---
title: "Update Policies"
method: PATCH
path: "/api/v2/Policies/{policyId}"
tags: ["Policies"]
---

# Update Policies

`PATCH /api/v2/Policies/{policyId}`

Update an existing LQL policy registered in your FortiCNAPP instance by specifying parameters in the request body when invoking the following endpoint: 

  > `PATCH https://YourAccount.lacework.net/api/v2/Policies/{policyId}`

  Replace `{policyId}` with the `policyId` value returned for an LQL policy in the response when the `GET /api/v2/Policies` endpoint is invoked.

## Path parameters

- `policyId` string, required

## Headers

- `Authorization` string, required
- `Content-Type` string, required

## Request body

- PoliciesUpdateSchema
  - `policyType` 'Violation' — The policy type such as `Violation`.
  - `queryId` string — Identifier of the query that executes while running the policy.
  - `title` string — The policy's title.
  - `enabled` boolean — When sending a request, use this attribute to enable or disable a policy. When included in a response, returns `True` for enabled policies, or returns `False` for disabled policies.
  - `description` string — Information about the new policy.
  - `remediation` string — Remediation strategy for the events triggered by the policy.
  - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical' — The severity of an event triggered by the policy.
  - `limit` number — The maximum number of records that each policy will return. The default value is 1000.
  - `evalFrequency` 'Hourly' | 'Daily' — Frequency at which the policy will be evaluated
  - `alertEnabled` boolean — When sending a request, set to `True` if you want to send alerts to an alert profile when the policy is triggered. Set to `False` if you want to mute alerts when the policy is triggered.
  - `alertProfile` string — The alert profile to use for sending alerts when the policy is triggered.
  - `tags` string[] — A list of policy tags.

## Response `200`

No Error

- object
  - `data` PoliciesResponseSchema
    - `policyType` 'Violation' — The policy type such as `Violation`.
    - `queryId` string, required — Identifier of the query that executes while running the policy.
    - `title` string, required — The policy's title.
    - `enabled` boolean, required — When sending a request, use this attribute to enable or disable a policy. When included in a response, returns `True` for enabled policies, or returns `False` for disabled policies.
    - `description` string, required — Information about the new policy.
    - `remediation` string, required — Remediation strategy for the events triggered by the policy.
    - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required — The severity of an event triggered by the policy.
    - `limit` number — The maximum number of records that each policy will return. The default value is 1000.
    - `evalFrequency` 'Hourly' | 'Daily' — Frequency at which the policy will be evaluated
    - `alertEnabled` boolean, required — When sending a request, set to `True` if you want to send alerts to an alert profile when the policy is triggered. Set to `False` if you want to mute alerts when the policy is triggered.
    - `alertProfile` string — The alert profile to use for sending alerts when the policy is triggered.
    - `tags` string[] — A list of policy tags.
    - `policyId` string — Policy ID. The convention for policy ID creation is `accountName-remainder`, for example, lws-special-100. When sending a request, you can simply provide `$account-<remainder>`, and FortiCNAPP will substitute the `$account` prefix with your actual account name. **Note:** The `-remainder` must use the regex pattern (`^[a-z]{1,16}(-\d{1,8})?$`), and cannot be `default` or start with `default-`.
    - `evaluatorId` string — Evaluator ID. For POST and PATCH endpoints, the `evaluatorId` field is still accepted but is ignored. No warning is returned if an `evaluatorId` is provided; this behavior may change in the future. For responses from all of these calls, an `evaluatorId` field is no longer returned.
    - `owner` string — The user who created the policy.
    - `lastUpdateTime` string — The timestamp for when the policy was last updated.
    - `lastUpdateUser` string — The user who last updated the policy.
    - `exceptionConfiguration` object — The configuration of policy exceptions when it is applicable.
      - `constraintFields` object[], required — List of constraint fields that can be used to create policy exceptions.
        - `fieldKey` string, required — Field ID that can be used to apply the exception on a policy.
        - `dataType` string, required — Type can be `String` or `KVTagPair`.
        - `multiValue` boolean, required — Allow multiple values or not.

## Other responses

- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/versions/7015f76895f2/schema)