---
title: "Apply a Policy Bundle for the calling user"
method: PUT
path: "/policy/bundle"
tags: ["PolicyBundle"]
---

# Apply a Policy Bundle for the calling user

`PUT /policy/bundle`

Accepts an edited Policy Bundle archive and applies it as the active
user-scope PolicySetVersion for the calling user.

The user's policy set is seeded from the system-default policies on
first access, forked into customer-owned policies; a user bundle
therefore contains only customer-owned policies. Applying an edit
creates a new version of the affected policy, and a `new_policy` entry
adds a further customer-owned policy. Platform-owned catalog policies
are never edited in place by this operation.

The request body codec is determined from `Content-Type`. The only codec
supported today is `application/vnd.keycard.policy-bundle.v1+tar+gzip`.

Supports optimistic concurrency via `If-Match`: when supplied, the server
applies the bundle only if the supplied ETag matches the current bundle
ETag; otherwise responds `412 Precondition Failed`.

On success the server returns the materialized bundle (in the same
codec) and its new `ETag`.

## Headers

- `X-Client-Request-ID` string, uuid
- `If-Match` string

## Response `200`

Bundle applied; materialized archive returned

## Other responses

- `400` — Bundle is malformed or fails Cedar validation
- `401` — Missing or invalid token
- `412` — Supplied `If-Match` ETag does not match the current bundle
- `415` — Request codec is not supported
- `422` — No active policy binding for zone
- `500` — Internal server error
- `501` — Endpoint not yet implemented

## Changes

- **2026-08-26** `d65d51379d93` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/keycardai/apis/untitled-api/changes/policy/bundle/put.md)

---

[API](https://skmtc.dev/keycardai/apis/untitled-api.md) · [All operations](https://skmtc.dev/keycardai/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/keycardai/untitled-api/revisions/d65d51379d93/schema)