---
title: "Override the location policy (own organization only; partial update; null resets to preset)"
method: PUT
path: "/api/rightos/locations/{locationId}/policy"
tags: ["locations"]
---

# Override the location policy (own organization only; partial update; null resets to preset)

`PUT /api/rightos/locations/{locationId}/policy`

## Request

- Base URL: `https://rightos.i-s3.com`
- URL: `https://rightos.i-s3.com/api/rightos/locations/{locationId}/policy`
- Auth: one of:
  - HTTP bearer
  - API key in header `x-rightos-key`

## Path parameters

- `locationId` string, required

## Request body

- object, nullable: Partial policy override, or null to reset to the industry preset
  - `transferable` boolean
  - `maxTransfers` integer, nullable
  - `defaultValidityMinutes` integer
  - `verificationRequirement` 'none' | 'external_id'
  - `holderCancellable` boolean

## Response `200`

Updated effective policy

- object
  - `locationId` string
  - `locationType` 'shop' | 'clinic' | 'ev_charging' | 'event' | 'logistics' | 'pickup' | 'other'
  - `policy` RightPolicy: Effective policy for a location (ADR-0010/0014, Policy Engine Phase 2). Resolution order: industry preset for the location's type -> country overlay (organization country x location type; conservative operational defaults for JP/US/GB/KR/TW/FR/DE/IT/ES/AU, not legal advice; see GET /api/rightos/policies) -> per-location override. Presets: shop (transferable, max 3, 12h, self-cancel), clinic (non-transferable, 12h, self-cancel), ev_charging (non-transferable, 4h, self-cancel), event (transferable once, 24h, no self-cancel), logistics (transferable, max 3, 24h, no self-cancel), pickup (transferable once, 6h, no self-cancel), other (transferable, max 3, 12h, self-cancel).
    - `transferable` boolean: Whether the right can be transferred (re-keying)
    - `maxTransfers` integer, nullable: Maximum number of transfers. null = unlimited
    - `defaultValidityMinutes` integer: Default validity applied when a token is issued without endTime
    - `verificationRequirement` 'none' | 'external_id': external_id declares that identity checks are delegated to external partners/ID systems — RightOS itself never collects personal data
    - `holderCancellable` boolean: Whether the current holder (who knows the verificationCode) can self-cancel the token. Operator cancellation via the authenticated cancel endpoint is always available
    - `maxActiveTokens` integer, nullable: Max concurrent active queue tokens (issued + verified, excluding expired). null = unlimited. When full, issue returns 409 queue_full (ADR-0024)
    - `enforceTimeWindow` boolean: When true, verify before startTime returns not_yet_valid (ADR-0024)
    - `requireVerifyBeforeUse` boolean: When true, use from issued status returns 409 verify_required (ADR-0024)
    - `approachingThreshold` integer, nullable: queue.approaching webhook threshold (ADR-0029). After a queue slot frees up (use / cancel / holder-cancel), each token whose aheadCount drops below this value triggers one queue.approaching delivery to the organization's webhooks (once per token; payload data includes queue: { aheadCount, queuePosition }). null = disabled (default). RightOS never notifies end users directly and never auto-calls.
  - `hasOverride` boolean

## Other responses

- `400`: Invalid policy field or value
- `401`: Missing or invalid API key (error: missing_api_key | invalid_api_key)
- `403`: Location belongs to another organization
- `404`: Location not found

---

[API](https://skmtc.dev/i-s3/apis/rightos-right-api.md) · [All operations](https://skmtc.dev/i-s3/apis/rightos-right-api/llms.txt) · [OpenAPI document](https://skmtc.dev/i-s3/apis/rightos-right-api/revisions/10020536e345?raw)