---
title: "Apply a detection policy"
method: PUT
path: "/api/policies/v2/deployments/{deploymentId}/detection-policy/{product}"
tags: ["PoliciesV2Service"]
---

# Apply a detection policy

`PUT /api/policies/v2/deployments/{deploymentId}/detection-policy/{product}`

Strictly applies a candidate detection policy bundle for one product: the submitted bundle replaces the current state, and exceptions absent from it are deleted. Requires the current state_version in the If-Match header; responds 428 when the header is missing and 409 with the current state_version when it is stale. The apply is atomic for the product's bundle.

## Path parameters

- `deploymentId` integer, required — The unique numerical identifier for the deployment.
- `product` string, required — The product the bundle applies to. One of: `code`, `secrets`.

## Request body

- ProtosPoliciesV2ApplyDetectionPolicyRequest
  - `bundle` ProtosPoliciesV2DetectionPolicyBundle, required — The full declared detection state for one product. A strict apply replaces the entire bundle: rule selection is overwritten and exceptions absent from the bundle are deleted.
    - `deployment_slug` string — Output only. The slug of the deployment the bundle belongs to. Ignored when sent in a request body.
    - `product` string — The product the bundle applies to. One of: `code`, `secrets`. Optional in request bodies; when present it must match the product in the URL.
    - `rulesets` string[] — Registry ruleset paths that run deployment-wide, for example `p/owasp-top-10`. Must be empty when product is `secrets`.
    - `rules` string[] — Registry rule paths added individually, on top of the selected rulesets.
    - `disabled` string[] — Registry rule paths from the selected rulesets that are explicitly turned off.
    - `exceptions` ProtosPoliciesV2DetectionPolicyException[] — Per-project or per-tag include/exclude exceptions to the deployment-wide rule selection.
      - `exception_type` string, required — Whether the exception forces the rule to run (`include`) or skips it (`exclude`) on the targeted scope.
      - `project` string — The name of the project the exception targets. Mutually exclusive with project_tag_name.
      - `project_tag_name` string — The name of the project tag the exception targets. Treat tag names as opaque strings: they may contain spaces and special characters. Mutually exclusive with project.
      - `rule` string, required — The registry path of the rule or rule pack the exception applies to.
      - `rule_type` string, required — Whether rule refers to a single rule (`rule`) or a rule pack (`pack`).

## Response `200`

OK

- ProtosPoliciesV2ApplyDetectionPolicyResponse
  - `bundle` ProtosPoliciesV2DetectionPolicyBundle — The full declared detection state for one product. A strict apply replaces the entire bundle: rule selection is overwritten and exceptions absent from the bundle are deleted.
    - `deployment_slug` string — Output only. The slug of the deployment the bundle belongs to. Ignored when sent in a request body.
    - `product` string — The product the bundle applies to. One of: `code`, `secrets`. Optional in request bodies; when present it must match the product in the URL.
    - `rulesets` string[] — Registry ruleset paths that run deployment-wide, for example `p/owasp-top-10`. Must be empty when product is `secrets`.
    - `rules` string[] — Registry rule paths added individually, on top of the selected rulesets.
    - `disabled` string[] — Registry rule paths from the selected rulesets that are explicitly turned off.
    - `exceptions` ProtosPoliciesV2DetectionPolicyException[] — Per-project or per-tag include/exclude exceptions to the deployment-wide rule selection.
      - `exception_type` string, required — Whether the exception forces the rule to run (`include`) or skips it (`exclude`) on the targeted scope.
      - `project` string — The name of the project the exception targets. Mutually exclusive with project_tag_name.
      - `project_tag_name` string — The name of the project tag the exception targets. Treat tag names as opaque strings: they may contain spaces and special characters. Mutually exclusive with project.
      - `rule` string, required — The registry path of the rule or rule pack the exception applies to.
      - `rule_type` string, required — Whether rule refers to a single rule (`rule`) or a rule pack (`pack`).
  - `state_version` string — The new state_version of the bundle after the apply.

---

[API](https://skmtc.net/semgrep/apis/semgrep-web-app.md) · [All operations](https://skmtc.net/semgrep/apis/semgrep-web-app/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/semgrep/semgrep-web-app/revisions/6483eeecd582/schema)