---
title: "SetOrganizationSecurityPolicyExecutables"
method: POST
path: "/gitpod.v1.OrganizationService/SetOrganizationSecurityPolicyExecutables"
tags: ["gitpod.v1.OrganizationService"]
---

# SetOrganizationSecurityPolicyExecutables

`POST /gitpod.v1.OrganizationService/SetOrganizationSecurityPolicyExecutables`

Replaces only executable rules. A non-empty write creates and assigns a
 default SecurityPolicy when absent; an empty write does not create one.

## Request body

- GitpodV1SetOrganizationSecurityPolicyExecutablesRequest
  - `legacyMigrationToken` string, nullable — legacy_migration_token binds the loaded legacy/default snapshot. Save must return it unchanged.
  - `organizationId` string, uuid, required
  - `rules` GitpodV1SecurityPolicySpecExecutablePolicyRule[]
    - `effect` 'EFFECT_UNSPECIFIED' | 'EFFECT_ALLOW' | 'EFFECT_BLOCK' | 'EFFECT_AUDIT'
    - `path` string — path is either an absolute executable path, such as /usr/bin/curl, or a bare executable name, such as npx. Bare names are expanded by runtime discovery. Surrounding whitespace is ignored. Empty or whitespace-only selectors and relative paths with directory separators are invalid. Enforcement uses executable content hashes, so different paths with identical content share one runtime decision and block wins conflicts.

## Response `200`

Success

- GitpodV1SetOrganizationSecurityPolicyExecutablesResponse
  - `executables` GitpodV1OrganizationSecurityPolicyExecutables, required
    - `legacyMigrationPending` boolean
    - `legacyMigrationToken` string, nullable — legacy_migration_token binds the loaded legacy/default snapshot. Save must return it unchanged when setting the executable rules.
    - `rules` GitpodV1SecurityPolicySpecExecutablePolicyRule[]
      - `effect` 'EFFECT_UNSPECIFIED' | 'EFFECT_ALLOW' | 'EFFECT_BLOCK' | 'EFFECT_AUDIT'
      - `path` string — path is either an absolute executable path, such as /usr/bin/curl, or a bare executable name, such as npx. Bare names are expanded by runtime discovery. Surrounding whitespace is ignored. Empty or whitespace-only selectors and relative paths with directory separators are invalid. Enforcement uses executable content hashes, so different paths with identical content share one runtime decision and block wins conflicts.
    - `safelist` string[]

## Other responses

- `default` — Error

---

[API](https://skmtc.net/gitpod-io/apis/gitpod-v1.md) · [All operations](https://skmtc.net/gitpod-io/apis/gitpod-v1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/gitpod-io/gitpod-v1/revisions/44d50c2ac284/schema)