> For the complete documentation index, see [llms.txt](https://docs.flashback.tech/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flashback.tech/support-reference/platform-api-reference/ai-apis/ai-policy/put__policy_-policyid.md).

# put\_\_policy\_{policyId}

⚠️ TEST ENVIRONMENT ONLY

{% hint style="info" %}
This API endpoint is currently available only in the TEST environment. It is not yet available in production.
{% endhint %}

`PUT /policy/{policyId}`

*Update AI Policy*

Update an existing AI governance policy. This endpoint allows modification of policy properties while maintaining audit trail information about who made the changes.

**Updatable Fields:**

* `name` - Policy name
* `content` - Policy rules and description
* `riskType` - Risk classification (LOW, MEDIUM, HIGH)
* `actionType` - Action to take on violation (0=log, 1=alert, 2=block)

**Important Notes:**

* All fields in the request body are optional - only provide fields you want to update
* At least one field must be provided for the update to proceed
* Users must have write permissions for the policy based on its scope level
* The policy's scope (org/workspace/repo) cannot be changed after creation
* Updates automatically track the user who made the change and the timestamp

**Security:**

* Organization boundaries are enforced
* Permission checks ensure users can only update policies they have access to
* Workspace-level and repository-level policies require appropriate write access
* Audit trail is automatically updated

**Use Cases:**

* Refine policy content based on feedback
* Adjust risk levels or action types
* Update policy names for better organization
* Modify policies as requirements change

#### TypeScript Client Library

```typescript
public updatePolicy = async (
  policyId: string,
  data: UpdatePolicyRequest
): Promise<{ success: boolean; policy: PolicyDTO }> => {
  return this.makeRequest<{ success: boolean; policy: PolicyDTO }>(`policy/${policyId}`, 'PUT', data);
};
```

#### Code Samples

{% tabs %}
{% tab title="Shell" %}

```shell
# You can also use wget
curl -X PUT https://backend.flashback.tech/policy/{policyId} \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer {access-token}'
```

{% endtab %}

{% tab title="HTTP" %}

```http
PUT https://backend.flashback.tech/policy/{policyId} HTTP/1.1
Host: backend.flashback.tech
Content-Type: application/json
Accept: application/json
```

{% endtab %}

{% tab title="JavaScript" %}

```javascript
const inputBody = '{
  "name": "Updated PII Protection Policy",
  "riskType": "HIGH",
  "actionType": 2
}';
const headers = {
  'Content-Type':'application/json',
  'Accept':'application/json',
  'Authorization':'Bearer {access-token}'
};

fetch('https://backend.flashback.tech/policy/{policyId}',
{
  method: 'PUT',
  body: inputBody,
  headers: headers
})
.then(function(res) {
    return res.json();
}).then(function(body) {
    console.log(body);
});
```

{% endtab %}

{% tab title="Ruby" %}

```ruby
require 'rest-client'
require 'json'

headers = {
  'Content-Type' => 'application/json',
  'Accept' => 'application/json',
  'Authorization' => 'Bearer {access-token}'
}

result = RestClient.put 'https://backend.flashback.tech/policy/{policyId}',
  params: {
  }, headers: headers

p JSON.parse(result)
```

{% endtab %}

{% tab title="Python" %}

```python
import requests
headers = {
  'Content-Type': 'application/json',
  'Accept': 'application/json',
  'Authorization': 'Bearer {access-token}'
}

r = requests.put('https://backend.flashback.tech/policy/{policyId}', headers = headers)

print(r.json())
```

{% endtab %}

{% tab title="PHP" %}

```php
<?php

require 'vendor/autoload.php';

$headers = array(
    'Content-Type' => 'application/json',
    'Accept' => 'application/json',
    'Authorization' => 'Bearer {access-token}',
);
```

{% endtab %}

{% tab title="Java" %}

```java
URL obj = new URL("https://backend.flashback.tech/policy/{policyId}");
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
con.setRequestMethod("PUT");
int responseCode = con.getResponseCode();
BufferedReader in = new BufferedReader(
    new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
    response.append(inputLine);
}
in.close();
System.out.println(response.toString());
```

{% endtab %}

{% tab title="Go" %}

```go
package main

import (
       "bytes"
       "net/http"
)

func main() {

    headers := map[string][]string{
        "Content-Type": []string{"application/json"},
        "Accept": []string{"application/json"},
        "Authorization": []string{"Bearer {access-token}"},
    }

    data := bytes.NewBuffer([]byte{jsonReq})
    req, err := http.NewRequest("PUT", "https://backend.flashback.tech/policy/{policyId}", data)
    req.Header = headers

    client := &http.Client{}
    resp, err := client.Do(req)
    // ...
}
```

{% endtab %}
{% endtabs %}

> Body parameter

```json
{
  "name": "Updated PII Protection Policy",
  "content": "Enhanced policy: Do not allow sharing of personally identifiable information including SSN, credit cards, addresses, phone numbers, or email addresses.",
  "riskType": "HIGH",
  "actionType": 2
}
```

#### Parameters <a href="#put__policy_-policyid-parameters" id="put__policy_-policyid-parameters"></a>

| Name         | In   | Type    | Required | Description                                     |
| ------------ | ---- | ------- | -------- | ----------------------------------------------- |
| policyId     | path | string  | true     | Unique identifier of the policy                 |
| body         | body | object  | true     | Updated policy properties                       |
| » name       | body | string  | false    | Human-readable name for the policy              |
| » content    | body | string  | false    | Policy rules and description (natural language) |
| » riskType   | body | string  | false    | Risk classification level                       |
| » actionType | body | integer | false    | Action to take when policy is violated          |

**Enumerated Values**

| Parameter  | Value  |
| ---------- | ------ |
| » riskType | LOW    |
| » riskType | MEDIUM |
| » riskType | HIGH   |

| Parameter    | Value | Description                      |
| ------------ | ----- | -------------------------------- |
| » actionType | 0     | Log only (record violation)      |
| » actionType | 1     | Alert (log and notify)           |
| » actionType | 2     | Block (prevent action and alert) |

> Example responses

> 200 Response

```json
{
  "success": true,
  "policy": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "orgId": "org-123",
    "name": "Updated PII Protection Policy",
    "content": "Enhanced policy: Do not allow sharing of personally identifiable information...",
    "riskType": "HIGH",
    "actionType": 2,
    "createdBy": {
      "id": "user-789",
      "name": "John",
      "lastName": "Doe",
      "email": "john.doe@example.com"
    },
    "createdAt": "2024-01-15T10:30:00.000Z",
    "lastUpdatedBy": {
      "id": "user-890",
      "name": "Jane",
      "lastName": "Smith",
      "email": "jane.smith@example.com"
    },
    "lastUpdatedAt": "2024-01-20T14:15:00.000Z",
    "workspaceId": "workspace-456",
    "repoId": null,
    "workspace": {
      "id": "workspace-456",
      "name": "Production Workspace"
    },
    "repo": null
  }
}
```

#### Responses <a href="#put__policy_-policyid-responses" id="put__policy_-policyid-responses"></a>

| Status | Meaning                                                                    | Description                 | Schema |
| ------ | -------------------------------------------------------------------------- | --------------------------- | ------ |
| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1)                    | Policy updated successfully | Inline |
| 400    | [Bad Request](https://tools.ietf.org/html/rfc7231#section-6.5.1)           | Validation error            | Inline |
| 403    | [Forbidden](https://tools.ietf.org/html/rfc7231#section-6.5.3)             | Insufficient permissions    | Inline |
| 404    | [Not Found](https://tools.ietf.org/html/rfc7231#section-6.5.4)             | Policy not found            | Inline |
| 500    | [Internal Server Error](https://tools.ietf.org/html/rfc7231#section-6.6.1) | Failed to update policy     | Inline |

#### Response Schema <a href="#put__policy_-policyid-responseschema" id="put__policy_-policyid-responseschema"></a>

Status Code **200**

| Name             | Type    | Required | Restrictions | Description                                  |
| ---------------- | ------- | -------- | ------------ | -------------------------------------------- |
| » success        | boolean | false    | none         | Operation success status                     |
| » policy         | object  | false    | none         | Updated policy object                        |
| »» id            | string  | false    | none         | Unique identifier for the policy             |
| »» orgId         | string  | false    | none         | Organization ID                              |
| »» name          | string  | false    | none         | Policy name                                  |
| »» content       | string  | false    | none         | Policy content/rules                         |
| »» riskType      | string  | false    | none         | Risk classification (LOW, MEDIUM, HIGH)      |
| »» actionType    | integer | false    | none         | Action type (0=log, 1=alert, 2=block)        |
| »» createdBy     | object  | false    | none         | User who created the policy                  |
| »»» id           | string  | false    | none         | User ID                                      |
| »»» name         | string  | false    | none         | User first name                              |
| »»» lastName     | string  | false    | none         | User last name                               |
| »»» email        | string  | false    | none         | User email                                   |
| »» createdAt     | string  | false    | none         | ISO 8601 timestamp                           |
| »» lastUpdatedBy | object  | false    | none         | User who last updated the policy             |
| »»» id           | string  | false    | none         | User ID                                      |
| »»» name         | string  | false    | none         | User first name                              |
| »»» lastName     | string  | false    | none         | User last name                               |
| »»» email        | string  | false    | none         | User email                                   |
| »» lastUpdatedAt | string  | false    | none         | ISO 8601 timestamp                           |
| »» workspaceId   | string  | false    | none         | Workspace ID (null for org-level)            |
| »» repoId        | string  | false    | none         | Repository ID (null for workspace/org-level) |
| »» workspace     | object  | false    | none         | Workspace details (if applicable)            |
| »»» id           | string  | false    | none         | Workspace ID                                 |
| »»» name         | string  | false    | none         | Workspace name                               |
| »» repo          | object  | false    | none         | Repository details (if applicable)           |
| »»» id           | string  | false    | none         | Repository ID                                |
| »»» name         | string  | false    | none         | Repository name                              |

Status Code **400**

| Name      | Type    | Required | Restrictions | Description   |
| --------- | ------- | -------- | ------------ | ------------- |
| » success | boolean | false    | none         | none          |
| » message | string  | false    | none         | Error message |

Status Code **403**

| Name      | Type    | Required | Restrictions | Description   |
| --------- | ------- | -------- | ------------ | ------------- |
| » success | boolean | false    | none         | none          |
| » message | string  | false    | none         | Error message |

Status Code **404**

| Name      | Type    | Required | Restrictions | Description   |
| --------- | ------- | -------- | ------------ | ------------- |
| » success | boolean | false    | none         | none          |
| » message | string  | false    | none         | Error message |

Status Code **500**

| Name      | Type    | Required | Restrictions | Description   |
| --------- | ------- | -------- | ------------ | ------------- |
| » success | boolean | false    | none         | none          |
| » message | string  | false    | none         | Error message |

To perform this operation, you must be authenticated by means of one of the following methods: BearerAuth


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.flashback.tech/support-reference/platform-api-reference/ai-apis/ai-policy/put__policy_-policyid.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.