--- title: "Update Produce Policy for Virtual Cluster" method: PUT path: "/v1/event-gateways/{gatewayId}/virtual-clusters/{virtualClusterId}/produce-policies/{policyId}" tags: ["Event Gateway Virtual Cluster Produce Policies"] --- # Update Produce Policy for Virtual Cluster `PUT /v1/event-gateways/{gatewayId}/virtual-clusters/{virtualClusterId}/produce-policies/{policyId}` ## Request - Base URL: `https://global.api.konghq.com` - URL: `https://global.api.konghq.com/v1/event-gateways/{gatewayId}/virtual-clusters/{virtualClusterId}/produce-policies/{policyId}` - Auth: one of: - HTTP bearer - HTTP bearer - HTTP bearer - HTTP bearer Updates an existing produce policy associated with the specified Event Gateway virtual cluster. ## Request body - union: The typed schema of the produce policy to modify it. - EventGatewayProduceSchemaValidationPolicy: A policy that validates produce messages against a schema registry. - `type` 'schema_validation', required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `config` union, required: The configuration of the produce schema validation policy. - EventGatewayProduceSchemaValidationPolicySchemaRegistryConfig: The configuration of the produce schema validation policy when using a schema registry. - `schema_registry` union: A reference to a schema Registry. - object - `id` string, uuid, required: The unique identifier of the schema registry. - object: Reference a schema registry by its unique name. - `name` string, required: The unique name of the schema registry. - `failure_mode` 'reject' | 'passthrough' | 'mark': Describes how to handle a failure in a policy applied to produced records. * `reject` - rejects the record batch. * `passthrough` - passes the record silently to the backend cluster even though policy execution failed. * `mark` - passes the record to the backend cluster but marks it with a `kong/policy-failure-` header whose value is the reason for the policy failure (truncated to 512 characters). **Requires a minimum runtime version of `1.2`**. - `validate_key` boolean: If true, validate the record key. **Requires a minimum runtime version of `1.2`**. - `validate_value` boolean: If true, validate the record value. **Requires a minimum runtime version of `1.2`**. - `key_validation_action` 'reject' | 'mark': Defines a behavior when record key is not valid. * reject - rejects a batch for topic partition. Only available for produce. * mark - marks a record with kong/server header and client ID value to help to identify the clients violating schema. - `value_validation_action` 'reject' | 'mark': Defines a behavior when record value is not valid. * reject - rejects a batch for topic partition. Only available for produce. * mark - marks a record with kong/server header and client ID value to help to identify the clients violating schema. - `type` 'confluent_schema_registry', required - EventGatewayProduceSchemaValidationPolicyJsonConfig: The configuration of the produce schema validation policy when using JSON parsing without schema. - `schema_registry` union: A reference to a schema Registry. - object - `id` string, uuid, required: The unique identifier of the schema registry. - object: Reference a schema registry by its unique name. - `name` string, required: The unique name of the schema registry. - `failure_mode` 'reject' | 'passthrough' | 'mark': Describes how to handle a failure in a policy applied to produced records. * `reject` - rejects the record batch. * `passthrough` - passes the record silently to the backend cluster even though policy execution failed. * `mark` - passes the record to the backend cluster but marks it with a `kong/policy-failure-` header whose value is the reason for the policy failure (truncated to 512 characters). **Requires a minimum runtime version of `1.2`**. - `validate_key` boolean: If true, validate the record key. **Requires a minimum runtime version of `1.2`**. - `validate_value` boolean: If true, validate the record value. **Requires a minimum runtime version of `1.2`**. - `key_validation_action` 'reject' | 'mark': Defines a behavior when record key is not valid. * reject - rejects a batch for topic partition. Only available for produce. * mark - marks a record with kong/server header and client ID value to help to identify the clients violating schema. - `value_validation_action` 'reject' | 'mark': Defines a behavior when record value is not valid. * reject - rejects a batch for topic partition. Only available for produce. * mark - marks a record with kong/server header and client ID value to help to identify the clients violating schema. - `type` 'json', required - EventGatewayProduceSchemaValidationPolicyInlineSchemaConfig: The configuration of the produce schema validation policy when using an inline schema. **Requires a minimum runtime version of `1.3`**. - `schema_registry` union: A reference to a schema Registry. - object - `id` string, uuid, required: The unique identifier of the schema registry. - object: Reference a schema registry by its unique name. - `name` string, required: The unique name of the schema registry. - `failure_mode` 'reject' | 'passthrough' | 'mark': Describes how to handle a failure in a policy applied to produced records. * `reject` - rejects the record batch. * `passthrough` - passes the record silently to the backend cluster even though policy execution failed. * `mark` - passes the record to the backend cluster but marks it with a `kong/policy-failure-` header whose value is the reason for the policy failure (truncated to 512 characters). **Requires a minimum runtime version of `1.2`**. - `validate_key` boolean: If true, validate the record key. **Requires a minimum runtime version of `1.2`**. - `validate_value` boolean: If true, validate the record value. **Requires a minimum runtime version of `1.2`**. - `key_validation_action` 'reject' | 'mark': Defines a behavior when record key is not valid. * reject - rejects a batch for topic partition. Only available for produce. * mark - marks a record with kong/server header and client ID value to help to identify the clients violating schema. - `value_validation_action` 'reject' | 'mark': Defines a behavior when record value is not valid. * reject - rejects a batch for topic partition. Only available for produce. * mark - marks a record with kong/server header and client ID value to help to identify the clients violating schema. - `type` 'inline_schema', required - `condition` string: A string containing the boolean expression that determines whether the policy is applied. - EventGatewayModifyHeadersPolicy: A policy that modifies headers for requests. - `type` 'modify_headers', required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `config` object, required: The configuration of the modify headers policy. - `actions` EventGatewayModifyHeaderAction[]: Actions are run in sequential order and act on individual headers. - union: An action that modifies a header. - EventGatewayModifyHeaderRemoveAction: An action that removes a header by key. - `op` 'remove', required - `key` string, required: The key of the header to remove. - EventGatewayModifyHeaderSetAction: An action that sets a header key and value. - `op` 'set', required - `key` string, required: The key of the header to set. - `value` string, required: The value of the header to set. - `condition` string: A string containing the boolean expression that determines whether the policy is applied. When the policy is applied as a child policy of schema_validation, the expression can also reference `record.value` fields. - EventGatewayEncryptPolicy: Encrypts Kafka records or keys using AES_256_GCM. Keys are therefore 256 bits long. - `type` 'encrypt', required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `config` EventGatewayEncryptConfig, required: The configuration of the encrypt policy. - `failure_mode` 'error' | 'passthrough', required: Describes how to handle failing encryption or decryption. Use `error` if the record should be rejected if encryption or decryption fails. Use `passthrough` to ignore encryption or decryption failure and continue proxying the record. - `part_of_record` EncryptionRecordPart[], required: Describes the parts of a record to encrypt. - `encryption_key` union, required: The key to use for encryption. - EncryptionKeyAWS: The AWS KMS key to use for encryption. - `type` 'aws', required - `arn` string, required: The AWS KMS key ARN. - EncryptionKeyStatic: A static encryption key. - `type` 'static', required - `key` union, required: A static encryption key reference, either by ID or by value. - object: A static encryption key reference by ID. - … - object: A static encryption key reference by name. - … - `condition` string: A string containing the boolean expression that determines whether the policy is applied. - EventGatewayParsedRecordEncryptFieldsPolicy: Encrypts fields of parsed Kafka records using AES_256_GCM. Keys are therefore 256 bits long. Note this policy can only be used as a child of a `EventGatewayProduceSchemaValidationPolicy` policy. **Requires a minimum runtime version of `1.2`**. - `type` 'encrypt_fields', required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `config` EventGatewayParsedRecordEncryptFieldsConfig, required: The configuration of the encrypt parsed record policy. - `failure_mode` 'reject' | 'passthrough' | 'mark', required: Describes how to handle a failure in a policy applied to produced records. * `reject` - rejects the record batch. * `passthrough` - passes the record silently to the backend cluster even though policy execution failed. * `mark` - passes the record to the backend cluster but marks it with a `kong/policy-failure-` header whose value is the reason for the policy failure (truncated to 512 characters). **Requires a minimum runtime version of `1.2`**. - `encrypt_fields` EventGatewayParsedRecordEncryptionSelector[], required: Selects which fields to encrypt and with what keys. - `paths` union, required: Selects which fields of the parsed record to encrypt. A maximum of 50 path entries are allowed. - object[] - `match` string, required: A field selector. It can select nested fields and array entries. Currently supported are exact matches. - string: This expression should evaluate to an array of exact field paths, equivalent to the `match` values in the array variant. - `encryption_key` union, required: The key to use for encryption. - EncryptionKeyAWS: The AWS KMS key to use for encryption. - `type` 'aws', required - `arn` string, required: The AWS KMS key ARN. - EncryptionKeyStatic: A static encryption key. - `type` 'static', required - `key` union, required: A static encryption key reference, either by ID or by value. - … - `condition` string: A string containing the boolean expression that determines whether the policy is applied. When the policy is applied as a child policy of schema_validation, the expression can also reference `record.value` fields. - EventGatewayParsedRecordTranscodeProducePolicy: Converts an already schema-validated record value into a different serialization format before it is produced to the backend cluster. Note this policy can only be used as a child of a `EventGatewayProduceSchemaValidationPolicy` policy. **Requires a minimum runtime version of `1.3`**. - `type` 'transcode', required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `config` union, required: The configuration of the transcode parsed record policy applied to produced records. - EventGatewayParsedRecordTranscodeProduceConfigJson: The configuration of the transcode parsed record policy when converting produced records to JSON. - `failure_mode` 'reject' | 'passthrough' | 'mark', required: Describes how to handle a failure in a policy applied to produced records. * `reject` - rejects the record batch. * `passthrough` - passes the record silently to the backend cluster even though policy execution failed. * `mark` - passes the record to the backend cluster but marks it with a `kong/policy-failure-` header whose value is the reason for the policy failure (truncated to 512 characters). **Requires a minimum runtime version of `1.2`**. - `schema_source` union: Determines how to look up the schema to use for the transcoded output data. Leave this unset if the output data schema isn't needed. - EventGatewayParsedRecordTranscodeSchemaSourceReference: References a schema registered in a schema registry, computing the subject and version to use. - `type` 'reference', required - `schema_registry` union: A reference to a schema Registry. - … - `subject` string: An expression that computes the schema registry subject of the output data's schema. - `version` string: An expression that computes the schema registry version of the output data's schema. - EventGatewayParsedRecordTranscodeSchemaSourceInline: A schema embedded directly in the policy configuration. - `type` 'inline', required - `inline` string, required: The raw schema text (e.g. an Avro JSON schema) to use for the transcoded output data. - `schema_ref_destination` union, required: Defines how to record the schema id for the transcoded output data. See the [Confluent docs](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format) for more about the wire format. - EventGatewayParsedRecordTranscodeSchemaRefDestinationConfluentFormat: Prefixes the structured data bytes with a reference to the schema. - `type` 'confluent_format', required - EventGatewayParsedRecordTranscodeSchemaRefDestinationRecordHeader: Puts the schema reference in a record header. - `type` 'record_header', required - `record_header` object - … - EventGatewayParsedRecordTranscodeSchemaRefDestinationNone: Do not persist the schema anywhere. - `type` 'none', required - `output_format` 'json', required: The serialization format to convert the record value into. - EventGatewayParsedRecordTranscodeProduceConfigAvro: The configuration of the transcode parsed record policy when converting produced records to Avro. Avro requires a schema to serialize the record value, so `schema_source` must be set. - `failure_mode` 'reject' | 'passthrough' | 'mark', required: Describes how to handle a failure in a policy applied to produced records. * `reject` - rejects the record batch. * `passthrough` - passes the record silently to the backend cluster even though policy execution failed. * `mark` - passes the record to the backend cluster but marks it with a `kong/policy-failure-` header whose value is the reason for the policy failure (truncated to 512 characters). **Requires a minimum runtime version of `1.2`**. - `schema_source` union, required: Determines how to look up the schema to use for the transcoded output data. Leave this unset if the output data schema isn't needed. - EventGatewayParsedRecordTranscodeSchemaSourceReference: References a schema registered in a schema registry, computing the subject and version to use. - `type` 'reference', required - `schema_registry` union: A reference to a schema Registry. - … - `subject` string: An expression that computes the schema registry subject of the output data's schema. - `version` string: An expression that computes the schema registry version of the output data's schema. - EventGatewayParsedRecordTranscodeSchemaSourceInline: A schema embedded directly in the policy configuration. - `type` 'inline', required - `inline` string, required: The raw schema text (e.g. an Avro JSON schema) to use for the transcoded output data. - `schema_ref_destination` union, required: Defines how to record the schema id for the transcoded output data. See the [Confluent docs](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format) for more about the wire format. - EventGatewayParsedRecordTranscodeSchemaRefDestinationConfluentFormat: Prefixes the structured data bytes with a reference to the schema. - `type` 'confluent_format', required - EventGatewayParsedRecordTranscodeSchemaRefDestinationRecordHeader: Puts the schema reference in a record header. - `type` 'record_header', required - `record_header` object - … - EventGatewayParsedRecordTranscodeSchemaRefDestinationNone: Do not persist the schema anywhere. - `type` 'none', required - `output_format` 'avro', required: The serialization format to convert the record value into. - `condition` string: A string containing the boolean expression that determines whether the policy is applied. When the policy is applied as a child policy of schema_validation, the expression can also reference `record.value` fields. - EventGatewayParsedRecordMaskFieldsProducePolicy: Redacts string fields of parsed Kafka records using a configurable masking strategy. Only string fields may be selected. Selecting a field that does not exist is ignored; selecting a field that is not a string is a policy error handled by `failure_mode`. Note this policy can only be used as a child of a `EventGatewayProduceSchemaValidationPolicy` policy. **Requires a minimum runtime version of `1.3`**. - `type` 'mask_fields', required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `config` EventGatewayParsedRecordMaskFieldsProduceConfig, required: The configuration of the mask record fields produce policy. - `failure_mode` 'reject' | 'passthrough' | 'mark', required: Describes how to handle a failure in a policy applied to produced records. * `reject` - rejects the record batch. * `passthrough` - passes the record silently to the backend cluster even though policy execution failed. * `mark` - passes the record to the backend cluster but marks it with a `kong/policy-failure-` header whose value is the reason for the policy failure (truncated to 512 characters). **Requires a minimum runtime version of `1.2`**. - `mask_fields` EventGatewayParsedRecordMaskSelector[], required: Selects which fields to mask and how to mask them. - `paths` union, required: Selects which fields of the parsed record to mask. A maximum of 50 path entries are allowed. - object[] - `match` string, required: A field selector. It can select nested fields and array entries. Currently supported are exact matches. - string: This expression should evaluate to an array of exact field paths, equivalent to the `match` values in the array variant. - `strategy` union, required: The strategy used to redact a matched field value. - EventGatewayMaskStrategyKeepChars: Keeps a number of leading and/or trailing characters and replaces the middle with a fixed phrase. If `first + last` is greater than or equal to the value length, the whole value is replaced with the phrase, so it never shows more characters than the original value. The phrase is fixed, so the masked output does not leak the value length. - `type` 'keep_chars', required - `keep_chars` object, required - … - EventGatewayMaskStrategyEmail: Masks an email address by applying a separate strategy to the local part and to the domain. - `type` 'email', required - `email` object, required - … - EventGatewayMaskStrategyReplace: Replaces the whole value with a fixed phrase. The masked length does not reflect the original value length. - `type` 'replace', required - `replace` object, required - … - `condition` string: A string containing the boolean expression that determines whether the policy is applied. When the policy is applied as a child policy of schema_validation, the expression can also reference `record.value` fields. ## Response `200` Updated produce policy object. - EventGatewayPolicy: A policy associated with an Event Gateway. - `type` string, required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `id` string, uuid, required: The unique identifier of the policy. - `config` object: The configuration of the policy. - `created_at` string, date-time, required: An ISO-8601 timestamp representation of entity creation date. - `parent_policy_id` string, uuid, nullable: The unique identifier of the parent policy, if any. - `updated_at` string, date-time, required: An ISO-8601 timestamp representation of entity update date. - `condition` string: A string containing the boolean expression that determines whether the policy is applied. ## Other responses - `400`: Bad Request - `401`: Unauthorized - `403`: Forbidden ## Changes - **2026-10-15** `7aab863a6daa`: 1 breaking, 2 warning - added `#/components/schemas/InvalidParameterMinimumTime, #/components/schemas/InvalidParameterMaximumTime` to the `invalid_parameters/items/` response property `oneOf` list for the response status `400` - added the new `key_invalid` enum value to the `invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterStandard]/rule` response property for the response status `400` - added the new `unique` enum value to the `invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterStandard]/rule` response property for the response status `400` - …earlier changes not shown [Operation history](https://skmtc.dev/kong/apis/konnect-api-go-sdk/changes/v1/event-gateways/:gatewayId/virtual-clusters/:virtualClusterId/produce-policies/:policyId/put.md) --- [API](https://skmtc.dev/kong/apis/konnect-api-go-sdk.md) · [All operations](https://skmtc.dev/kong/apis/konnect-api-go-sdk/llms.txt) · [OpenAPI document](https://skmtc.dev/kong/apis/konnect-api-go-sdk/revisions/7aab863a6daa?raw)