---
title: "Change a policy rule's action"
method: PATCH
path: "/v1/connectors/policies/{policyRuleId}"
tags: ["Connectors"]
---

# Change a policy rule's action

`PATCH /v1/connectors/policies/{policyRuleId}`

## Request

- Base URL: `https://api.spacefast.com`
- URL: `https://api.spacefast.com/v1/connectors/policies/{policyRuleId}`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://api.spacefast.com/v1/auth/oauth2/authorize`, token URL `https://api.spacefast.com/v1/auth/oauth2/token`; client credentials, token URL `https://api.spacefast.com/v1/auth/oauth2/token`, scopes: `connectors:write`)

Replaces what a rule does. A rule's pattern and owner are fixed — delete it and add the one you meant.

## Path parameters

- `policyRuleId` string, required: Policy rule id.

## Query parameters

- `team` string: Team id or slug to act for. Required only when the credential could act for more than one team.

## Request body

- object
  - `action` 'approve' | 'require_approval' | 'block', required: Replacement action. A rule's pattern and owner are fixed — delete and re-add.

## Response `200`

Response for status 200

- object
  - `$schema` string, uri: Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.
  - `data` object, required: One ordered address-pattern rule. Most restrictive across owners wins.
    - `id` string, required: Policy rule id. Opaque — minted by the policy engine, not a Spacefast resource prefix.
    - `pattern` string, required: `*`, `<connector>/*`, `<connectionId>/*`, or `<connectionId>/<tool>`. First match in order wins.
    - `action` 'approve' | 'require_approval' | 'block', required: What policy does with a call: run it, park it for a person, or refuse it.
    - `owner` 'team' | 'personal', required: Team rules are a floor: a personal rule may tighten one, never loosen it.
    - `position` string, required: Fractional index the engine assigned from the pattern's specificity. Rules evaluate in this order.
    - `createdAt` string, date-time, required

## Other responses

- `default`: Problem details (RFC 9457). Any 4xx/5xx response is one `application/problem+json` document.

---

[API](https://skmtc.dev/spacefast/apis/spacefast-api.md) · [All operations](https://skmtc.dev/spacefast/apis/spacefast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spacefast/apis/spacefast-api/revisions/bd165bc7c983?raw)