---
title: "Updates the per-account PolicySettings singleton."
method: PATCH
path: "/v1/accounts/{account_id}/policySettings"
tags: ["gateway.openapi_Gateway"]
---

# Updates the per-account PolicySettings singleton.

`PATCH /v1/accounts/{account_id}/policySettings`

## Request

- Base URL: `https://api.fireworks.ai`
- URL: `https://api.fireworks.ai/v1/accounts/{account_id}/policySettings`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/fw-ai-external/apis/gateway-rest-api/docs/v1/accounts/:account_id/policySettings/patch.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `account_id` string, required

## Request body

- object
  - `defaultPermissions` PolicySettingsModelPermissions: Each boolean is required when ModelPermissions is sent. Using `optional` gives the field presence tracking, and `(buf.validate.field).required` makes server-side validation reject messages with any unset boolean. This forces callers (frontend, firectl, scripts) to always send all four permissions explicitly, instead of silently relying on bool's default of `false`. It also causes proto3 JSON to emit explicit `false` values on output, so a Get response always shows the full picture.
    - `allowServerless` boolean, required
    - `allowDedicatedDeployments` boolean, required
    - `allowTraining` boolean, required
    - `allowServerlessFast` boolean, required: Serverless inference through the model's Fast serving mode, which is served by a separate router rather than the base model id. Independent of allow_serverless: an account can be allowed standard serverless on a model while being denied its Fast variant.
  - `rules` PolicySettingsModelAccessRule[]: Per-model override rows. A model not listed here uses default_permissions.
    - `model` string, required
    - `permissions` PolicySettingsModelPermissions, required: Each boolean is required when ModelPermissions is sent. Using `optional` gives the field presence tracking, and `(buf.validate.field).required` makes server-side validation reject messages with any unset boolean. This forces callers (frontend, firectl, scripts) to always send all four permissions explicitly, instead of silently relying on bool's default of `false`. It also causes proto3 JSON to emit explicit `false` values on output, so a Get response always shows the full picture.
      - `allowServerless` boolean, required
      - `allowDedicatedDeployments` boolean, required
      - `allowTraining` boolean, required
      - `allowServerlessFast` boolean, required: Serverless inference through the model's Fast serving mode, which is served by a separate router rather than the base model id. Independent of allow_serverless: an account can be allowed standard serverless on a model while being denied its Fast variant.
  - `updateTime` string, date-time
  - `cmekRequired` boolean: Whether new customer-data resources for this account must be CMEK-encrypted. Readable by the account, but only a Fireworks superuser can change it (the write path gates this explicitly). Enabling requires a READY primary ExternalKey.
  - `residency` 'MULTI_REGION_UNSPECIFIED' | 'GLOBAL' | 'US' | 'CANADA' | 'EUROPE' | 'APAC'
  - `zeroDataRetention` PolicySettingsZeroDataRetentionPolicy: Zero Data Retention (ZDR) blocks new work that would retain customer inputs or outputs, such as stored responses, batch jobs, uploads, and training. Compatible stateless requests continue. Enabling ZDR does not delete existing data. Caches, non-content metadata, and third-party retention are excluded. Each scope uses its own enforcement when set, otherwise default_enforced.
    - `defaultEnforced` boolean, required: Account default for Inference and Training. Required whenever this policy is supplied; false means ZDR is off unless a scope enforces it.
    - `inference` ZeroDataRetentionPolicyInferencePolicy: Enforcement for Inference, including chat and completion requests, stored or background responses, and batch inference.
      - `enforcement` 'ENFORCEMENT_UNSPECIFIED' | 'ENFORCED' | 'NOT_ENFORCED': - ENFORCEMENT_UNSPECIFIED: Inherits default_enforced. - ENFORCED: Blocks new Inference work that retains customer content. - NOT_ENFORCED: Allows Inference work that retains customer content.
    - `training` ZeroDataRetentionPolicyTrainingPolicy: Enforcement for Training, including fine-tuning jobs, training sessions, checkpoints, and evaluations. Enforced Training blocks all new Training work because it retains datasets, checkpoints, and trained weights.
      - `enforcement` 'ENFORCEMENT_UNSPECIFIED' | 'ENFORCED' | 'NOT_ENFORCED': - ENFORCEMENT_UNSPECIFIED: Inherits default_enforced. - ENFORCED: Blocks new Training work. - NOT_ENFORCED: Allows new Training work.

## Response `200`

A successful response.

- GatewayPolicySettings: Account-level policy settings (singleton per account). Holds model access and may grow with other policy sections (e.g. regional residency) without separate top-level API resources.
  - `name` string
  - `defaultPermissions` PolicySettingsModelPermissions: Each boolean is required when ModelPermissions is sent. Using `optional` gives the field presence tracking, and `(buf.validate.field).required` makes server-side validation reject messages with any unset boolean. This forces callers (frontend, firectl, scripts) to always send all four permissions explicitly, instead of silently relying on bool's default of `false`. It also causes proto3 JSON to emit explicit `false` values on output, so a Get response always shows the full picture.
    - `allowServerless` boolean, required
    - `allowDedicatedDeployments` boolean, required
    - `allowTraining` boolean, required
    - `allowServerlessFast` boolean, required: Serverless inference through the model's Fast serving mode, which is served by a separate router rather than the base model id. Independent of allow_serverless: an account can be allowed standard serverless on a model while being denied its Fast variant.
  - `rules` PolicySettingsModelAccessRule[]: Per-model override rows. A model not listed here uses default_permissions.
    - `model` string, required
    - `permissions` PolicySettingsModelPermissions, required: Each boolean is required when ModelPermissions is sent. Using `optional` gives the field presence tracking, and `(buf.validate.field).required` makes server-side validation reject messages with any unset boolean. This forces callers (frontend, firectl, scripts) to always send all four permissions explicitly, instead of silently relying on bool's default of `false`. It also causes proto3 JSON to emit explicit `false` values on output, so a Get response always shows the full picture.
      - `allowServerless` boolean, required
      - `allowDedicatedDeployments` boolean, required
      - `allowTraining` boolean, required
      - `allowServerlessFast` boolean, required: Serverless inference through the model's Fast serving mode, which is served by a separate router rather than the base model id. Independent of allow_serverless: an account can be allowed standard serverless on a model while being denied its Fast variant.
  - `updateTime` string, date-time
  - `cmekRequired` boolean: Whether new customer-data resources for this account must be CMEK-encrypted. Readable by the account, but only a Fireworks superuser can change it (the write path gates this explicitly). Enabling requires a READY primary ExternalKey.
  - `residency` 'MULTI_REGION_UNSPECIFIED' | 'GLOBAL' | 'US' | 'CANADA' | 'EUROPE' | 'APAC'
  - `zeroDataRetention` PolicySettingsZeroDataRetentionPolicy: Zero Data Retention (ZDR) blocks new work that would retain customer inputs or outputs, such as stored responses, batch jobs, uploads, and training. Compatible stateless requests continue. Enabling ZDR does not delete existing data. Caches, non-content metadata, and third-party retention are excluded. Each scope uses its own enforcement when set, otherwise default_enforced.
    - `defaultEnforced` boolean, required: Account default for Inference and Training. Required whenever this policy is supplied; false means ZDR is off unless a scope enforces it.
    - `inference` ZeroDataRetentionPolicyInferencePolicy: Enforcement for Inference, including chat and completion requests, stored or background responses, and batch inference.
      - `enforcement` 'ENFORCEMENT_UNSPECIFIED' | 'ENFORCED' | 'NOT_ENFORCED': - ENFORCEMENT_UNSPECIFIED: Inherits default_enforced. - ENFORCED: Blocks new Inference work that retains customer content. - NOT_ENFORCED: Allows Inference work that retains customer content.
    - `training` ZeroDataRetentionPolicyTrainingPolicy: Enforcement for Training, including fine-tuning jobs, training sessions, checkpoints, and evaluations. Enforced Training blocks all new Training work because it retains datasets, checkpoints, and trained weights.
      - `enforcement` 'ENFORCEMENT_UNSPECIFIED' | 'ENFORCED' | 'NOT_ENFORCED': - ENFORCEMENT_UNSPECIFIED: Inherits default_enforced. - ENFORCED: Blocks new Training work. - NOT_ENFORCED: Allows new Training work.

## Changes

- **2026-10-16** `3bf245180173`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/fw-ai-external/apis/gateway-rest-api/changes/v1/accounts/:account_id/policySettings/patch.md)

---

[API](https://skmtc.dev/fw-ai-external/apis/gateway-rest-api.md) - [All operations](https://skmtc.dev/fw-ai-external/apis/gateway-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fw-ai-external/apis/gateway-rest-api/revisions/3bf245180173?raw)