---
title: "Update desktop policy"
method: PATCH
path: "/v1/desktop-policies/{desktopPolicyId}"
tags: ["Desktop Policies"]
---

# Update desktop policy

`PATCH /v1/desktop-policies/{desktopPolicyId}`

Rewrites one desktop policy. The full write body is required: the policy document is replaced (access, execution, and onboarding prompts omitted from it are carried over from the stored document) and the member, team, and role assignments are replaced with the ones sent. The default policy keeps its name, priority, and assignments and cannot be disabled (400 default_policy_required).

## Path parameters

- `desktopPolicyId` string, typeid, required

## Request body

- object
  - `policyName` string, required
  - `policy` DenDesktopPolicyDocumentWrite, required
    - `allowCustomProviders` boolean
    - `allowZenModel` boolean
    - `allowMultipleWorkspaces` boolean
    - `allowControlSettings` boolean
    - `allowManageExtensions` boolean
    - `allowBuiltInExtensions` boolean
    - `allowAlphaUpdates` boolean
    - `showWelcomePage` boolean
    - `access` object
      - `mode` 'custom' | 'locked', required
      - `capabilities` DenDesktopPolicyValue, required
        - `allowCustomProviders` boolean
        - `allowZenModel` boolean
        - `allowMultipleWorkspaces` boolean
        - `allowControlSettings` boolean
        - `allowManageExtensions` boolean
        - `allowBuiltInExtensions` boolean
        - `allowAlphaUpdates` boolean
        - `showWelcomePage` boolean
    - `execution` object
      - `commands` 'allow' | 'deny'
      - `blockedCommands` string[]
      - `browserOrigins` string[]
      - `blockBrowserUploads` boolean
    - `onboardingPrompts` string[], nullable
    - `onboardingPromptDescriptions` string[], nullable
  - `priority` integer
  - `isEnabled` boolean
  - `memberIds` string[]
  - `teamIds` string[]
  - `roles` string[]

## Response `200`

Desktop policy updated successfully.

- DesktopPolicyResponse
  - `desktopPolicy` object, required

## Other responses

- `400` — The desktop policy request was invalid.
- `401` — The caller must be signed in to update desktop policies.
- `402` — Desktop policy management requires an Enterprise plan.
- `403` — Only workspace owners and super-admins can update desktop policies.
- `404` — The policy or a referenced resource was not found.

## Changes

- **2026-09-11** `bb8ff73e4ad3` — 2 info
  - the endpoint scheme security `bearerAuth` was added to the API
  - the endpoint scheme security `denApiKey` was added to the API
- **2026-09-07** `ffcccb610e8a` — 1 info
  - added the new optional request property `policy/execution`
- **2026-09-05** `cb34559d4b4d` — 1 info
  - added the new optional request property `policy/access`
- **2026-09-04** `d3984673ccd1` — 1 info
  - added the optional property `capability` to the response with the `400` status
- **2026-08-20** `93df40e2efd5` — 3 info
  - removed the pattern `^dpo_.*` from the `path` request parameter `desktopPolicyId`
  - removed the pattern `^om_.*` from the request property `memberIds/items/`
  - removed the pattern `^tem_.*` from the request property `teamIds/items/`

[Change history](https://skmtc.dev/openworklabs/apis/den-api/changes/v1/desktop-policies/:desktopPolicyId/patch.md)

---

[API](https://skmtc.dev/openworklabs/apis/den-api.md) · [All operations](https://skmtc.dev/openworklabs/apis/den-api/llms.txt) · [OpenAPI document](https://skmtc.dev/openworklabs/apis/den-api/revisions/d76883ffb5c4?raw)