Update a model policy. PATCH /api/openapi/v1/model-policies/{policyId}, scope admin.v1.model-policies.manage.
- Scope: admin.v1.model-policies.manage
- Permission: Manage model policies (model-policies)
- Permission type: Manage
- Endpoint: PATCH/api/openapi/v1/model-policies/{policyId}
Authentication and request headers
Call with an application API key. This endpoint checks only the scope above; read, manage and execute permissions do not imply one another.
| Name | Location | Type | Required | Description | Example |
|---|---|---|---|---|---|
| Authorization | header | string | Yes | Application API key, passed as a Bearer token. | Bearer qwk_*** |
| X-Request-Id | header | string | No | Optional request tracing identifier; generated by the server if omitted. | req-20260831-001 |
Request parameters
| Name | Location | Type | Required | Description | Example |
|---|---|---|---|---|---|
| policyId | path | string · uuid | Required | Policy group ID | "<uuid>" |
| description | body | string | No | Description | "<string>" |
| display_order | body | integer · int64 | No | Display order | 0 |
| mode | body | string | Required | Policy mode | "allowlist" |
| name | body | string | Required | Policy name | "<string>" |
| resource_ids | body | array ｜ null | Required | Main model scope (resource IDs) | ["<string>"] |
| resource_scope | body | string | Required | Main model scope | "all" |
| status | body | string | No | Enabled | "enabled" |
| subject_scope | body | string | Required | Scope | "all_users" |
| subjects | body | array ｜ null | Required | Select scope | [{"include_descendants":false,"subject_id":"<string>","subject_type":"user"}] |
| surfaces | body | array ｜ null | Required | Target app | ["<string>"] |
| valid_from | body | string · date-time | No | Effective from | "2026-08-27T10:00:00Z" |
| valid_to | body | string · date-time | No | Effective until | "2026-08-27T10:00:00Z" |
Request example
cURL
Responses
200 OK
| Name | Type | Required | Description | Example |
|---|---|---|---|---|
| created_at | string · date-time | Yes | Created at | "2026-08-27T10:00:00Z" |
| default | boolean | Yes | Whether this is the default policy group | false |
| description | string | Yes | Description | "<string>" |
| id | string | Yes | Policy group ID | "<string>" |
| mode | string | Yes | Policy mode | "<string>" |
| name | string | Yes | Policy name | "<string>" |
| policy_type | string | Yes | Policy type | "<string>" |
| resource_count | integer · int64 | Yes | Resource count | 0 |
| resource_scope | string | Yes | Main model scope | "<string>" |
| status | string | Yes | Enabled | "<string>" |
| subject_count | integer · int64 | Yes | Subject count | 0 |
| subject_counts | object | Yes | Subject counts by type | {} |
| subject_scope | string | Yes | Scope | "<string>" |
| surfaces | array ｜ null | Yes | Target app | ["<string>"] |
| updated_at | string · date-time | Yes | Updated at | "2026-08-27T10:00:00Z" |
default Flat business error
| Name | Type | Required | Description | Example |
|---|---|---|---|---|
| code | string | No | Stable business error code | "<string>" |
| detail | string | Yes | Human-readable error description | "<string>" |
| details | OpenapiErrorDetails | No | Error details | {"field":"<string>","reason":"<string>","suggestion":"<string>"} |
| details.field | string | No | Request field that failed validation | "<string>" |
| details.reason | string | No | Stable validation failure reason | "<string>" |
| details.suggestion | string | No | Suggested normalized value | "<string>" |
| error | string | Yes | Stable HTTP error type | "<string>" |