Sign in

v66

OpenAPI 3.1.0raw.githubusercontent.com2026-08-0174265626.3 KB
gateway

Set policies

Replace an environment's gateway policies in a single atomic request. Policies run at the edge before requests reach your app: verify API keys, rate limit, block requests outright, or validate them against your OpenAPI spec.

Policies are an ordered list: the gateway evaluates them top to bottom and the first rejection short-circuits the request.

Each policy sets exactly one of keyauth, ratelimit, firewall or openapi, plus optional match expressions restricting which requests it applies to.

Every call is a full replace: the environment's policies become exactly the request list in the given order, and the server generates a fresh id for each one. An empty list removes all policies. The operation is atomic: if any policy is invalid, nothing is written.

Required Permissions

Your root key must have one of the following permissions:

  • environment.*.set_policies (for any environment)
  • environment.<environment_id>.set_policies (for a specific environment)
post/v2/gateway.setPolicies

Request body

projectstring required

Identifies a resource by either its unique ID or its slug. Accepts a prefixed ID (such as 'proj_' or 'app_') or a slug.

appstring required

Identifies a resource by either its unique ID or its slug. Accepts a prefixed ID (such as 'proj_' or 'app_') or a slug.

environmentstring required

Identifies a resource by either its unique ID or its slug. Accepts a prefixed ID (such as 'proj_' or 'app_') or a slug.

Example request

{
  "project": "proj_1234abcd",
  "app": "proj_1234abcd",
  "environment": "proj_1234abcd",
  "policies": [
    {
      "name": "Block internal paths",
      "enabled": true,
      "match": [
        {
          "path": {
            "path": {
              "prefix": "/internal/"
            }
          }
        }
      ],
      "firewall": {
        "action": "ACTION_DENY"
      }
    }
  ]
}

Response

Successfully set the policies.

dataEmptyResponse required

Empty response object by design. A successful response indicates this operation was successfully executed.

Example response

{
  "meta": {
    "requestId": "req_123"
  }
}