---
title: "Update Tenant Agent Policy"
method: PATCH
path: "/tenants/{id}/agent-policy"
tags: ["agents"]
---

# Update Tenant Agent Policy

`PATCH /tenants/{id}/agent-policy`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/tenants/{id}/agent-policy`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

Merges a partial policy onto what is stored (tenant_manage in that tenant). An unknown key, a wrong type, max_credential_ttl_days < 1, a default above the max, or an unknown role id is 400 invalid_policy.

## Path parameters

- `id` string, required

## Request body

- EnforcerV3InternalDomainAgentPolicy
  - `allowed_role_ids` string[]: AllowedRoleIDs are the role ids a non-admin may give an agent. Absent from storage, it defaults to the built-in "user" and "developer" roles (resolved by the usecase, which can see roles).
  - `default_credential_ttl_days` integer
  - `max_agents_per_steward` integer
  - `max_credential_ttl_days` integer
  - `member_agents` boolean
  - `require_expiry` boolean

## Response `200`

OK

- InternalDeliveryHttpHandlerAgentPolicyResponse
  - `data` EnforcerV3InternalDomainAgentPolicy
    - `allowed_role_ids` string[]: AllowedRoleIDs are the role ids a non-admin may give an agent. Absent from storage, it defaults to the built-in "user" and "developer" roles (resolved by the usecase, which can see roles).
    - `default_credential_ttl_days` integer
    - `max_agents_per_steward` integer
    - `max_credential_ttl_days` integer
    - `member_agents` boolean
    - `require_expiry` boolean
  - `success` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)