---
title: "Apply a detection policy"
method: PUT
path: "/api/policies/v2/deployments/{deploymentId}/detection-policy/{product}"
tags: ["PoliciesV2Service"]
---

# Apply a detection policy

`PUT /api/policies/v2/deployments/{deploymentId}/detection-policy/{product}`

## Request

- The document declares no server URL.
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/semgrep/apis/semgrep-web-app/docs/api/policies/v2/deployments/:deploymentId/detection-policy/:product/put.ts> (a function with typed inputs; its response is checked against the schema)

Strictly applies a candidate detection policy bundle for one product: the submitted bundle replaces the current state, and exceptions absent from it are deleted. Requires the current state_version in the If-Match header; responds 428 when the header is missing and 409 with the current state_version when it is stale. The apply is atomic for the product's bundle.

## Path parameters

- `deploymentId` integer, required: The unique numerical identifier for the deployment.
- `product` string, required: The product the bundle applies to. One of: `code`, `secrets`.

## Request body

- ProtosPoliciesV2ApplyDetectionPolicyRequest
  - `bundle` ProtosPoliciesV2DetectionPolicyBundle, required: The full declared detection state for one product. A strict apply replaces the entire bundle: rule selection is overwritten and exceptions absent from the bundle are deleted.
    - `deployment_slug` string: Output only. The slug of the deployment the bundle belongs to. Ignored when sent in a request body.
    - `product` string: The product the bundle applies to. One of: `code`, `secrets`. Optional in request bodies; when present it must match the product in the URL.
    - `rulesets` string[]: Registry ruleset paths that run deployment-wide, for example `p/owasp-top-10`. Must be empty when product is `secrets`.
    - `rules` string[]: Registry rule paths added individually, on top of the selected rulesets.
    - `disabled` string[]: Registry rule paths from the selected rulesets that are explicitly turned off.
    - `exceptions` ProtosPoliciesV2DetectionPolicyException[]: Per-project or per-tag include/exclude exceptions to the deployment-wide rule selection.
      - `exception_type` string, required: Whether the exception forces the rule to run (`include`) or skips it (`exclude`) on the targeted scope.
      - `project` string: The name of the project the exception targets. Mutually exclusive with project_tag_name.
      - `project_tag_name` string: The name of the project tag the exception targets. Treat tag names as opaque strings: they may contain spaces and special characters. Mutually exclusive with project.
      - `rule` string, required: The registry path of the rule or rule pack the exception applies to.
      - `rule_type` string, required: Whether rule refers to a single rule (`rule`) or a rule pack (`pack`).

## Response `200`

OK

- ProtosPoliciesV2ApplyDetectionPolicyResponse
  - `bundle` ProtosPoliciesV2DetectionPolicyBundle: The full declared detection state for one product. A strict apply replaces the entire bundle: rule selection is overwritten and exceptions absent from the bundle are deleted.
    - `deployment_slug` string: Output only. The slug of the deployment the bundle belongs to. Ignored when sent in a request body.
    - `product` string: The product the bundle applies to. One of: `code`, `secrets`. Optional in request bodies; when present it must match the product in the URL.
    - `rulesets` string[]: Registry ruleset paths that run deployment-wide, for example `p/owasp-top-10`. Must be empty when product is `secrets`.
    - `rules` string[]: Registry rule paths added individually, on top of the selected rulesets.
    - `disabled` string[]: Registry rule paths from the selected rulesets that are explicitly turned off.
    - `exceptions` ProtosPoliciesV2DetectionPolicyException[]: Per-project or per-tag include/exclude exceptions to the deployment-wide rule selection.
      - `exception_type` string, required: Whether the exception forces the rule to run (`include`) or skips it (`exclude`) on the targeted scope.
      - `project` string: The name of the project the exception targets. Mutually exclusive with project_tag_name.
      - `project_tag_name` string: The name of the project tag the exception targets. Treat tag names as opaque strings: they may contain spaces and special characters. Mutually exclusive with project.
      - `rule` string, required: The registry path of the rule or rule pack the exception applies to.
      - `rule_type` string, required: Whether rule refers to a single rule (`rule`) or a rule pack (`pack`).
  - `state_version` string: The new state_version of the bundle after the apply.

---

[API](https://skmtc.dev/semgrep/apis/semgrep-web-app.md) - [All operations](https://skmtc.dev/semgrep/apis/semgrep-web-app/llms.txt) - [OpenAPI document](https://skmtc.dev/semgrep/apis/semgrep-web-app/revisions/6483eeecd582?raw)