--- title: "Apply remediation policies" method: PUT path: "/api/policies/v2/deployments/{deploymentId}/remediation-policies" tags: ["PoliciesV2Service"] --- # Apply remediation policies `PUT /api/policies/v2/deployments/{deploymentId}/remediation-policies` Strictly applies a candidate remediation policies bundle: the submitted list replaces the current state, and policies absent from it are deleted. Requires the current state_version in the If-Match header; responds 428 when the header is missing and 409 with the current state_version when it is stale. The apply is atomic for the bundle. System-managed policies are unaffected; submitting a policy whose slug collides with one responds 409 with code RESERVED_SLUG. ## Path parameters - `deploymentId` integer, required — The unique numerical identifier for the deployment. ## Request body - ProtosPoliciesV2ApplyRemediationPoliciesRequest - `bundle` ProtosPoliciesV2RemediationPoliciesBundle, required — The full declared set of remediation policies for a deployment. A strict apply replaces the whole list: policies absent from the submitted bundle are deleted. System-managed policies never appear in the bundle and are never affected by an apply. - `deployment_slug` string — Output only. The slug of the deployment the bundle belongs to. Ignored when sent in a request body. - `policies` ProtosPoliciesV2RemediationPolicy[] — The remediation policies of the deployment. - `slug` string — The stable public identity of the policy. Immutable after create: renames change name but never slug. When omitted on create, it is derived from name; set it explicitly to pin a URL-safe identity independent of name. - `name` string, required — The display name of the policy. - `description` string — An optional free-form description of the policy. - `active` boolean — Whether the policy is evaluated. Defaults to `true` when omitted on create. - `filters` ProtosPoliciesV2RemediationPolicyFilters, required — How a remediation policy decides whether a finding matches. - `mode` string, required — How the conditions combine. One of: `all`, `any`. - `conditions` ProtosPoliciesV2RemediationPolicyCondition[] — The conditions evaluated against each finding. At least one condition is required. - `type` string, required — The condition type, for example `severity`, `confidence`, or `repository_tag`. The vocab endpoint lists the accepted types. - `values` string[], required — The values the condition matches against. - `mode` string — How multiple values combine. One of: `any`, `none`. `none` negates the condition (the finding must match none of the values). Defaults to `any`. - `actions` ProtosPoliciesV2RemediationPolicyAction[], required — The actions that fire when a finding matches. The list is replaced as a unit on update: any change to it is a single update of the policy. - `type` string, required — The action type. One of: `block`, `pr_comment`, `jira`, `slack_app`, `webhook`, `triage`. The vocab endpoint lists the accepted types and their companion requirements (for example, `block` requires `pr_comment` in the same policy). - `config` object — Action-specific configuration. Downstream resources are referenced by slug or name, never by numeric id. For example, a `jira` action takes `project_id` and `credential_slug`. ## Response `200` OK - ProtosPoliciesV2ApplyRemediationPoliciesResponse - `bundle` ProtosPoliciesV2RemediationPoliciesBundle — The full declared set of remediation policies for a deployment. A strict apply replaces the whole list: policies absent from the submitted bundle are deleted. System-managed policies never appear in the bundle and are never affected by an apply. - `deployment_slug` string — Output only. The slug of the deployment the bundle belongs to. Ignored when sent in a request body. - `policies` ProtosPoliciesV2RemediationPolicy[] — The remediation policies of the deployment. - `slug` string — The stable public identity of the policy. Immutable after create: renames change name but never slug. When omitted on create, it is derived from name; set it explicitly to pin a URL-safe identity independent of name. - `name` string, required — The display name of the policy. - `description` string — An optional free-form description of the policy. - `active` boolean — Whether the policy is evaluated. Defaults to `true` when omitted on create. - `filters` ProtosPoliciesV2RemediationPolicyFilters, required — How a remediation policy decides whether a finding matches. - `mode` string, required — How the conditions combine. One of: `all`, `any`. - `conditions` ProtosPoliciesV2RemediationPolicyCondition[] — The conditions evaluated against each finding. At least one condition is required. - `type` string, required — The condition type, for example `severity`, `confidence`, or `repository_tag`. The vocab endpoint lists the accepted types. - `values` string[], required — The values the condition matches against. - `mode` string — How multiple values combine. One of: `any`, `none`. `none` negates the condition (the finding must match none of the values). Defaults to `any`. - `actions` ProtosPoliciesV2RemediationPolicyAction[], required — The actions that fire when a finding matches. The list is replaced as a unit on update: any change to it is a single update of the policy. - `type` string, required — The action type. One of: `block`, `pr_comment`, `jira`, `slack_app`, `webhook`, `triage`. The vocab endpoint lists the accepted types and their companion requirements (for example, `block` requires `pr_comment` in the same policy). - `config` object — Action-specific configuration. Downstream resources are referenced by slug or name, never by numeric id. For example, a `jira` action takes `project_id` and `credential_slug`. - `state_version` string — The new state_version of the bundle after the apply. --- [API](https://skmtc.net/semgrep/apis/semgrep-web-app.md) · [All operations](https://skmtc.net/semgrep/apis/semgrep-web-app/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/semgrep/semgrep-web-app/revisions/6483eeecd582/schema)