{
  "config": {"window": "monthly", "limit_usd": 200},
  "enabled": false
}

{
  "action": "<string>",
  "config": {},
  "created_at": "<string>",
  "created_by": "<string>",
  "current_spend_usd": 123,
  "current_usage": [
    {
      "value": 123
    }
  ],
  "description": "<string>",
  "enabled": true,
  "id": "<string>",
  "is_system_generated": true,
  "name": "<string>",
  "organization_id": "<string>",
  "parent_policy_id": "<string>",
  "policy_type": "<string>",
  "priority": 123,
  "subject_matchers": [
    {
      "key": "<string>",
      "value": "<string>"
    }
  ],
  "updated_at": "<string>"
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

Update a gateway policy

Partially updates a gateway policy. Only fields present in the request body are applied; absent fields are left unchanged. policy_type is immutable — to change a policy’s type, delete it and create a new one.

config if supplied must match the policy’s type:

spend-cap: {"window": ..., "limit_usd": ...}
guard: {"version": 1, "detect": {...}, "timeout_seconds": <number>, "timeout_action": "allow"|"block"}
rate-limit: {"version": 1, "limits": [{"metric": "requests"|"tokens", "window": "minute"|"hour", "value": <integer>}]} Mismatched shapes are rejected with 400.

default cascade: editing a default_spend_cap or default_rate_limit updates the config/action/enabled/priority on every attached child policy so the template stays the source of truth across rollouts.

PATCH

api

platform

gateway-policies

{id}

{
  "config": {"window": "monthly", "limit_usd": 200},
  "enabled": false
}

{
  "action": "<string>",
  "config": {},
  "created_at": "<string>",
  "created_by": "<string>",
  "current_spend_usd": 123,
  "current_usage": [
    {
      "value": 123
    }
  ],
  "description": "<string>",
  "enabled": true,
  "id": "<string>",
  "is_system_generated": true,
  "name": "<string>",
  "organization_id": "<string>",
  "parent_policy_id": "<string>",
  "policy_type": "<string>",
  "priority": 123,
  "subject_matchers": [
    {
      "key": "<string>",
      "value": "<string>"
    }
  ],
  "updated_at": "<string>"
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

Authorizations

X-API-Key

string

header

required

Path Parameters

string<uuid>

required

Policy ID

Body

application/json

action

string

Example:

"block"

config

object

description

string

Example:

"Blocks overspend on the production org"

enabled

boolean

Example:

true

name

string

Example:

"monthly-cap"

priority

integer

Example:

0

subject_matchers

object[]

Show child attributes

Response

action

string

config

object

created_at

string

created_by

string

current_spend_usd

number

CurrentSpendUSD is the spend in the policy's current window. Set for any spend_cap policy regardless of enabled state — disabled policies still surface usage so users can see what would have been counted. Nil for non-spend_cap policies or when the spend lookup failed.

current_usage

object[]

CurrentUsage is the consumed units in each configured limit's current window. Set for any rate_limit policy regardless of enabled state, one entry per limit in the config. Nil for non-rate_limit policies or when the usage lookup failed.

Show child attributes

description

string

enabled

boolean

string

is_system_generated

boolean

name

string

organization_id

string

parent_policy_id

string

ParentPolicyID is set on materialized children of a default_spend_cap to the default's id. An explicit Update or a Create with the same matchers clears the link and takes ownership of the materialized row. Delete on the parent cascade-soft-deletes children still attached.

policy_type

string

priority

integer

subject_matchers

object[]

Show child attributes

updated_at

string