--- title: "Update Consume Policy for Virtual Cluster" method: PUT path: "/v1/event-gateways/{gatewayId}/virtual-clusters/{virtualClusterId}/consume-policies/{policyId}" tags: ["Event Gateway Virtual Cluster Consume Policies"] --- # Update Consume Policy for Virtual Cluster `PUT /v1/event-gateways/{gatewayId}/virtual-clusters/{virtualClusterId}/consume-policies/{policyId}` ## Request - Base URL: `https://global.api.konghq.com` - URL: `https://global.api.konghq.com/v1/event-gateways/{gatewayId}/virtual-clusters/{virtualClusterId}/consume-policies/{policyId}` - Auth: one of: - HTTP bearer - HTTP bearer - HTTP bearer - HTTP bearer Updates an existing consume policy associated with the specified Event Gateway virtual cluster. ## Request body - union: The typed schema of the consume policy to modify it. - EventGatewayModifyHeadersPolicy: A policy that modifies headers for requests. - `type` 'modify_headers', required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `config` object, required: The configuration of the modify headers policy. - `actions` EventGatewayModifyHeaderAction[]: Actions are run in sequential order and act on individual headers. - union: An action that modifies a header. - EventGatewayModifyHeaderRemoveAction: An action that removes a header by key. - `op` 'remove', required - `key` string, required: The key of the header to remove. - EventGatewayModifyHeaderSetAction: An action that sets a header key and value. - `op` 'set', required - `key` string, required: The key of the header to set. - `value` string, required: The value of the header to set. - `condition` string: A string containing the boolean expression that determines whether the policy is applied. When the policy is applied as a child policy of schema_validation, the expression can also reference `record.value` fields. - EventGatewayConsumeSchemaValidationPolicy: A policy that validates consume messages against a schema registry. - `type` 'schema_validation', required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `config` union, required: The configuration of the consume schema validation policy. - EventGatewayConsumeSchemaValidationPolicySchemaRegistryConfig: The configuration of the consume schema validation policy when using a schema registry. - `schema_registry` union: A reference to a schema Registry. - object - `id` string, uuid, required: The unique identifier of the schema registry. - object: Reference a schema registry by its unique name. - `name` string, required: The unique name of the schema registry. - `failure_mode` 'error' | 'skip' | 'passthrough' | 'mark': Describes how to handle a failure in a policy applied to consumed records. * `error` - the batch is not delivered to the client. Use sparingly: erroring on a batch causes clients to get stuck on the problematic offset and requires manual intervention to skip it. * `skip` - the record is not delivered to the client. * `passthrough` - passes the record to the client even though policy execution failed. * `mark` - passes the record to the client but marks it with a `kong/policy-failure-` header whose value is the reason for the policy failure (truncated to 512 characters). **Requires a minimum runtime version of `1.2`**. - `validate_key` boolean: If true, validate the record key. **Requires a minimum runtime version of `1.2`**. - `validate_value` boolean: If true, validate the record value. **Requires a minimum runtime version of `1.2`**. - `key_validation_action` 'mark' | 'skip': Deprecated. Use `failure_mode`. Defines a behavior when record key is not valid. * mark - marks a record with kong/server header and client ID value to help to identify the clients violating schema. * skip - skips delivering a record. - `value_validation_action` 'mark' | 'skip': Deprecated. Use `failure_mode`. Defines a behavior when record value is not valid. * mark - marks a record with kong/server header and client ID value to help to identify the clients violating schema. * skip - skips delivering a record. - `type` 'confluent_schema_registry', required - EventGatewayConsumeSchemaValidationPolicyJsonConfig: The configuration of the consume schema validation policy when using JSON parsing without schema. - `schema_registry` union: A reference to a schema Registry. - object - `id` string, uuid, required: The unique identifier of the schema registry. - object: Reference a schema registry by its unique name. - `name` string, required: The unique name of the schema registry. - `failure_mode` 'error' | 'skip' | 'passthrough' | 'mark': Describes how to handle a failure in a policy applied to consumed records. * `error` - the batch is not delivered to the client. Use sparingly: erroring on a batch causes clients to get stuck on the problematic offset and requires manual intervention to skip it. * `skip` - the record is not delivered to the client. * `passthrough` - passes the record to the client even though policy execution failed. * `mark` - passes the record to the client but marks it with a `kong/policy-failure-` header whose value is the reason for the policy failure (truncated to 512 characters). **Requires a minimum runtime version of `1.2`**. - `validate_key` boolean: If true, validate the record key. **Requires a minimum runtime version of `1.2`**. - `validate_value` boolean: If true, validate the record value. **Requires a minimum runtime version of `1.2`**. - `key_validation_action` 'mark' | 'skip': Deprecated. Use `failure_mode`. Defines a behavior when record key is not valid. * mark - marks a record with kong/server header and client ID value to help to identify the clients violating schema. * skip - skips delivering a record. - `value_validation_action` 'mark' | 'skip': Deprecated. Use `failure_mode`. Defines a behavior when record value is not valid. * mark - marks a record with kong/server header and client ID value to help to identify the clients violating schema. * skip - skips delivering a record. - `type` 'json', required - EventGatewayConsumeSchemaValidationPolicyInlineSchemaConfig: The configuration of the consume schema validation policy when using an inline schema. **Requires a minimum runtime version of `1.3`**. - `schema_registry` union: A reference to a schema Registry. - object - `id` string, uuid, required: The unique identifier of the schema registry. - object: Reference a schema registry by its unique name. - `name` string, required: The unique name of the schema registry. - `failure_mode` 'error' | 'skip' | 'passthrough' | 'mark': Describes how to handle a failure in a policy applied to consumed records. * `error` - the batch is not delivered to the client. Use sparingly: erroring on a batch causes clients to get stuck on the problematic offset and requires manual intervention to skip it. * `skip` - the record is not delivered to the client. * `passthrough` - passes the record to the client even though policy execution failed. * `mark` - passes the record to the client but marks it with a `kong/policy-failure-` header whose value is the reason for the policy failure (truncated to 512 characters). **Requires a minimum runtime version of `1.2`**. - `validate_key` boolean: If true, validate the record key. **Requires a minimum runtime version of `1.2`**. - `validate_value` boolean: If true, validate the record value. **Requires a minimum runtime version of `1.2`**. - `key_validation_action` 'mark' | 'skip': Deprecated. Use `failure_mode`. Defines a behavior when record key is not valid. * mark - marks a record with kong/server header and client ID value to help to identify the clients violating schema. * skip - skips delivering a record. - `value_validation_action` 'mark' | 'skip': Deprecated. Use `failure_mode`. Defines a behavior when record value is not valid. * mark - marks a record with kong/server header and client ID value to help to identify the clients violating schema. * skip - skips delivering a record. - `type` 'inline_schema', required - `condition` string: A string containing the boolean expression that determines whether the policy is applied. - EventGatewayDecryptPolicy: Decrypts Kafka records or keys using AES_256_GCM. Keys are therefore 256 bits long. - `type` 'decrypt', required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `config` EventGatewayDecryptPolicyConfig, required: The configuration of the decrypt policy. - `failure_mode` 'error' | 'passthrough', required: Describes how to handle failing encryption or decryption. Use `error` if the record should be rejected if encryption or decryption fails. Use `passthrough` to ignore encryption or decryption failure and continue proxying the record. - `key_sources` EventGatewayKeySource[], required: Describes how to find a symmetric key for decryption. - union: A key source that describes how to find a symmetric key for encryption or decryption. It can be an AWS KMS key source that uses a KMS to find a symmetric key, or a static key source that uses a static symmetric key provided as secrets. - EventGatewayAWSKeySource: A key source that uses an AWS KMS to find a symmetric key. Load KMS credentials from the environment. See [aws docs](https://docs.aws.amazon.com/sdk-for-rust/latest/dg/credproviders.html#credproviders-default-credentials-provider-chain) for more information about how credential retrieval. - `type` 'aws', required - EventGatewayStaticKeySource: A key source that uses static symmetric keys. - `type` 'static', required - `part_of_record` DecryptionRecordPart[], required: Describes the parts of a record to decrypt. - `condition` string: A string containing the boolean expression that determines whether the policy is applied. - EventGatewaySkipRecordPolicy: A policy that skips processing of a record. - `type` 'skip_record', required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `condition` string: A string containing the boolean expression that determines whether the policy is applied. When the policy is applied as a child policy of schema_validation, the expression can also reference `record.value` fields. - EventGatewayParsedRecordDecryptFieldsPolicy: Decrypts fields of parsed Kafka records using AES_256_GCM. Keys are therefore 256 bits long. Note this policy can only be used as a child of a `EventGatewayConsumeSchemaValidationPolicy` policy. **Requires a minimum runtime version of `1.2`**. - `type` 'decrypt_fields', required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `config` EventGatewayParsedRecordDecryptFieldsConfig, required: The configuration of the decrypt parsed record fields policy. - `failure_mode` 'error' | 'skip' | 'passthrough' | 'mark', required: Describes how to handle a failure in a policy applied to consumed records. * `error` - the batch is not delivered to the client. Use sparingly: erroring on a batch causes clients to get stuck on the problematic offset and requires manual intervention to skip it. * `skip` - the record is not delivered to the client. * `passthrough` - passes the record to the client even though policy execution failed. * `mark` - passes the record to the client but marks it with a `kong/policy-failure-` header whose value is the reason for the policy failure (truncated to 512 characters). **Requires a minimum runtime version of `1.2`**. - `key_sources` EventGatewayKeySource[], required: Describes how to find a symmetric key for decryption. - union: A key source that describes how to find a symmetric key for encryption or decryption. It can be an AWS KMS key source that uses a KMS to find a symmetric key, or a static key source that uses a static symmetric key provided as secrets. - EventGatewayAWSKeySource: A key source that uses an AWS KMS to find a symmetric key. Load KMS credentials from the environment. See [aws docs](https://docs.aws.amazon.com/sdk-for-rust/latest/dg/credproviders.html#credproviders-default-credentials-provider-chain) for more information about how credential retrieval. - `type` 'aws', required - EventGatewayStaticKeySource: A key source that uses static symmetric keys. - `type` 'static', required - `decrypt_fields` EventGatewayParsedRecordDecryptionSelector, required: Selects fields of a parsed record for decryption. - `paths` union, required: Selects which fields of the parsed record to decrypt. A maximum of 50 path entries are allowed. - object[] - `match` string, required: A field selector. It can select nested fields and array entries. Currently supported are exact matches. - string: This expression should evaluate to an array of exact field paths, equivalent to the `match` values in the array variant. - `condition` string: A string containing the boolean expression that determines whether the policy is applied. When the policy is applied as a child policy of schema_validation, the expression can also reference `record.value` fields. - EventGatewayParsedRecordTranscodeConsumePolicy: Converts an already schema-validated record value into a different serialization format before it is returned to the consumer. Note this policy can only be used as a child of a `EventGatewayConsumeSchemaValidationPolicy` policy. **Requires a minimum runtime version of `1.3`**. - `type` 'transcode', required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `config` union, required: The configuration of the transcode parsed record policy applied to consumed records. - EventGatewayParsedRecordTranscodeConsumeConfigJson: The configuration of the transcode parsed record policy when converting consumed records to JSON. - `failure_mode` 'error' | 'skip' | 'passthrough' | 'mark', required: Describes how to handle a failure in a policy applied to consumed records. * `error` - the batch is not delivered to the client. Use sparingly: erroring on a batch causes clients to get stuck on the problematic offset and requires manual intervention to skip it. * `skip` - the record is not delivered to the client. * `passthrough` - passes the record to the client even though policy execution failed. * `mark` - passes the record to the client but marks it with a `kong/policy-failure-` header whose value is the reason for the policy failure (truncated to 512 characters). **Requires a minimum runtime version of `1.2`**. - `schema_source` union: Determines how to look up the schema to use for the transcoded output data. Leave this unset if the output data schema isn't needed. - EventGatewayParsedRecordTranscodeSchemaSourceReference: References a schema registered in a schema registry, computing the subject and version to use. - `type` 'reference', required - `schema_registry` union: A reference to a schema Registry. - … - `subject` string: An expression that computes the schema registry subject of the output data's schema. - `version` string: An expression that computes the schema registry version of the output data's schema. - EventGatewayParsedRecordTranscodeSchemaSourceInline: A schema embedded directly in the policy configuration. - `type` 'inline', required - `inline` string, required: The raw schema text (e.g. an Avro JSON schema) to use for the transcoded output data. - `schema_ref_destination` union, required: Defines how to record the schema id for the transcoded output data. See the [Confluent docs](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format) for more about the wire format. - EventGatewayParsedRecordTranscodeSchemaRefDestinationConfluentFormat: Prefixes the structured data bytes with a reference to the schema. - `type` 'confluent_format', required - EventGatewayParsedRecordTranscodeSchemaRefDestinationRecordHeader: Puts the schema reference in a record header. - `type` 'record_header', required - `record_header` object - … - EventGatewayParsedRecordTranscodeSchemaRefDestinationNone: Do not persist the schema anywhere. - `type` 'none', required - `output_format` 'json', required: The serialization format to convert the record value into. - EventGatewayParsedRecordTranscodeConsumeConfigAvro: The configuration of the transcode parsed record policy when converting consumed records to Avro. Avro requires a schema to serialize the record value, so `schema_source` must be set. - `failure_mode` 'error' | 'skip' | 'passthrough' | 'mark', required: Describes how to handle a failure in a policy applied to consumed records. * `error` - the batch is not delivered to the client. Use sparingly: erroring on a batch causes clients to get stuck on the problematic offset and requires manual intervention to skip it. * `skip` - the record is not delivered to the client. * `passthrough` - passes the record to the client even though policy execution failed. * `mark` - passes the record to the client but marks it with a `kong/policy-failure-` header whose value is the reason for the policy failure (truncated to 512 characters). **Requires a minimum runtime version of `1.2`**. - `schema_source` union, required: Determines how to look up the schema to use for the transcoded output data. Leave this unset if the output data schema isn't needed. - EventGatewayParsedRecordTranscodeSchemaSourceReference: References a schema registered in a schema registry, computing the subject and version to use. - `type` 'reference', required - `schema_registry` union: A reference to a schema Registry. - … - `subject` string: An expression that computes the schema registry subject of the output data's schema. - `version` string: An expression that computes the schema registry version of the output data's schema. - EventGatewayParsedRecordTranscodeSchemaSourceInline: A schema embedded directly in the policy configuration. - `type` 'inline', required - `inline` string, required: The raw schema text (e.g. an Avro JSON schema) to use for the transcoded output data. - `schema_ref_destination` union, required: Defines how to record the schema id for the transcoded output data. See the [Confluent docs](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format) for more about the wire format. - EventGatewayParsedRecordTranscodeSchemaRefDestinationConfluentFormat: Prefixes the structured data bytes with a reference to the schema. - `type` 'confluent_format', required - EventGatewayParsedRecordTranscodeSchemaRefDestinationRecordHeader: Puts the schema reference in a record header. - `type` 'record_header', required - `record_header` object - … - EventGatewayParsedRecordTranscodeSchemaRefDestinationNone: Do not persist the schema anywhere. - `type` 'none', required - `output_format` 'avro', required: The serialization format to convert the record value into. - `condition` string: A string containing the boolean expression that determines whether the policy is applied. When the policy is applied as a child policy of schema_validation, the expression can also reference `record.value` fields. - EventGatewayParsedRecordMaskFieldsConsumePolicy: Redacts string fields of parsed Kafka records using a configurable masking strategy. Only string fields may be selected. Selecting a field that does not exist is ignored; selecting a field that is not a string is a policy error handled by `failure_mode`. Note this policy can only be used as a child of a `EventGatewayConsumeSchemaValidationPolicy` policy. **Requires a minimum runtime version of `1.3`**. - `type` 'mask_fields', required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `config` EventGatewayParsedRecordMaskFieldsConsumeConfig, required: The configuration of the mask parsed record fields consume policy. - `failure_mode` 'error' | 'skip' | 'passthrough' | 'mark', required: Describes how to handle a failure in a policy applied to consumed records. * `error` - the batch is not delivered to the client. Use sparingly: erroring on a batch causes clients to get stuck on the problematic offset and requires manual intervention to skip it. * `skip` - the record is not delivered to the client. * `passthrough` - passes the record to the client even though policy execution failed. * `mark` - passes the record to the client but marks it with a `kong/policy-failure-` header whose value is the reason for the policy failure (truncated to 512 characters). **Requires a minimum runtime version of `1.2`**. - `mask_fields` EventGatewayParsedRecordMaskSelector[], required: Selects which fields to mask and how to mask them. - `paths` union, required: Selects which fields of the parsed record to mask. A maximum of 50 path entries are allowed. - object[] - `match` string, required: A field selector. It can select nested fields and array entries. Currently supported are exact matches. - string: This expression should evaluate to an array of exact field paths, equivalent to the `match` values in the array variant. - `strategy` union, required: The strategy used to redact a matched field value. - EventGatewayMaskStrategyKeepChars: Keeps a number of leading and/or trailing characters and replaces the middle with a fixed phrase. If `first + last` is greater than or equal to the value length, the whole value is replaced with the phrase, so it never shows more characters than the original value. The phrase is fixed, so the masked output does not leak the value length. - `type` 'keep_chars', required - `keep_chars` object, required - … - EventGatewayMaskStrategyEmail: Masks an email address by applying a separate strategy to the local part and to the domain. - `type` 'email', required - `email` object, required - … - EventGatewayMaskStrategyReplace: Replaces the whole value with a fixed phrase. The masked length does not reflect the original value length. - `type` 'replace', required - `replace` object, required - … - `condition` string: A string containing the boolean expression that determines whether the policy is applied. When the policy is applied as a child policy of schema_validation, the expression can also reference `record.value` fields. ## Response `200` Updated consume policy object. - EventGatewayPolicy: A policy associated with an Event Gateway. - `type` string, required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `id` string, uuid, required: The unique identifier of the policy. - `config` object: The configuration of the policy. - `created_at` string, date-time, required: An ISO-8601 timestamp representation of entity creation date. - `parent_policy_id` string, uuid, nullable: The unique identifier of the parent policy, if any. - `updated_at` string, date-time, required: An ISO-8601 timestamp representation of entity update date. - `condition` string: A string containing the boolean expression that determines whether the policy is applied. ## Other responses - `400`: Bad Request - `401`: Unauthorized - `403`: Forbidden ## Changes - **2026-10-15** `7aab863a6daa`: 1 breaking, 2 warning - added `#/components/schemas/InvalidParameterMinimumTime, #/components/schemas/InvalidParameterMaximumTime` to the `invalid_parameters/items/` response property `oneOf` list for the response status `400` - added the new `key_invalid` enum value to the `invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterStandard]/rule` response property for the response status `400` - added the new `unique` enum value to the `invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterStandard]/rule` response property for the response status `400` - …earlier changes not shown [Operation history](https://skmtc.dev/kong/apis/konnect-api-go-sdk/changes/v1/event-gateways/:gatewayId/virtual-clusters/:virtualClusterId/consume-policies/:policyId/put.md) --- [API](https://skmtc.dev/kong/apis/konnect-api-go-sdk.md) · [All operations](https://skmtc.dev/kong/apis/konnect-api-go-sdk/llms.txt) · [OpenAPI document](https://skmtc.dev/kong/apis/konnect-api-go-sdk/revisions/7aab863a6daa?raw)