UNunkeyed
gateway

Update policy

Changed on

Update a single policy in place without resending the environment's full policy list. The policy keeps its id and its position in the evaluation order, and all other policies are untouched.

Omitted fields keep their stored values; at least one updatable field must be provided. Setting match to null removes all match expressions so the policy applies to every request. Providing one of keyauth, ratelimit, firewall or openapi replaces the policy's rule entirely, including switching its type; at most one may be set.

Policy ids are regenerated whenever gateway.setPolicies replaces the list, so fetch current ids via gateway.listPolicies first.

Required Permissions

Your root key must have one of the following permissions:

  • environment.*.update_policy (for any environment)
  • environment.<environment_id>.update_policy (for a specific environment)
post/v2/gateway.updatePolicy

Request

  • Base URL
    https://api.unkey.com
  • URL
    https://api.unkey.com/v2/gateway.updatePolicy
  • Auth
    HTTP bearer

Request body

projectstring required

Identifies a resource by either its unique ID or its slug. Accepts a prefixed ID (such as 'proj_' or 'app_') or a slug.

appstring required

Identifies a resource by either its unique ID or its slug. Accepts a prefixed ID (such as 'proj_' or 'app_') or a slug.

environmentstring required

Identifies a resource by either its unique ID or its slug. Accepts a prefixed ID (such as 'proj_' or 'app_') or a slug.

policyIdstring required

Id of the policy to update, as returned by gateway.listPolicies. Ids are regenerated whenever gateway.setPolicies replaces the list, so list the policies first if you are unsure the id is current.

namestring

New human-readable name. Omit to keep the current name.

enabledboolean

Enable or disable the policy. Disabled policies are stored but skipped during evaluation. Omit to keep the current setting.

openapiOpenapiPolicy

Validates matching requests against the app's uploaded OpenAPI spec. Has no configuration of its own. If no spec has been uploaded for the deployment, the policy is a no-op and requests pass through unvalidated.

Example request

{
  "project": "proj_1234abcd",
  "app": "proj_1234abcd",
  "environment": "proj_1234abcd",
  "policyId": "pol_9d2Fk1LmQ",
  "match": [
    {
      "path": {
        "path": {
          "prefix": "/api/"
        }
      }
    }
  ],
  "keyauth": {
    "keyspaces": [
      "ks_1234abcd"
    ]
  },
  "ratelimit": {
    "limit": 100,
    "windowMs": 60000,
    "identifiers": [
      {
        "remoteIp": {}
      }
    ]
  },
  "firewall": {
    "action": "ACTION_DENY"
  },
  "openapi": {},
  "logging": {
    "requestHeaders": true,
    "responseHeaders": true,
    "requestBody": true,
    "responseBody": true,
    "query": true
  }
}

Response

Successfully updated the policy.

dataEmptyResponse required

Empty response object by design. A successful response indicates this operation was successfully executed.

Example response

{
  "meta": {
    "requestId": "req_123"
  }
}

Changes

  • 6fee91b79da3Revision changes
    • breaking

      removed the enum value true of the request property ///

    • breaking

      removed the enum value true of the request property ///

  • 2a504dcea6cbRevision changes
    • info

      added the new optional request property //