--- title: "Update Cluster Policy for Virtual Cluster" method: PUT path: "/v1/event-gateways/{gatewayId}/virtual-clusters/{virtualClusterId}/cluster-policies/{policyId}" tags: ["Event Gateway Virtual Cluster Policies"] --- # Update Cluster Policy for Virtual Cluster `PUT /v1/event-gateways/{gatewayId}/virtual-clusters/{virtualClusterId}/cluster-policies/{policyId}` ## Request - Base URL: `https://global.api.konghq.com` - URL: `https://global.api.konghq.com/v1/event-gateways/{gatewayId}/virtual-clusters/{virtualClusterId}/cluster-policies/{policyId}` - Auth: one of: - HTTP bearer - HTTP bearer - HTTP bearer - HTTP bearer Updates an existing cluster-level policy associated with the specified Event Gateway virtual cluster. ## Request body - union: The typed schema of the cluster policy to modify it. - EventGatewayACLsPolicy: Apply Kafka ACLs to virtual cluster traffic. - `type` 'acls', required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `config` EventGatewayACLPolicyConfig, required: Apply ACLs to virtual cluster traffic. - `rules` EventGatewayACLRule[], required: Every ACL rule in this list applies independently. - `resource_type` 'topic' | 'group' | 'transactional_id' | 'cluster', required: This rule applies to access only for type of resource - `action` 'allow' | 'deny', required: How to handle the request if the rule matches - `operations` EventGatewayACLOperation[], required: Types of Kafka operations to match against. Note that not every operation can apply to every resource type. - `name` 'all' | 'alter' | 'alter_configs' | 'create' | 'delete' | 'describe' | 'describe_configs' | 'idempotent_write' | 'read' | 'write', required - `resource_names` union, required: If any of these entries match, the resource name matches for this rule. A maximum of 50 entries are allowed. - EventGatewayACLResourceName[]: A static list of resource name globs to match against resources when applying an ACL policy. - `match` string, glob, required: Currently supported are exact matches and globs. All `*` characters are interpreted as globs, i.e. they match zero or more of any character. - string: This expression should evaluate to an array of glob patterns, equivalent to the `match` values in the static array form of `resource_names`. **Requires a minimum runtime version of `1.1`**. - `condition` string: A string containing the boolean expression that determines whether the policy is applied. - EventGatewayRequestRuleValidatorPolicy: Validates the content of Kafka requests against a list of rules. Use this policy to enforce conventions that Kafka ACLs cannot express, because ACLs cannot read the content of a request. For example, a maximum number of partitions, a topic naming convention, or a minimum number of acknowledgements on produce. Each rule describes the valid state of the request. The action of the rule runs when the rule evaluates to `false`. **Requires a minimum runtime version of `1.3`**. - `type` 'request_rule_validator', required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `config` EventGatewayRequestRuleValidatorConfig, required: The configuration of the request rule validator policy. - `requests` EventGatewayRequestRules[], required: The rules to apply, grouped by Kafka request type. A request type can occur more than once in this list. Every entry for the type applies, in list order. Requests of a type that is not in this list are not validated. A maximum of 100 entries are allowed. - union: The rules to apply to one Kafka request type. - EventGatewayCreateTopicsRequestRules: The rules to apply to Kafka `CreateTopics` requests. When at least one `create_topics` rule is configured, Event Gateway turns auto topic creation off on `Metadata` requests, because clients could use it to bypass the rules. - `type` 'create_topics', required - `rules` EventGatewayCreateTopicsRule[], required: Every rule in this list is evaluated independently against each topic in the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - … - EventGatewayCreatePartitionsRequestRules: The rules to apply to Kafka `CreatePartitions` requests. - `type` 'create_partitions', required - `rules` EventGatewayCreatePartitionsRule[], required: Every rule in this list is evaluated independently against each topic in the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - … - EventGatewayAlterConfigsRequestRules: The rules to apply to Kafka `AlterConfigs` requests. - `type` 'alter_configs', required - `rules` EventGatewayAlterConfigsRule[], required: Every rule in this list is evaluated independently against each resource in the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - … - EventGatewayIncrementalAlterConfigsRequestRules: The rules to apply to Kafka `IncrementalAlterConfigs` requests. - `type` 'incremental_alter_configs', required - `rules` EventGatewayIncrementalAlterConfigsRule[], required: Every rule in this list is evaluated independently against each configuration entry in the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - … - EventGatewayAlterClientQuotasRequestRules: The rules to apply to Kafka `AlterClientQuotas` requests. - `type` 'alter_client_quotas', required - `rules` EventGatewayAlterClientQuotasRule[], required: Every rule in this list is evaluated independently against each quota operation in the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - … - EventGatewayAlterUserScramCredentialsRequestRules: The rules to apply to Kafka `AlterUserScramCredentials` requests. - `type` 'alter_user_scram_credentials', required - `rules` EventGatewayAlterUserScramCredentialsRule[], required: Every rule in this list is evaluated independently against each credential in the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - … - EventGatewayProduceRequestRules: The rules to apply to Kafka `Produce` requests. - `type` 'produce', required - `rules` EventGatewayProduceRule[], required: Every rule in this list is evaluated independently against the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - … - EventGatewayFetchRequestRules: The rules to apply to Kafka `Fetch` requests. - `type` 'fetch', required - `rules` EventGatewayFetchRule[], required: Every rule in this list is evaluated independently against the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - … - EventGatewayJoinGroupRequestRules: The rules to apply to Kafka `JoinGroup` requests. - `type` 'join_group', required - `rules` EventGatewayJoinGroupRule[], required: Every rule in this list is evaluated independently against the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - … - EventGatewayConsumerGroupHeartbeatRequestRules: The rules to apply to Kafka `ConsumerGroupHeartbeat` requests. - `type` 'consumer_group_heartbeat', required - `rules` EventGatewayConsumerGroupHeartbeatRule[], required: Every rule in this list is evaluated independently against the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - … - EventGatewayOffsetCommitRequestRules: The rules to apply to Kafka `OffsetCommit` requests. - `type` 'offset_commit', required - `rules` EventGatewayOffsetCommitRule[], required: Every rule in this list is evaluated independently against the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - … - EventGatewayOffsetFetchRequestRules: The rules to apply to Kafka `OffsetFetch` requests. - `type` 'offset_fetch', required - `rules` EventGatewayOffsetFetchRule[], required: Every rule in this list is evaluated independently against the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - … - EventGatewayTxnOffsetCommitRequestRules: The rules to apply to Kafka `TxnOffsetCommit` requests. - `type` 'txn_offset_commit', required - `rules` EventGatewayTxnOffsetCommitRule[], required: Every rule in this list is evaluated independently against the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - … - `condition` string: A string containing the boolean expression that determines whether the policy is applied. ## Response `200` Updated cluster-level policy object. - EventGatewayPolicy: A policy associated with an Event Gateway. - `type` string, required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `id` string, uuid, required: The unique identifier of the policy. - `config` object: The configuration of the policy. - `created_at` string, date-time, required: An ISO-8601 timestamp representation of entity creation date. - `parent_policy_id` string, uuid, nullable: The unique identifier of the parent policy, if any. - `updated_at` string, date-time, required: An ISO-8601 timestamp representation of entity update date. - `condition` string: A string containing the boolean expression that determines whether the policy is applied. ## Other responses - `400`: Bad Request - `401`: Unauthorized - `403`: Forbidden ## Changes - **2026-10-15** `7aab863a6daa`: 1 breaking, 2 warning - added `#/components/schemas/InvalidParameterMinimumTime, #/components/schemas/InvalidParameterMaximumTime` to the `invalid_parameters/items/` response property `oneOf` list for the response status `400` - added the new `key_invalid` enum value to the `invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterStandard]/rule` response property for the response status `400` - added the new `unique` enum value to the `invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterStandard]/rule` response property for the response status `400` - **2026-09-29** `ffdac1582857`: 2 info - added `txn_offset_commit` discriminator mapping keys to the `oneOf[subschema #2: Request Rule Validator]/config/requests/items/` request property - added `#/components/schemas/EventGatewayTxnOffsetCommitRequestRules` to the `oneOf[subschema #2: Request Rule Validator]/config/requests/items/` request property `oneOf` list - **2026-09-25** `68d43091b84d`: 2 warning - added the new `400.00` enum value to the `status` response property for the response status `400` - added the new `403.00` enum value to the `status` response property for the response status `403` - **2026-09-22** `f82fa1eee23a`: 2 info - added `request_rule_validator` mapping keys to the request discriminator - added `#/components/schemas/EventGatewayRequestRuleValidatorPolicy` to the request body `oneOf` list - …earlier changes not shown [Operation history](https://skmtc.dev/kong/apis/konnect-api-go-sdk/changes/v1/event-gateways/:gatewayId/virtual-clusters/:virtualClusterId/cluster-policies/:policyId/put.md) --- [API](https://skmtc.dev/kong/apis/konnect-api-go-sdk.md) · [All operations](https://skmtc.dev/kong/apis/konnect-api-go-sdk/llms.txt) · [OpenAPI document](https://skmtc.dev/kong/apis/konnect-api-go-sdk/revisions/7aab863a6daa?raw)