PACKAGE_FIREWALL_ACTION_UNSPECIFIED' | 'PACKAGE_FIREWALL_ACTION_BLOCK' | 'PACKAGE_FIREWALL_ACTION_WARN' | 'PACKAGE_FIREWALL_ACTION_CURATED': PackageFirewallAction defines how the package firewall responds when a check is triggered. Used in both configuration (what to do) and audit logs (what was done). - PACKAGE_FIREWALL_ACTION_BLOCK: Block the request and return HTTP 403. - PACKAGE_FIREWALL_ACTION_WARN: Log a warning audit event and allow the request to proceed. - PACKAGE_FIREWALL_ACTION_CURATED: One or more versions were removed from the package metadata response as part of package curation. The package manager resolves to the best remaining safe version without seeing the curated-out versions. - `min_age_action` 'PACKAGE_FIREWALL_ACTION_UNSPECIFIED' | 'PACKAGE_FIREWALL_ACTION_BLOCK' | 'PACKAGE_FIREWALL_ACTION_WARN' | 'PACKAGE_FIREWALL_ACTION_CURATED': PackageFirewallAction defines how the package firewall responds when a check is triggered. Used in both configuration (what to do) and audit logs (what was done). - PACKAGE_FIREWALL_ACTION_BLOCK: Block the request and return HTTP 403. - PACKAGE_FIREWALL_ACTION_WARN: Log a warning audit event and allow the request to proceed. - PACKAGE_FIREWALL_ACTION_CURATED: One or more versions were removed from the package metadata response as part of package curation. The package manager resolves to the best remaining safe version without seeing the curated-out versions. - `min_age_hours` integer: Minimum age in hours for a package to be allowed (0 = disabled). - `notification_rules` PackageFirewallPolicyNotificationRule[]: Rules that send a Slack message to notification targets when the firewall blocks or warns. - `name` string: Display name of the rule. - `notification_target_uuids` string[]: UUIDs of the notification targets to send to. - `on_actions` V1PackageFirewallAction[]: Firewall actions that trigger this rule. Empty matches all actions. - `reasons` V1PackageFirewallReason[]: Firewall reasons that trigger this rule. Empty matches all reasons. - `restricted_license_action` 'PACKAGE_FIREWALL_ACTION_UNSPECIFIED' | 'PACKAGE_FIREWALL_ACTION_BLOCK' | 'PACKAGE_FIREWALL_ACTION_WARN' | 'PACKAGE_FIREWALL_ACTION_CURATED': PackageFirewallAction defines how the package firewall responds when a check is triggered. Used in both configuration (what to do) and audit logs (what was done). - PACKAGE_FIREWALL_ACTION_BLOCK: Block the request and return HTTP 403. - PACKAGE_FIREWALL_ACTION_WARN: Log a warning audit event and allow the request to proceed. - PACKAGE_FIREWALL_ACTION_CURATED: One or more versions were removed from the package metadata response as part of package curation. The package manager resolves to the best remaining safe version without seeing the curated-out versions. - `restricted_licenses` string[]: Restricted SPDX license identifiers, subject to restricted_license_action. - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: UUID of the policy. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:object.tenant_meta.namespace/package-firewall-policies/patch.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)