---
title: "Toggle policy enabled status"
method: PATCH
path: "/api/v1/system-policies/{id}"
tags: ["System Policies"]
deprecated: true
---

# Toggle policy enabled status

`PATCH /api/v1/system-policies/{id}`

## Request

- Base URL: `https://agent.getaxonflow.com`
- URL: `https://agent.getaxonflow.com/api/v1/system-policies/{id}`
- Auth: none declared
- TypeScript: <https://skmtc.dev/getaxonflow/apis/axonflow-agent-api/docs/api/v1/system-policies/:id/patch.ts> (a function with typed inputs; its response is checked against the schema)

> **Deprecated.**

Toggles the enabled status of a policy.

**Restrictions:**
- System-tier policies cannot be disabled via this endpoint (use overrides)

**v11:** on a deployment whose database connection cannot write
`static_policies` (`migrations/core/172`), this route answers
`409 LEGACY_POLICY_WRITE_FROZEN` before the request body is read and
before the policy is looked up, whatever it contains, naming the
typed authoring route. An owner-role deployment still toggles.

## Path parameters

- `id` string, uuid, required

## Headers

- `X-User-ID` string

## Request body

- object
  - `enabled` boolean, required: New enabled status

## Response `200`

Policy updated successfully

- StaticPolicy: A static policy with three-tier hierarchy support (v2.0.0). System policies are immutable; Organization/Tenant policies can be customized.
  - `id` string, uuid, required: Unique policy UUID
  - `policy_id` string, required: Human-readable policy identifier (e.g., sys_sqli_union_select)
  - `name` string, required: Display name of the policy
  - `description` string: Detailed policy description
  - `category` 'security-sqli' | 'security-admin' | 'pii-global' | 'pii-us' | 'pii-eu' | 'pii-india' | 'custom', required: Policy category (v2.0.0 semantic naming)
  - `tier` 'system' | 'organization' | 'tenant': Policy tier in the hierarchy
  - `pattern` string, required: Regex pattern for detection
  - `severity` 'critical' | 'high' | 'medium' | 'low', required: Policy severity level
  - `action` 'block' | 'require_approval' | 'redact' | 'warn' | 'log', required: Action to take when pattern matches. require_approval triggers HITL queue for human oversight.
  - `enabled` boolean, required: Whether policy is active
  - `priority` integer: Evaluation priority (higher = evaluated first)
  - `version` integer: Policy version number
  - `has_override` boolean: Whether this policy has an override (Enterprise only)
  - `override` PolicyOverride: Override configuration for system policies (Enterprise only)
    - `id` string: Override identifier
    - `policy_id` string: ID of the policy being overridden
    - `policy_type` 'static' | 'dynamic': Type of policy being overridden
    - `tenant_id` string: Tenant ID for tenant-level overrides
    - `enabled_override` boolean: Override enabled status (null = no override)
    - `action_override` 'block' | 'require_approval' | 'redact' | 'warn' | 'log': Override action (must be more restrictive). require_approval triggers HITL queue.
    - `override_reason` string: Reason for the override (required for audit)
    - `expires_at` string, date-time: When the override automatically expires
    - `created_by` string: User who created the override
    - `created_at` string, date-time
    - `updated_by` string: User who last updated the override
    - `updated_at` string, date-time
  - `tenant_id` string, required: Tenant ID (for tenant-tier policies)
  - `created_at` string, date-time, required: When policy was created
  - `updated_at` string, date-time, required: When policy was last modified

## Other responses

- `403`: System policies cannot be disabled
- `404`: Policy not found
- `409`: The legacy policy tables are read-only. `migrations/core/172` revoked INSERT, UPDATE, DELETE and TRUNCATE on `static_policies` from the application roles, and this endpoint writes it, so the write is refused permanently rather than transiently. It is not an entitlement fact: no licence, edition or upgrade changes it. Author policies through the typed authoring route (`/api/v1/typed-policies`, in `orchestrator-api.yaml`) instead. Reads are unaffected. A deployment whose connection may still write the table (the database owner; a property of the connection, not of `AXONFLOW_DB_USE_APP_ROLE` alone) is not bound by the revoke and does not receive this response. The body is the `JSONError` envelope with `code` as the string `LEGACY_POLICY_WRITE_FROZEN` rather than the numeric status.

---

[API](https://skmtc.dev/getaxonflow/apis/axonflow-agent-api.md) - [All operations](https://skmtc.dev/getaxonflow/apis/axonflow-agent-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getaxonflow/apis/axonflow-agent-api/revisions/34d30fcb7fa1?raw)