---
title: "Update an issuer policy"
method: PATCH
path: "/v1/kms/issuers/{issuerId}/policies/{kind}/{policyKey}"
tags: ["kms"]
---

# Update an issuer policy

`PATCH /v1/kms/issuers/{issuerId}/policies/{kind}/{policyKey}`

Update an existing KMS issuer policy's environments or token claims.

## Path parameters

- `issuerId` string, required — The ID of the issuer.
- `kind` 'project-grant', required — The issuer policy kind.
- `policyKey` string, required — The policy identifier.

## Query parameters

- `teamId` string
- `slug` string

## Request body

- object
  - `environments` string[] — The environments for the project grant policy. Each entry is a system environment (production, preview, development) or a custom environment ID (env_...).
  - `tokenClaims` object, nullable — The claims that KMS should include in signed JWTs for this policy. Pass null to remove them.

## Response `200`

- union
  - object
    - `kind` 'project-grant', required
    - `teamId` string, required
    - `projectId` string, required
    - `environments` string[], required — Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim.
    - `tokenClaims` object
    - `createdAt` string, required
    - `updatedAt` string, required
  - object
    - `kind` 'connex-grant', required
    - `clientId` string, required
    - `tokenClaims` object
    - `createdAt` string, required
    - `updatedAt` string, required

## Other responses

- `400` — One of the provided values in the request body is invalid. One of the provided values in the request query is invalid.
- `401` — The request is not authorized.
- `403` — You do not have permission to access this resource.
- `404`
- `410`

---

[API](https://skmtc.net/vercel/apis/api.md) · [All operations](https://skmtc.net/vercel/apis/api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vercel/api/revisions/339d55de6905/schema)