gateway

Set policies

Replace an environment's gateway policies in a single atomic request. Policies run at the edge before requests reach your app: verify API keys, rate limit, block requests outright, or validate them against your OpenAPI spec.

Policies are an ordered list: the gateway evaluates them top to bottom and the first rejection short-circuits the request.

Each policy sets exactly one of keyauth, ratelimit, firewall or openapi, plus optional match expressions restricting which requests it applies to.

Every call is a full replace: the environment's policies become exactly the request list in the given order, and the server generates a fresh id for each one. An empty list removes all policies. The operation is atomic: if any policy is invalid, nothing is written.

Required Permissions

Your root key must have one of the following permissions:

environment.*.set_policies (for any environment)
environment.<environment_id>.set_policies (for a specific environment)

post/v2/gateway.setPolicies

Request body

projectstring required

Identifies a resource by either its unique ID or its slug. Accepts a prefixed ID (such as 'proj_' or 'app_') or a slug.

appstring required

Identifies a resource by either its unique ID or its slug. Accepts a prefixed ID (such as 'proj_' or 'app_') or a slug.

environmentstring required

Identifies a resource by either its unique ID or its slug. Accepts a prefixed ID (such as 'proj_' or 'app_') or a slug.

Example request

{
  "project": "proj_1234abcd",
  "app": "proj_1234abcd",
  "environment": "proj_1234abcd",
  "policies": [
    {
      "name": "Block internal paths",
      "enabled": true,
      "match": [
        {
          "path": {
            "path": {
              "prefix": "/internal/"
            }
          }
        }
      ],
      "firewall": {
        "action": "ACTION_DENY"
      }
    }
  ]
}

Response

Successfully set the policies.

dataEmptyResponse required

Empty response object by design. A successful response indicates this operation was successfully executed.

Example response

{
  "meta": {
    "requestId": "req_123"
  }
}

Changes

Changed in 4 of the 91 revisions of this API.256

Aug 17, 202668e1a2c609c01See the full diff
- ○
  added the new optional request property policies/items/logging
  new-optional-request-property
Aug 13, 2026a021527e00d21See the full diff
- ○
  added the new optional request property policies/items/keyauth/credits
  new-optional-request-property
Aug 12, 20269bbd42d710cf253See the full diff
- ▲
  added RatelimitIdentifier to the policies/items/ratelimit/identifier request property allOf list
  request-property-all-of-added
- ▲
  the policies/items/ratelimit/identifier request property type/format changed from object/ to /
  request-property-type-changed
- ●
  removed the request property policies/items/ratelimit/identifier/authenticatedSubject
  request-property-removed
- ●
  removed the request property policies/items/ratelimit/identifier/header
  request-property-removed
- ●
  removed the request property policies/items/ratelimit/identifier/path
  request-property-removed
- ●
  removed the request property policies/items/ratelimit/identifier/principalField
  request-property-removed
- ●
  removed the request property policies/items/ratelimit/identifier/remoteIp
  request-property-removed
- ○
  added the new optional request property policies/items/ratelimit/identifiers
  new-optional-request-property
- ○
  the request property policies/items/ratelimit/identifier became optional
  request-property-became-optional
- ○
  request property policies/items/ratelimit/identifier deprecated
  request-property-deprecated
Jul 16, 20261ee061c4f5101See the full diff
- ○
  endpoint added
  endpoint-added

Full history