---
title: "Update Cluster Policy for Virtual Cluster"
method: PUT
path: "/v1/event-gateways/{gatewayId}/virtual-clusters/{virtualClusterId}/cluster-policies/{policyId}#Acls"
tags: ["Event Gateway Virtual Cluster Policies"]
---

# Update Cluster Policy for Virtual Cluster

`PUT /v1/event-gateways/{gatewayId}/virtual-clusters/{virtualClusterId}/cluster-policies/{policyId}#Acls`

## Request

- Base URL: `https://global.api.konghq.com`
- URL: `https://global.api.konghq.com/v1/event-gateways/{gatewayId}/virtual-clusters/{virtualClusterId}/cluster-policies/{policyId}#Acls`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer
  - HTTP bearer
  - HTTP bearer
- TypeScript: <https://skmtc.dev/kong/apis/konnect-api/docs/v1/event-gateways/:gatewayId/virtual-clusters/:virtualClusterId/cluster-policies/:policyId%23Acls/put.ts> (a function with typed inputs; its response is checked against the schema)

Updates an existing cluster-level policy associated with the specified Event Gateway virtual cluster.

## Request body

- EventGatewayACLsPolicy: Apply Kafka ACLs to virtual cluster traffic.
  - `type` 'acls', required: The type name of the policy.
  - `name` string: A unique user-defined name of the policy.
  - `description` string: A human-readable description of the policy.
  - `enabled` boolean: Whether the policy is enabled.
  - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
  - `config` EventGatewayACLPolicyConfig, required: Apply ACLs to virtual cluster traffic.
    - `rules` EventGatewayACLRule[], required: Every ACL rule in this list applies independently.
      - `resource_type` 'topic' | 'group' | 'transactional_id' | 'cluster', required: This rule applies to access only for type of resource
      - `action` 'allow' | 'deny', required: How to handle the request if the rule matches
      - `operations` EventGatewayACLOperation[], required: Types of Kafka operations to match against. Note that not every operation can apply to every resource type.
        - `name` 'all' | 'alter' | 'alter_configs' | 'create' | 'delete' | 'describe' | 'describe_configs' | 'idempotent_write' | 'read' | 'write', required
      - `resource_names` EventGatewayACLResourceName[], required: If any of these entries match, the resource name matches for this rule. A maximum of 50 entries are allowed.
        - `match` string, glob, required: Currently supported are exact matches and globs. All `*` characters are interpreted as globs, i.e. they match zero or more of any character.
  - `condition` string: A string containing the boolean expression that determines whether the policy is applied.

## Response `200`

Updated cluster-level policy object.

- EventGatewayPolicy: A policy associated with an Event Gateway.
  - `type` string, required: The type name of the policy.
  - `name` string: A unique user-defined name of the policy.
  - `description` string: A human-readable description of the policy.
  - `enabled` boolean: Whether the policy is enabled.
  - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
  - `id` string, uuid, required: The unique identifier of the policy.
  - `config` object, nullable: The configuration of the policy.
  - `created_at` string, date-time, required: An ISO-8601 timestamp representation of entity creation date.
  - `parent_policy_id` string, uuid, nullable: The unique identifier of the parent policy, if any.
  - `updated_at` string, date-time, required: An ISO-8601 timestamp representation of entity update date.
  - `condition` string: A string containing the boolean expression that determines whether the policy is applied.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden

## Changes

- **2026-10-23** `30af8b28f6ef`: 1 breaking, 2 warning
  - added `#/components/schemas/InvalidParameterMinimumTime, #/components/schemas/InvalidParameterMaximumTime` to the `invalid_parameters/items/` response property `oneOf` list for the response status `400`
  - added the new `key_invalid` enum value to the `invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterStandard]/rule` response property for the response status `400`
  - added the new `unique` enum value to the `invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterStandard]/rule` response property for the response status `400`
- **2026-09-30** `f530bf400198`: 2 warning
  - added the new `400.00` enum value to the `status` response property for the response status `400`
  - added the new `403.00` enum value to the `status` response property for the response status `403`
- **2026-09-25** `4a02153f2e60`: 2 breaking, 18 info
  - the response's body type changed from no type to `object` for status `400`
  - the response's body type changed from no type to `object` for status `403`
  - removed `#/components/schemas/BaseError, subschema #2` from the response body `allOf` list for the response status `400`
  - removed `#/components/schemas/BaseError, subschema #2` from the response body `allOf` list for the response status `401`
  - …16 more
- **2026-02-16** `2b2a72c67bd2`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/kong/apis/konnect-api/changes/v1/event-gateways/:gatewayId/virtual-clusters/:virtualClusterId/cluster-policies/:policyId%23Acls/put.md)

---

[API](https://skmtc.dev/kong/apis/konnect-api.md) - [All operations](https://skmtc.dev/kong/apis/konnect-api/llms.txt) - [OpenAPI document](https://skmtc.dev/kong/apis/konnect-api/revisions/f018071a4515?raw)