---
title: "Update a policy"
method: PATCH
path: "/zones/{zone_id}/policies/{policy_id}"
tags: ["Policies"]
---

# Update a policy

`PATCH /zones/{zone_id}/policies/{policy_id}`

## Path parameters

- `zone_id` string, required
- `policy_id` string, required

## Headers

- `If-Match` string
- `X-API-Version` string
- `X-Client-Request-ID` string, uuid

## Request body

- PdpUpdatePolicyRequest
  - `name` string
  - `description` string

## Response `200`

The updated policy

- PdpPolicy
  - `id` string, required
  - `zone_id` string, required
  - `name` string, required
  - `description` string, nullable
  - `archived_at` string, date-time, nullable
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `created_by` string, required
  - `updated_by` string, nullable
  - `latest_version_id` string, nullable
  - `latest_version` integer, nullable — Human-readable version number of the latest version (e.g., 1, 2, 3)
  - `latest_schema_version` string, nullable — Schema version the latest version was validated against (e.g., "2026-02-24"). Null when the policy has no published versions. Denormalized from `PolicyVersion.schema_version` for the policy referenced by `latest_version_id`.
  - `owner_type` 'platform' | 'customer', required — Who manages this policy: - `"platform"` — managed by the Keycard platform (system policies). - `"customer"` — managed by the tenant (custom policies).

## Other responses

- `400` — bad request error response when caller supplied invalid input data
- `401` — unauthorized error response when caller session is not authenticated
- `403` — forbidden error response when caller does not have permissions to a resource
- `404` — not found error response when caller does not have permission to see a resource or the resource does not exist
- `409` — Conflict - name collision
- `412` — Precondition Failed - resource has been modified since the provided ETag
- `429` — rate limit exceeded error response when caller has exhausted api limits for the given time period
- `500` — internal server error response when server encountered error of its own creation
- `503` — service unavailable error when server you're attempting to reach is not available
- `default` — internal server error response when server encountered error of its own creation

---

[API](https://skmtc.net/keycardai/apis/untitled-api.md) · [All operations](https://skmtc.net/keycardai/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/keycardai/untitled-api/revisions/2f5033ed4491/schema)