Sign in
PolicySets

Update a policy set

Update metadata or manage binding. Set active=true to bind, active=false to unbind.

patch/zones/{zone_id}/policy-sets/{policy_set_id}

Path parameters

zone_idstring required

The zone identifier

policy_set_idstring required

The policy set identifier

Headers

If-Matchstring

ETag value from a previous GET/POST/PATCH response. When provided, the update only succeeds if the resource has not been modified; otherwise 412 Precondition Failed is returned.

X-API-Versionstring

API version header (date-based, e.g. 2026-02-01)

X-Client-Request-IDstring uuid

Unique request identifier specified by the originating caller and passed along by proxies.

Request body

namestring

Response

The updated policy set

idstring required
zone_idstring required
namestring required
scope_type'zone' | 'resource' | 'user' | 'session' required

Deprecated. Use target_type instead. Carries the same value.

target_type'zone' | 'user' required

What this policy set targets:

  • "zone" — applies to all requests in the zone.
  • "user" — scoped to a specific user.

resource and session are reserved; legacy sets with those scopes carry them in the deprecated scope_type field.

latest_version_idstring nullable
latest_versioninteger nullable

Human-readable version number of the latest version (e.g., 1, 2, 3)

archived_atstring date-time nullable
created_atstring date-time required
updated_atstring date-time required
created_bystring required
updated_bystring nullable
owner_type'platform' | 'customer' required

Who manages this policy set:

  • "platform" — managed by the Keycard platform (system policies).
  • "customer" — managed by the tenant (custom policies).
scope_target_idstring nullable

Deprecated. Use target_id instead. Carries the active binding's target; null when unbound.

target_idstring nullable

Target entity ID. Equals zone_id for zone-targeted sets; the principal identifier for principal-scoped sets. Null only for legacy non-zone sets that predate target tracking.

mode'active' | 'shadow' nullable
activeboolean

Whether this policy set is currently bound to a scope

active_version_idstring nullable

Public ID of the currently active (bound) version

active_versioninteger nullable

Human-readable version number of the active version (e.g., 1, 2, 3)

shadow_version_idstring nullable

Public ID of the shadow (observed) version, if any

shadow_versioninteger nullable

Human-readable version number of the shadow version

Changes

Changed in 4 of the 23 revisions of this API.8

  • 1a0dd4d857ee4See the full diff
    • ○

      added the optional property / to the response with the status

      response-optional-property-added

    • ○

      response property allOf[pdp_PolicySet]/scope_type deprecated

      response-property-deprecated

    • ○

      response property allOf[subschema #2]/scope_target_id deprecated

      response-property-deprecated

    • ○

      added the required property //// to the response with the status

      response-required-property-added

  • 932699a5ea162See the full diff
    • ○

      added the optional property / to the response with the status

      response-optional-property-added

    • ○

      added the optional property / to the response with the status

      response-optional-property-added

  • aee6e66de0d31See the full diff
    • ○

      the endpoint scheme security OAuth2 was added to the API

      api-security-added

  • d3d69f45bfed1See the full diff
    • ○

      endpoint added

      endpoint-added

    This revision also has 8 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog