Update a draft policy rule (organization)

curl --request PATCH \
  --url https://api.onecli.sh/v1/org/policy/rules/{ruleId} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "description": "<string>",
  "enabled": true,
  "rateLimit": 123,
  "rateLimitWindow": "<string>",
  "requireApproval": true,
  "conditions": null,
  "identities": [
    {
      "id": "<string>"
    }
  ],
  "targets": [
    {
      "provider": "<string>",
      "tools": [
        "<string>"
      ],
      "connectionId": "<string>",
      "secretId": "<string>",
      "hostPattern": "<string>",
      "pathPattern": "<string>"
    }
  ]
}
'

import requests

url = "https://api.onecli.sh/v1/org/policy/rules/{ruleId}"

payload = {
    "name": "<string>",
    "description": "<string>",
    "enabled": True,
    "rateLimit": 123,
    "rateLimitWindow": "<string>",
    "requireApproval": True,
    "conditions": None,
    "identities": [{ "id": "<string>" }],
    "targets": [
        {
            "provider": "<string>",
            "tools": ["<string>"],
            "connectionId": "<string>",
            "secretId": "<string>",
            "hostPattern": "<string>",
            "pathPattern": "<string>"
        }
    ]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: '<string>',
    description: '<string>',
    enabled: true,
    rateLimit: 123,
    rateLimitWindow: '<string>',
    requireApproval: true,
    conditions: null,
    identities: [{id: '<string>'}],
    targets: [
      {
        provider: '<string>',
        tools: ['<string>'],
        connectionId: '<string>',
        secretId: '<string>',
        hostPattern: '<string>',
        pathPattern: '<string>'
      }
    ]
  })
};

fetch('https://api.onecli.sh/v1/org/policy/rules/{ruleId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.onecli.sh/v1/org/policy/rules/{ruleId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => '<string>',
    'description' => '<string>',
    'enabled' => true,
    'rateLimit' => 123,
    'rateLimitWindow' => '<string>',
    'requireApproval' => true,
    'conditions' => null,
    'identities' => [
        [
                'id' => '<string>'
        ]
    ],
    'targets' => [
        [
                'provider' => '<string>',
                'tools' => [
                                '<string>'
                ],
                'connectionId' => '<string>',
                'secretId' => '<string>',
                'hostPattern' => '<string>',
                'pathPattern' => '<string>'
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.onecli.sh/v1/org/policy/rules/{ruleId}"

	payload := strings.NewReader("{\n  \"name\": \"<string>\",\n  \"description\": \"<string>\",\n  \"enabled\": true,\n  \"rateLimit\": 123,\n  \"rateLimitWindow\": \"<string>\",\n  \"requireApproval\": true,\n  \"conditions\": null,\n  \"identities\": [\n    {\n      \"id\": \"<string>\"\n    }\n  ],\n  \"targets\": [\n    {\n      \"provider\": \"<string>\",\n      \"tools\": [\n        \"<string>\"\n      ],\n      \"connectionId\": \"<string>\",\n      \"secretId\": \"<string>\",\n      \"hostPattern\": \"<string>\",\n      \"pathPattern\": \"<string>\"\n    }\n  ]\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://api.onecli.sh/v1/org/policy/rules/{ruleId}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"<string>\",\n  \"description\": \"<string>\",\n  \"enabled\": true,\n  \"rateLimit\": 123,\n  \"rateLimitWindow\": \"<string>\",\n  \"requireApproval\": true,\n  \"conditions\": null,\n  \"identities\": [\n    {\n      \"id\": \"<string>\"\n    }\n  ],\n  \"targets\": [\n    {\n      \"provider\": \"<string>\",\n      \"tools\": [\n        \"<string>\"\n      ],\n      \"connectionId\": \"<string>\",\n      \"secretId\": \"<string>\",\n      \"hostPattern\": \"<string>\",\n      \"pathPattern\": \"<string>\"\n    }\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.onecli.sh/v1/org/policy/rules/{ruleId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"<string>\",\n  \"description\": \"<string>\",\n  \"enabled\": true,\n  \"rateLimit\": 123,\n  \"rateLimitWindow\": \"<string>\",\n  \"requireApproval\": true,\n  \"conditions\": null,\n  \"identities\": [\n    {\n      \"id\": \"<string>\"\n    }\n  ],\n  \"targets\": [\n    {\n      \"provider\": \"<string>\",\n      \"tools\": [\n        \"<string>\"\n      ],\n      \"connectionId\": \"<string>\",\n      \"secretId\": \"<string>\",\n      \"hostPattern\": \"<string>\",\n      \"pathPattern\": \"<string>\"\n    }\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "generation": 123,
  "priority": 123,
  "enabled": true,
  "isDefault": true,
  "logicalId": "<string>",
  "source": "<string>",
  "name": "<string>",
  "description": "<string>",
  "rateLimit": 123,
  "requireApproval": true,
  "conditions": "<unknown>",
  "identities": [
    {
      "id": "<string>"
    }
  ],
  "targets": [
    {
      "provider": "<string>",
      "tools": [
        "<string>"
      ],
      "connectionId": "<string>",
      "secretId": "<string>",
      "hostPattern": "<string>",
      "pathPattern": "<string>"
    }
  ],
  "createdAt": "2023-11-07T05:31:56Z"
}

PATCH

org

policy

rules

{ruleId}

Update a draft policy rule (organization)

curl --request PATCH \
  --url https://api.onecli.sh/v1/org/policy/rules/{ruleId} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "description": "<string>",
  "enabled": true,
  "rateLimit": 123,
  "rateLimitWindow": "<string>",
  "requireApproval": true,
  "conditions": null,
  "identities": [
    {
      "id": "<string>"
    }
  ],
  "targets": [
    {
      "provider": "<string>",
      "tools": [
        "<string>"
      ],
      "connectionId": "<string>",
      "secretId": "<string>",
      "hostPattern": "<string>",
      "pathPattern": "<string>"
    }
  ]
}
'

import requests

url = "https://api.onecli.sh/v1/org/policy/rules/{ruleId}"

payload = {
    "name": "<string>",
    "description": "<string>",
    "enabled": True,
    "rateLimit": 123,
    "rateLimitWindow": "<string>",
    "requireApproval": True,
    "conditions": None,
    "identities": [{ "id": "<string>" }],
    "targets": [
        {
            "provider": "<string>",
            "tools": ["<string>"],
            "connectionId": "<string>",
            "secretId": "<string>",
            "hostPattern": "<string>",
            "pathPattern": "<string>"
        }
    ]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: '<string>',
    description: '<string>',
    enabled: true,
    rateLimit: 123,
    rateLimitWindow: '<string>',
    requireApproval: true,
    conditions: null,
    identities: [{id: '<string>'}],
    targets: [
      {
        provider: '<string>',
        tools: ['<string>'],
        connectionId: '<string>',
        secretId: '<string>',
        hostPattern: '<string>',
        pathPattern: '<string>'
      }
    ]
  })
};

fetch('https://api.onecli.sh/v1/org/policy/rules/{ruleId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.onecli.sh/v1/org/policy/rules/{ruleId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => '<string>',
    'description' => '<string>',
    'enabled' => true,
    'rateLimit' => 123,
    'rateLimitWindow' => '<string>',
    'requireApproval' => true,
    'conditions' => null,
    'identities' => [
        [
                'id' => '<string>'
        ]
    ],
    'targets' => [
        [
                'provider' => '<string>',
                'tools' => [
                                '<string>'
                ],
                'connectionId' => '<string>',
                'secretId' => '<string>',
                'hostPattern' => '<string>',
                'pathPattern' => '<string>'
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.onecli.sh/v1/org/policy/rules/{ruleId}"

	payload := strings.NewReader("{\n  \"name\": \"<string>\",\n  \"description\": \"<string>\",\n  \"enabled\": true,\n  \"rateLimit\": 123,\n  \"rateLimitWindow\": \"<string>\",\n  \"requireApproval\": true,\n  \"conditions\": null,\n  \"identities\": [\n    {\n      \"id\": \"<string>\"\n    }\n  ],\n  \"targets\": [\n    {\n      \"provider\": \"<string>\",\n      \"tools\": [\n        \"<string>\"\n      ],\n      \"connectionId\": \"<string>\",\n      \"secretId\": \"<string>\",\n      \"hostPattern\": \"<string>\",\n      \"pathPattern\": \"<string>\"\n    }\n  ]\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://api.onecli.sh/v1/org/policy/rules/{ruleId}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"<string>\",\n  \"description\": \"<string>\",\n  \"enabled\": true,\n  \"rateLimit\": 123,\n  \"rateLimitWindow\": \"<string>\",\n  \"requireApproval\": true,\n  \"conditions\": null,\n  \"identities\": [\n    {\n      \"id\": \"<string>\"\n    }\n  ],\n  \"targets\": [\n    {\n      \"provider\": \"<string>\",\n      \"tools\": [\n        \"<string>\"\n      ],\n      \"connectionId\": \"<string>\",\n      \"secretId\": \"<string>\",\n      \"hostPattern\": \"<string>\",\n      \"pathPattern\": \"<string>\"\n    }\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.onecli.sh/v1/org/policy/rules/{ruleId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"<string>\",\n  \"description\": \"<string>\",\n  \"enabled\": true,\n  \"rateLimit\": 123,\n  \"rateLimitWindow\": \"<string>\",\n  \"requireApproval\": true,\n  \"conditions\": null,\n  \"identities\": [\n    {\n      \"id\": \"<string>\"\n    }\n  ],\n  \"targets\": [\n    {\n      \"provider\": \"<string>\",\n      \"tools\": [\n        \"<string>\"\n      ],\n      \"connectionId\": \"<string>\",\n      \"secretId\": \"<string>\",\n      \"hostPattern\": \"<string>\",\n      \"pathPattern\": \"<string>\"\n    }\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "generation": 123,
  "priority": 123,
  "enabled": true,
  "isDefault": true,
  "logicalId": "<string>",
  "source": "<string>",
  "name": "<string>",
  "description": "<string>",
  "rateLimit": 123,
  "requireApproval": true,
  "conditions": "<unknown>",
  "identities": [
    {
      "id": "<string>"
    }
  ],
  "targets": [
    {
      "provider": "<string>",
      "tools": [
        "<string>"
      ],
      "connectionId": "<string>",
      "secretId": "<string>",
      "hostPattern": "<string>",
      "pathPattern": "<string>"
    }
  ],
  "createdAt": "2023-11-07T05:31:56Z"
}

Authorizations

Authorization

string

header

required

API key obtained from the dashboard or GET /user/api-key

Path Parameters

ruleId

string

required

Body

application/json

Every field optional (at least one required); nullable fields accept an explicit null to clear.

name

string

description

string | null

enabled

boolean

action

enum<string>

Available options:

allow,

block

rateLimit

integer | null

rateLimitWindow

string | null

requireApproval

boolean

conditions

unknown

identities

object[]

Show child attributes

targets

object[]

Show child attributes

Response

The updated draft rule

A policy-engine rule (the staged draft → publish model). Writes land in the draft; only a publish makes them enforced. Published row ids regenerate on every publish; logicalId is the identity stable across statuses and generations.

string

scope

enum<string>

Available options:

project,

organization

status

enum<string>

Available options:

draft,

published

generation

integer

0 for the draft working copy; the snapshot number for published rows.

priority

integer

First-match order (lower evaluates first).

enabled

boolean

isDefault

boolean

True on the scope's terminal Default Rule.

logicalId

string

Generation-stable identity; compare rules across draft/published by this, never by id.

source

string

custom (user-owned, editable), default (the Default Rule), or system-managed blocklist/equipment rows. Self-hosted deployments that have not cut over to the policy engine may also expose read-only app_permission rows derived from the legacy model.

name

string

description

string | null

action

enum<string>

Available options:

allow,

block

rateLimit

integer | null

rateLimitWindow

enum<string> | null

Available options:

minute,

hour,

day,

null

requireApproval

boolean

conditions

any | null

A conditions array, a session-policy object ({repositories} / {folders}), or null.

identities

object[]

Show child attributes

targets

object[]

Show child attributes

createdAt

string<date-time>

Create a policy rule (organization)Delete a draft policy rule (organization)

Agents

Secrets

Apps

Connections

Policy

Projects

Team

User

Utility

Agent Setup

Migration

Approvals

Organization Secrets

Organization Policy

Organization Connections

Organization App Config

Organization Approvals

Organization Settings

Partner Organizations

Partner Projects

Partner Secrets

Partner Budgets

Partner Members

Organization Partner

Update a draft policy rule (organization)

Authorizations

Path Parameters

Body

Response