---
title: "Update"
method: POST
path: "/api/v1/policies/{id}"
tags: ["Policy"]
---

# Update

`POST /api/v1/policies/{id}`

Update a policy by providing a policy object and an update mask.

## Path parameters

- `id` string, required — The ID of the Policy.

## Request body

- C1ApiPolicyV1UpdatePolicyRequestInput — The UpdatePolicyRequest message contains the policy object to update and a field mask to indicate which fields to update. It uses URL value for input.
  - `policy` C1ApiPolicyV1Policy — A policy defines a workflow (sequence of steps) that runs when processing access requests, reviews, or revocations. Policies support conditional routing: different conditions can trigger different step sequences, with a baseline fallback.
    - `annotations` object — Key/value metadata. Up to 16 entries; keys 1-128 chars; values 0-256 chars; URL-safe ASCII. Keys starting with `c1/` are reserved. Updates have PATCH semantics: keys absent from the request are preserved; an empty value deletes the key. Well-known keys: `managed_by`, `iac_workspace`, `iac_resource_address`, `iac_tool_version`.
    - `createdAt` string, date-time
    - `deletedAt` string, date-time
    - `description` string — The description of the Policy.
    - `displayName` string — The display name of the Policy.
    - `id` string — The ID of the Policy.
    - `policySteps` object — A map from string keys to step sequences. One entry is always the baseline, keyed by the lowercased policy_type (e.g., "grant", "revoke", "certify"). Additional entries have opaque keys (UUIDs) and are referenced by the rules array for conditional routing. If no conditional rules are configured, only the baseline entry exists.
    - `policyType` 'POLICY_TYPE_UNSPECIFIED' | 'POLICY_TYPE_GRANT' | 'POLICY_TYPE_REVOKE' | 'POLICY_TYPE_CERTIFY' | 'POLICY_TYPE_ACCESS_REQUEST' | 'POLICY_TYPE_PROVISION' — The type of this policy (grant, revoke, or certify). The lowercased type name (e.g., "grant") is also the key for the baseline entry in policy_steps.
    - `postActions` C1ApiPolicyV1PolicyPostActions[], nullable — Ordered actions to execute after the policy completes processing.
      - `certifyRemediateImmediately` boolean, nullable — Only valid on certify policies. When true, any revocations resulting from the certification are applied immediately when the campaign task closes. This field is part of the `action` oneof. See the documentation for `c1.api.policy.v1.PolicyPostActions` for more details.
    - `reassignTasksToDelegates` boolean — This field is no longer used. Configure delegate reassignment in the policy step instead.
    - `rules` C1ApiPolicyV1Rule[], nullable — Ordered conditional routing rules. Evaluated top-to-bottom; the first matching rule selects a step sequence from policy_steps. If no rule matches (or if this array is empty), the baseline entry in policy_steps is used.
      - `condition` string — A CEL expression that is evaluated against the request context. If it returns true, the step sequence identified by policy_key is used.
      - `policyKey` string — A key into the policy's policy_steps map identifying which step sequence to execute when this rule's condition matches.
    - `systemBuiltin` boolean — Whether this policy is a builtin system policy. Builtin system policies cannot be edited.
    - `updatedAt` string, date-time
  - `updateMask` string, nullable

## Response `200`

The UpdatePolicyResponse message contains the updated policy object.

- C1ApiPolicyV1UpdatePolicyResponse — The UpdatePolicyResponse message contains the updated policy object.
  - `policy` C1ApiPolicyV1Policy — A policy defines a workflow (sequence of steps) that runs when processing access requests, reviews, or revocations. Policies support conditional routing: different conditions can trigger different step sequences, with a baseline fallback.
    - `annotations` object — Key/value metadata. Up to 16 entries; keys 1-128 chars; values 0-256 chars; URL-safe ASCII. Keys starting with `c1/` are reserved. Updates have PATCH semantics: keys absent from the request are preserved; an empty value deletes the key. Well-known keys: `managed_by`, `iac_workspace`, `iac_resource_address`, `iac_tool_version`.
    - `createdAt` string, date-time
    - `deletedAt` string, date-time
    - `description` string — The description of the Policy.
    - `displayName` string — The display name of the Policy.
    - `id` string — The ID of the Policy.
    - `policySteps` object — A map from string keys to step sequences. One entry is always the baseline, keyed by the lowercased policy_type (e.g., "grant", "revoke", "certify"). Additional entries have opaque keys (UUIDs) and are referenced by the rules array for conditional routing. If no conditional rules are configured, only the baseline entry exists.
    - `policyType` 'POLICY_TYPE_UNSPECIFIED' | 'POLICY_TYPE_GRANT' | 'POLICY_TYPE_REVOKE' | 'POLICY_TYPE_CERTIFY' | 'POLICY_TYPE_ACCESS_REQUEST' | 'POLICY_TYPE_PROVISION' — The type of this policy (grant, revoke, or certify). The lowercased type name (e.g., "grant") is also the key for the baseline entry in policy_steps.
    - `postActions` C1ApiPolicyV1PolicyPostActions[], nullable — Ordered actions to execute after the policy completes processing.
      - `certifyRemediateImmediately` boolean, nullable — Only valid on certify policies. When true, any revocations resulting from the certification are applied immediately when the campaign task closes. This field is part of the `action` oneof. See the documentation for `c1.api.policy.v1.PolicyPostActions` for more details.
    - `reassignTasksToDelegates` boolean — This field is no longer used. Configure delegate reassignment in the policy step instead.
    - `rules` C1ApiPolicyV1Rule[], nullable — Ordered conditional routing rules. Evaluated top-to-bottom; the first matching rule selects a step sequence from policy_steps. If no rule matches (or if this array is empty), the baseline entry in policy_steps is used.
      - `condition` string — A CEL expression that is evaluated against the request context. If it returns true, the step sequence identified by policy_key is used.
      - `policyKey` string — A key into the policy's policy_steps map identifying which step sequence to execute when this rule's condition matches.
    - `systemBuiltin` boolean — Whether this policy is a builtin system policy. Builtin system policies cannot be edited.
    - `updatedAt` string, date-time

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/versions/d391405a35d3/schema)