---
title: "Update a Policy"
method: PATCH
path: "/policies/{id}"
tags: ["Policies"]
---

# Update a Policy

`PATCH /policies/{id}`

Updates a Policy.

A Policy is enabled or disabled through the `is_disabled` field. Disabling a Policy stops it granting access without deleting it.

## Path parameters

- `id` string, required

## Request body

- PolicyUpdateRequest — PUT/PATCH body for updating a Policy
  - `policy` PolicyUpdateParams, required — Policy attributes accepted when updating a Policy. All fields are optional; omitted fields keep their current value.
    - `conditions` PolicyCondition[] — Conditions that must be satisfied for the Policy to grant access
      - `operator` 'is_in' | 'is_not_in' | 'is_in_cidr' | 'is_not_in_cidr' | 'is_in_day_of_week_time_ranges' | 'is', required — How the values are compared against the property
      - `property` 'remote_ip_location_region' | 'remote_ip' | 'auth_provider_id' | 'current_utc_datetime' | 'client_verified', required — The attribute of the connection being matched against
      - `values` string[], required — The values to compare against, interpreted per the property
    - `description` string, nullable — Policy Description
    - `flow_log_uploads_enabled` boolean — Whether flow logs are reported for connections authorized by this Policy. Always false for Internet Resource policies.
    - `group_id` string, uuid — Group ID
    - `is_disabled` boolean — Whether the Policy is disabled. A disabled Policy grants no access but is otherwise retained.
    - `resource_id` string, uuid — Resource ID

## Response `200`

Policy Response

- PolicyResponse — Response schema for single Policy
  - `data` Policy — Policy
    - `conditions` PolicyCondition[], required — Conditions that must be satisfied for the Policy to grant access
      - `operator` 'is_in' | 'is_not_in' | 'is_in_cidr' | 'is_not_in_cidr' | 'is_in_day_of_week_time_ranges' | 'is', required — How the values are compared against the property
      - `property` 'remote_ip_location_region' | 'remote_ip' | 'auth_provider_id' | 'current_utc_datetime' | 'client_verified', required — The attribute of the connection being matched against
      - `values` string[], required — The values to compare against, interpreted per the property
    - `description` string, nullable, required — Policy Description
    - `flow_log_uploads_enabled` boolean, required — Whether flow logs are reported for connections authorized by this Policy
    - `group_id` string, uuid, nullable, required — Group ID. Null if the Group was deleted during directory sync; it is relinked automatically if the Group reappears on a subsequent sync.
    - `id` string, uuid, required — Policy ID
    - `is_disabled` boolean, required — Whether the Policy is disabled. A disabled Policy grants no access but is otherwise retained.
    - `resource_id` string, uuid, required — Resource ID

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `422` — Unprocessable Content
- `429` — Too Many Requests

---

[API](https://skmtc.dev/firezone/apis/firezone-api.md) · [All operations](https://skmtc.dev/firezone/apis/firezone-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/firezone/firezone-api/revisions/110de2cb2283/schema)