UpdateAuthPolicy

Updates an authentication policy for an organization. Authentication policies define rules for how OIDC tokens are validated and what access they grant, including claim mappings, trust conditions, and role assignments. The policy definition cannot be empty.

The request body contains a policies array where each policy object includes:

• decision: allow or deny
• tokenType: organization, team, personal, or runner
• teamName: required when tokenType is team
• userLogin: required when tokenType is personal
• runnerID: required when tokenType is runner
• authorizedPermissions: array of permissions (only admin is supported for organization tokens)
• rules: object defining claim-matching rules for the token

For more information about authorization rules, refer to the OIDC authorization policies documentation.