Update an organization rule
curl --request PATCH \
--url https://api.onecli.sh/v1/org/policy/rules/{ruleId} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "<string>",
"description": "<string>",
"enabled": true,
"rateLimit": 123,
"rateLimitWindow": "<string>",
"requireApproval": true,
"conditions": null,
"identities": [
{
"id": "<string>"
}
],
"targets": [
{
"provider": "<string>",
"tools": [
"<string>"
],
"connectionId": "<string>",
"secretId": "<string>",
"hostPattern": "<string>",
"pathPattern": "<string>"
}
]
}
'import requests
url = "https://api.onecli.sh/v1/org/policy/rules/{ruleId}"
payload = {
"name": "<string>",
"description": "<string>",
"enabled": True,
"rateLimit": 123,
"rateLimitWindow": "<string>",
"requireApproval": True,
"conditions": None,
"identities": [{ "id": "<string>" }],
"targets": [
{
"provider": "<string>",
"tools": ["<string>"],
"connectionId": "<string>",
"secretId": "<string>",
"hostPattern": "<string>",
"pathPattern": "<string>"
}
]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
name: '<string>',
description: '<string>',
enabled: true,
rateLimit: 123,
rateLimitWindow: '<string>',
requireApproval: true,
conditions: null,
identities: [{id: '<string>'}],
targets: [
{
provider: '<string>',
tools: ['<string>'],
connectionId: '<string>',
secretId: '<string>',
hostPattern: '<string>',
pathPattern: '<string>'
}
]
})
};
fetch('https://api.onecli.sh/v1/org/policy/rules/{ruleId}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.onecli.sh/v1/org/policy/rules/{ruleId}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'description' => '<string>',
'enabled' => true,
'rateLimit' => 123,
'rateLimitWindow' => '<string>',
'requireApproval' => true,
'conditions' => null,
'identities' => [
[
'id' => '<string>'
]
],
'targets' => [
[
'provider' => '<string>',
'tools' => [
'<string>'
],
'connectionId' => '<string>',
'secretId' => '<string>',
'hostPattern' => '<string>',
'pathPattern' => '<string>'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.onecli.sh/v1/org/policy/rules/{ruleId}"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"description\": \"<string>\",\n \"enabled\": true,\n \"rateLimit\": 123,\n \"rateLimitWindow\": \"<string>\",\n \"requireApproval\": true,\n \"conditions\": null,\n \"identities\": [\n {\n \"id\": \"<string>\"\n }\n ],\n \"targets\": [\n {\n \"provider\": \"<string>\",\n \"tools\": [\n \"<string>\"\n ],\n \"connectionId\": \"<string>\",\n \"secretId\": \"<string>\",\n \"hostPattern\": \"<string>\",\n \"pathPattern\": \"<string>\"\n }\n ]\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://api.onecli.sh/v1/org/policy/rules/{ruleId}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"description\": \"<string>\",\n \"enabled\": true,\n \"rateLimit\": 123,\n \"rateLimitWindow\": \"<string>\",\n \"requireApproval\": true,\n \"conditions\": null,\n \"identities\": [\n {\n \"id\": \"<string>\"\n }\n ],\n \"targets\": [\n {\n \"provider\": \"<string>\",\n \"tools\": [\n \"<string>\"\n ],\n \"connectionId\": \"<string>\",\n \"secretId\": \"<string>\",\n \"hostPattern\": \"<string>\",\n \"pathPattern\": \"<string>\"\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.onecli.sh/v1/org/policy/rules/{ruleId}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"description\": \"<string>\",\n \"enabled\": true,\n \"rateLimit\": 123,\n \"rateLimitWindow\": \"<string>\",\n \"requireApproval\": true,\n \"conditions\": null,\n \"identities\": [\n {\n \"id\": \"<string>\"\n }\n ],\n \"targets\": [\n {\n \"provider\": \"<string>\",\n \"tools\": [\n \"<string>\"\n ],\n \"connectionId\": \"<string>\",\n \"secretId\": \"<string>\",\n \"hostPattern\": \"<string>\",\n \"pathPattern\": \"<string>\"\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "<string>",
"scope": "organization",
"status": "draft",
"generation": 123,
"priority": 123,
"enabled": true,
"isDefault": true,
"logicalId": "<string>",
"source": "<string>",
"name": "<string>",
"description": "<string>",
"action": "allow",
"rateLimit": 123,
"rateLimitWindow": "minute",
"requireApproval": true,
"conditions": "<unknown>",
"identities": [
{
"type": "agent",
"id": "<string>"
}
],
"targets": [
{
"kind": "app",
"provider": "<string>",
"tools": [
"<string>"
],
"connectionScope": "organization",
"connectionId": "<string>",
"secretId": "<string>",
"secretScope": "organization",
"hostPattern": "<string>",
"pathPattern": "<string>",
"method": "GET"
}
],
"createdAt": "2023-11-07T05:31:56Z"
}{
"error": "<string>"
}{
"error": "<string>"
}{
"error": "<string>"
}Policy
Update an organization policy rule
Partially updates an organization policy rule. The action and modifier constraints are re-validated against the merged rule before the change is saved.
PATCH
/
org
/
policy
/
rules
/
{ruleId}
Update an organization rule
curl --request PATCH \
--url https://api.onecli.sh/v1/org/policy/rules/{ruleId} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "<string>",
"description": "<string>",
"enabled": true,
"rateLimit": 123,
"rateLimitWindow": "<string>",
"requireApproval": true,
"conditions": null,
"identities": [
{
"id": "<string>"
}
],
"targets": [
{
"provider": "<string>",
"tools": [
"<string>"
],
"connectionId": "<string>",
"secretId": "<string>",
"hostPattern": "<string>",
"pathPattern": "<string>"
}
]
}
'import requests
url = "https://api.onecli.sh/v1/org/policy/rules/{ruleId}"
payload = {
"name": "<string>",
"description": "<string>",
"enabled": True,
"rateLimit": 123,
"rateLimitWindow": "<string>",
"requireApproval": True,
"conditions": None,
"identities": [{ "id": "<string>" }],
"targets": [
{
"provider": "<string>",
"tools": ["<string>"],
"connectionId": "<string>",
"secretId": "<string>",
"hostPattern": "<string>",
"pathPattern": "<string>"
}
]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
name: '<string>',
description: '<string>',
enabled: true,
rateLimit: 123,
rateLimitWindow: '<string>',
requireApproval: true,
conditions: null,
identities: [{id: '<string>'}],
targets: [
{
provider: '<string>',
tools: ['<string>'],
connectionId: '<string>',
secretId: '<string>',
hostPattern: '<string>',
pathPattern: '<string>'
}
]
})
};
fetch('https://api.onecli.sh/v1/org/policy/rules/{ruleId}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.onecli.sh/v1/org/policy/rules/{ruleId}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'description' => '<string>',
'enabled' => true,
'rateLimit' => 123,
'rateLimitWindow' => '<string>',
'requireApproval' => true,
'conditions' => null,
'identities' => [
[
'id' => '<string>'
]
],
'targets' => [
[
'provider' => '<string>',
'tools' => [
'<string>'
],
'connectionId' => '<string>',
'secretId' => '<string>',
'hostPattern' => '<string>',
'pathPattern' => '<string>'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.onecli.sh/v1/org/policy/rules/{ruleId}"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"description\": \"<string>\",\n \"enabled\": true,\n \"rateLimit\": 123,\n \"rateLimitWindow\": \"<string>\",\n \"requireApproval\": true,\n \"conditions\": null,\n \"identities\": [\n {\n \"id\": \"<string>\"\n }\n ],\n \"targets\": [\n {\n \"provider\": \"<string>\",\n \"tools\": [\n \"<string>\"\n ],\n \"connectionId\": \"<string>\",\n \"secretId\": \"<string>\",\n \"hostPattern\": \"<string>\",\n \"pathPattern\": \"<string>\"\n }\n ]\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://api.onecli.sh/v1/org/policy/rules/{ruleId}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"description\": \"<string>\",\n \"enabled\": true,\n \"rateLimit\": 123,\n \"rateLimitWindow\": \"<string>\",\n \"requireApproval\": true,\n \"conditions\": null,\n \"identities\": [\n {\n \"id\": \"<string>\"\n }\n ],\n \"targets\": [\n {\n \"provider\": \"<string>\",\n \"tools\": [\n \"<string>\"\n ],\n \"connectionId\": \"<string>\",\n \"secretId\": \"<string>\",\n \"hostPattern\": \"<string>\",\n \"pathPattern\": \"<string>\"\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.onecli.sh/v1/org/policy/rules/{ruleId}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"description\": \"<string>\",\n \"enabled\": true,\n \"rateLimit\": 123,\n \"rateLimitWindow\": \"<string>\",\n \"requireApproval\": true,\n \"conditions\": null,\n \"identities\": [\n {\n \"id\": \"<string>\"\n }\n ],\n \"targets\": [\n {\n \"provider\": \"<string>\",\n \"tools\": [\n \"<string>\"\n ],\n \"connectionId\": \"<string>\",\n \"secretId\": \"<string>\",\n \"hostPattern\": \"<string>\",\n \"pathPattern\": \"<string>\"\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "<string>",
"scope": "organization",
"status": "draft",
"generation": 123,
"priority": 123,
"enabled": true,
"isDefault": true,
"logicalId": "<string>",
"source": "<string>",
"name": "<string>",
"description": "<string>",
"action": "allow",
"rateLimit": 123,
"rateLimitWindow": "minute",
"requireApproval": true,
"conditions": "<unknown>",
"identities": [
{
"type": "agent",
"id": "<string>"
}
],
"targets": [
{
"kind": "app",
"provider": "<string>",
"tools": [
"<string>"
],
"connectionScope": "organization",
"connectionId": "<string>",
"secretId": "<string>",
"secretScope": "organization",
"hostPattern": "<string>",
"pathPattern": "<string>",
"method": "GET"
}
],
"createdAt": "2023-11-07T05:31:56Z"
}{
"error": "<string>"
}{
"error": "<string>"
}{
"error": "<string>"
}Changes only the fields you send. OneCLI validates the merged result, so an invalid mix of action and modifiers is rejected. The change applies to every workspace right away.
Related guide: Rules: control what agents can do.
Partial. The action-versus-modifier laws are re-checked against the merged rule.
Availability: Cloud · Community (self-hosted) · Enterprise (self-hosted)
Authorizations
A workspace API key (oc_…) or organization API key (oc_org_…). Workspace-scoped endpoints called with an organization key also need X-Workspace-Id.
Path Parameters
Body
application/json
Every field optional (at least one required); nullable fields accept an explicit null to clear.
Response
The rule
A policy-engine rule. Every write is enforced immediately; the draft/published split survives only for older clients. Published row ids regenerate on every publish; logicalId is the identity stable across statuses and generations.
Available options:
organization, workspace Available options:
draft, published 0 for the draft working copy; the snapshot number for published rows.
First-match order (lower evaluates first).
True on the scope's terminal Default Rule.
Generation-stable identity; compare rules across draft/published by this, never by id.
custom (user-owned, editable), default (the Default Rule), or system-managed rows: blocklist (compiled from app blocklists) and, at workspace scope, grant (compiled from agent grants; managed through the Grants endpoints, never edited as rules).
Available options:
allow, block Available options:
minute, hour, day, null A conditions array, a session-policy object ({repositories} / {folders} / {driveFolders}), or null.
Show child attributes
Show child attributes
Show child attributes
Show child attributes