---
title: "Update app usage policy"
method: POST
path: "/user_risk/apps/usage_policy/update"
tags: ["userrisk"]
---

# Update app usage policy

`POST /user_risk/apps/usage_policy/update`

## Request

- Base URL: `https://cyber-risk.upguard.com/api/public`
- URL: `https://cyber-risk.upguard.com/api/public/user_risk/apps/usage_policy/update`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/docs/user_risk/apps/usage_policy/update/post.ts> (a function with typed inputs; its response is checked against the schema)

Set or update the usage policy for a specific app in your organization.

This endpoint replaces the app's entire usage policy instead of merging with it. It
removes any custom rule that isn't included in `custom_rules`, so a request that omits
`custom_rules` clears all existing custom rules for the app.

Valid `base_rule` and `custom_rules` outcome values are `approve`, `tolerate`,
`nudge`, and `block`. Custom rule outcomes must differ from the base rule, and a
team, role, or user must not appear in more than one custom rule.

`app_name` must match an app already discovered in your organization, and every value in
`team_names`, `role_names`, and `user_emails` must match an existing team, role, or
monitored user in your organization. Unrecognized values return a 422 response rather
than being ignored.

Apps that were admin-consented through Microsoft Entra are always approved and
reject usage policy updates.

Required API key permissions: `User Risk` + `ReadWrite` (select when creating API key in Account Settings)

## Request body

- UserRiskAppUsagePolicyUpdateBody
  - `app_name` string, required: The name of the app the usage policy applies to. Case-insensitive.
  - `base_rule` 'approve' | 'tolerate' | 'nudge' | 'block', string, required: The outcome applied to users of the app by default, unless overridden by a custom rule.
  - `custom_rules` object: Custom rules that override the base rule for specific teams, roles, or users, keyed by the outcome they apply. This value replaces all existing custom rules for the app instead of merging into them.
  - `note` string: An optional note describing the policy change, shown on the app's timeline.

## Response `204`

Successful response is empty

## Other responses

- `403`: Your API key does not have permission to perform this action.
- `422`: An invalid parameter was supplied or a mandatory parameter was missing
- `429`: Too many requests have been made to this endpoint.
- `500`: An internal system error occurred

---

[API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)