# Change a policy rule's action

Replaces what a rule does. A rule’s pattern and owner are fixed — delete it and add the one you meant.

PATCH `/v1/connectors/policies/{policyRuleId}`

## Authorization

`Authorization` Bearer token · header required

```
Authorization: Bearer <token>
```

with an API key (`sfa_` prefix), an OAuth access token, a session token, or a Space machine credential (`sfm_` prefix).

or

`Authorization` OAuth2 access token · header required

OAuth 2.0 with Spacefast scopes. People use the authorization code flow; machines use client credentials.

**Scopes:** `connectors:write`

## Path parameters

`policyRuleId` string required

min length 1

## Query parameters

`team` string

min length 1 · max length 255

## Request body

required `application/json`

`action` string required

Replacement action. A rule's pattern and owner are fixed — delete and re-add.

**Allowed:** `approve`, `require_approval`, `block`

## Responses

### 200 Response for status 200

`$schema` string <uri>

Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.

`data` object required

One ordered address-pattern rule. Most restrictive across owners wins.

#### Show properties Hide properties

- `id` string required

Policy rule id. Opaque — minted by the policy engine, not a Spacefast resource prefix.

- `pattern` string required

`*`, `<connector>/ *`, `<connectionId>/ *`, or `<connectionId>/<tool>`. First match in order wins.

- `action` string required

What policy does with a call: run it, park it for a person, or refuse it.

**Allowed:** `approve`, `require_approval`, `block`

- `owner` string required

Team rules are a floor: a personal rule may tighten one, never loosen it.

**Allowed:** `team`, `personal`

- `position` string required

Fractional index the engine assigned from the pattern's specificity. Rules evaluate in this order.

- `createdAt` string <date-time> required

matches ^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\.\\d+)?)?(?:Z))$

default Problem details (RFC 9457). Any 4xx/5xx response is one `application/problem+json` document.

`$schema` string <uri>

Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.

- `type` string required

URL of the documentation page for this error. Derived from `code`.

- `title` string required

Human-readable name of the error type. Derived from `code`.

- `status` integer required

HTTP status of the response, repeated in the body.

min -9007199254740991 · max 9007199254740991

- `detail` string required

What went wrong in this request.

- `code` string required

Stable snake_case error code. Match on this, not on `detail`.

- `pointer` string

RFC 6901 JSON Pointer to the request field or batch entry that failed, for example `/files/37/path`. Present on validation failures.

- `details` object

Machine-readable context keyed by the error code.

- `suggestions` string[]

Recovery steps safe to show to a person.

- `next` string[]

Commands or API requests to run next, usable as written.

- `requestId` string required

ID of this request, from the `X-Request-Id` header or generated. Quote it when contacting support.

## Try it

**Server**

**Base URL** https://api.spacefast.com  
Custom base URL Overrides the selected server when set.

## Authorization

Bearer token Remember on this device Include my values in samples

### Parameters

- `policyRuleId` path* `team` query

## Body

application/json

`action` string* `approve`, `require_approval`, `block`

Replacement action. A rule's pattern and owner are fixed — delete and re-add.

### Send

### Request

**cURL**

```bash
curl -X PATCH "https://api.spacefast.com/v1/connectors/policies/string" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "action": "approve"
}'
```

**JavaScript**

```javascript
const response = await fetch("https://api.spacefast.com/v1/connectors/policies/string", {
  method: "PATCH",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type": "application/json"
  },
  body: "{\n  \"action\": \"approve\"\n}"
});
```

**Python**

```python
import requests

response = requests.patch(
    "https://api.spacefast.com/v1/connectors/policies/string",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Content-Type": "application/json"
    },
    data="{\n  \"action\": \"approve\"\n}",
)
```

### Response

**200 default**

```json
{
  "$schema": "http://example.com",
  "data": {
    "id": "string",
    "pattern": "string",
    "action": "approve",
    "owner": "team",
    "position": "string",
    "createdAt": "2019-08-24T14:15:22Z"
  }
}
```

```json
{
  "$schema": "http://example.com",
  "type": "string",
  "title": "string",
  "status": -9007199254740991,
  "detail": "string",
  "code": "string",
  "pointer": "string",
  "details": {
    "property1": null,
    "property2": null
  },
  "suggestions": [
    "string"
  ],
  "next": [
    "string"
  ],
  "requestId": "string"
}
```