---
title: "Create or replace an end user's execution policy"
method: PUT
path: "/credits/end-users/{externalUserId}/policy"
tags: ["End users"]
---

# Create or replace an end user's execution policy

`PUT /credits/end-users/{externalUserId}/policy`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/end-users/{externalUserId}/policy`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Workspace owner/admin session or a secret key with tokens:manage. Admission, counters, the credit hold, and the reservation commit atomically. Amounts use the tenant's exact credit denomination.

## Path parameters

- `externalUserId` string, required: Case-sensitive immutable ID in the tenant namespace. Prefer an identity-provider subject, not an email address.

## Request body

- EndUserPolicyInput
  - `mode` 'ask' | 'bounded' | 'unlimited', required
  - `budgetPeriod` 'hour' | 'day' | 'week' | 'month' | 'null', nullable
  - `budgetCredits` string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
  - `maxChargeCredits` string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
  - `allowProviders` string[], nullable
  - `denyProviders` string[], nullable
  - `allowEndpoints` string[], nullable
  - `denyEndpoints` string[], nullable
  - `allowModels` string[], nullable
  - `denyModels` string[], nullable
  - `maxConcurrentReservations` integer, nullable
  - `maxCallsPerPeriod` integer, nullable
  - `maxCallsPerLoop` integer, nullable

## Response `200`

Policy applied

- EndUserPolicyEnvelope
  - `success` unknown, required
  - `externalUserId` string, required: Case-sensitive immutable ID in the tenant namespace. Prefer an identity-provider subject, not an email address.
  - `policy` EndUserPolicy, required
    - `mode` 'ask' | 'bounded' | 'unlimited', required
    - `budgetPeriod` 'hour' | 'day' | 'week' | 'month' | 'null', nullable
    - `budgetCredits` string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
    - `maxChargeCredits` string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
    - `allowProviders` string[], nullable
    - `denyProviders` string[], nullable
    - `allowEndpoints` string[], nullable
    - `denyEndpoints` string[], nullable
    - `allowModels` string[], nullable
    - `denyModels` string[], nullable
    - `maxConcurrentReservations` integer, nullable
    - `maxCallsPerPeriod` integer, nullable
    - `maxCallsPerLoop` integer, nullable
    - `id` string, uuid, required
    - `activeReservations` integer, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required

## Other responses

- `400`: Unknown field or invalid exact-credit/count contract

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)