Update a gateway policy

Partially updates a gateway policy. Only fields present in the request body are applied; absent fields are left unchanged. policy_type is immutable — to change a policy’s type, delete it and create a new one.

config if supplied must match the policy’s type:

• spend-cap: {"window": ..., "limit_usd": ...}
• guard: {"version": 1, "detect": {...}} Mismatched shapes are rejected with 400.

default_spend_cap cascade: editing a default_spend_cap updates the config/action/enabled/priority on every attached child policy so the template stays the source of truth across rollouts.

PATCH /v1/platform/gateway-policies/{id}

guard

spend_cap

{ "config": {"window": "monthly", "limit_usd": 200}, "enabled": false }

200

{
  "action": "<string>",
  "config": {},
  "created_at": "<string>",
  "created_by": "<string>",
  "current_spend_usd": 123,
  "description": "<string>",
  "enabled": true,
  "id": "<string>",
  "is_system_generated": true,
  "name": "<string>",
  "organization_id": "<string>",
  "parent_policy_id": "<string>",
  "policy_type": "<string>",
  "priority": 123,
  "subject_matchers": [
    {
      "key": "<string>",
      "value": "<string>"
    }
  ],
  "updated_at": "<string>"
}

Authorizations

API KeyBearer Auth

X-API-Key · string · header · required

Path Parameters

id · string<uuid> · required

Policy ID

Body

application/json

action · string

Example:

"block"

config · object

description · string

Example:

"Blocks overspend on the production org"

enabled · boolean

Example:

true

name · string

Example:

"monthly-cap"

priority · integer

Example:

0

subject_matchers · object[]

Show child attributes

Response

200

application/json

OK

action · string

config · object

created_at · string

created_by · string

current_spend_usd · number

CurrentSpendUSD is the spend in the policy's current window. Set for any spend_cap policy regardless of enabled state — disabled policies still surface usage so users can see what would have been counted. Nil for non-spend_cap policies or when the spend lookup failed.

description · string

enabled · boolean

id · string

is_system_generated · boolean

name · string

organization_id · string

parent_policy_id · string

ParentPolicyID is set on materialized children of a default_spend_cap to the default's id, and cleared (NULL) only when an admin Create with the same matchers takes over the materialized row. Update on a child preserves the link; Delete on the parent cascade-soft-deletes every child rather than detaching them.

policy_type · string

priority · integer

subject_matchers · object[]

Show child attributes

updated_at · string