---
title: "Replace this organization's risk policy (BSA officer / admin session required)"
method: PUT
path: "/api/v1/policy"
tags: ["risk-policy-browser"]
---

# Replace this organization's risk policy (BSA officer / admin session required)

`PUT /api/v1/policy`

## Request

- Base URL: `https://kyt.infinihash.com`
- URL: `https://kyt.infinihash.com/api/v1/policy`
- Auth: API key in header `X-API-Key`

Replace the CALLER's org policy. Stricter-only: each cut-off may only
move down from its default (critical <= 76) and each action may only be
raised. Direct sanctions matches and critical overrides are always
critical / block_report regardless.

Auth: a `bsa_officer`/`admin` dashboard session (cookie or Bearer JWT) is
required; the session's organization must be the one being changed.

## Request body

- PolicyUpdate: Full replacement of the org's policy. Omitted levels take the global default, so `{}` resets the org to today's behaviour (as a new version).
  - `thresholds` object, nullable
  - `actions` object, nullable
  - `exposure_decay` boolean, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `403`: No BSA officer/admin session (an API key alone is never sufficient), or the session belongs to a different organization
- `409`: Concurrent update; retry
- `422`: Policy would weaken a default band, a floor, or is malformed

---

[API](https://skmtc.dev/infinihash/apis/infinihash-kyt.md) · [All operations](https://skmtc.dev/infinihash/apis/infinihash-kyt/llms.txt) · [OpenAPI document](https://skmtc.dev/infinihash/apis/infinihash-kyt/revisions/e575fa9c63fd?raw)