---
title: "Update policy"
method: PUT
path: "/api/v1/policies/{id}"
tags: ["Dynamic Policies"]
deprecated: true
---

# Update policy

`PUT /api/v1/policies/{id}`

## Request

- Base URL: `https://orchestrator.getaxonflow.com`
- URL: `https://orchestrator.getaxonflow.com/api/v1/policies/{id}`
- Auth: none declared. Required headers: `X-Tenant-ID`
- TypeScript: <https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/docs/api/v1/policies/:id/put.ts> (a function with typed inputs; its response is checked against the schema)

> **Deprecated.**

## Path parameters

- `id` string, uuid, required

## Headers

- `X-Tenant-ID` string, required
- `X-User-ID` string

## Request body

- UpdatePolicyRequest: All fields optional for partial update
  - `name` string
  - `description` string
  - `pattern` string
  - `action` 'block' | 'require_approval' | 'redact' | 'warn' | 'log'
  - `severity` 'critical' | 'high' | 'medium' | 'low'
  - `priority` integer
  - `enabled` boolean
  - `conditions` object[]
  - `actions` object[]

## Response `200`

Policy updated

- Policy: A policy with full metadata
  - `id` string, uuid
  - `policy_id` string: Human-readable identifier
  - `name` string
  - `description` string
  - `type` 'static' | 'dynamic'
  - `category` string
  - `tier` 'system' | 'organization' | 'tenant'
  - `pattern` string: Regex pattern (for static policies)
  - `action` 'block' | 'require_approval' | 'redact' | 'warn' | 'log'
  - `severity` 'critical' | 'high' | 'medium' | 'low'
  - `priority` integer
  - `enabled` boolean
  - `conditions` object[]: Conditions (for dynamic policies)
  - `actions` object[]: Actions (for dynamic policies)
  - `version` integer
  - `tenant_id` string
  - `organization_id` string: The organisation that owns this policy. This is the current wire field name and it is not deprecated: it is unrelated to a database column of the same name that was retired in an earlier release. The two share a name and nothing else.
  - `created_by` string
  - `created_at` string, date-time
  - `updated_by` string
  - `updated_at` string, date-time

## Other responses

- `400`: Invalid request (coded envelope)
- `401`: Unauthorized - missing or invalid organization scope (coded envelope)
- `404`: Policy not found
- `409`: The legacy policy tables are read-only. migrations/core/172 revoked INSERT/UPDATE/DELETE/TRUNCATE on static_policies and dynamic_policies from the application roles, and this endpoint writes them, so the write is refused permanently rather than transiently. It is not an entitlement fact: no licence, edition or upgrade changes it. Author policies through the typed authoring route instead. Reads on this endpoint are unaffected. A deployment whose connection may still write the tables (the database owner) does not receive this response. Where the connection cannot write them, the create, update and bulk-import routes answer this before reading the request body, whatever it contains.

---

[API](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api.md) - [All operations](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/revisions/f408ef3ec9dd?raw)