Dependency-Track unofficial
POST/v1/policy

Update a policy

Updates an existing policy. If you submit a request body, include name, operator, uuid, and violationState; the body itself may be omitted. The authenticated user must have POLICY_MANAGEMENT or POLICY_MANAGEMENT_UPDATE permission.

  • IdempotentThe SDK sends Idempotency-Key, so a retried request is only applied once.

11 body fields

Optional policy data for the update. If you send a body, name, operator, uuid, and violationState are required.

globalbooleanoptional
Whether the policy applies globally.
includeChildrenbooleanoptional
Whether the policy includes child projects.
invertTagMatchbooleanoptional
Whether to invert the policy's tag-matching behavior.
namestringrequired
The policy name. Must be 1 to 255 characters.
onlyLatestProjectVersionbooleanoptional
Whether the policy applies only to the latest project version.
operatorstringrequired
The policy matching operator: `ALL` or `ANY`.
Allowed:ALLANY
policyConditionsarray<object>optional
Conditions used to evaluate the policy. Each condition requires `operator`, `subject`, `uuid`, and `value`; its operator and violation type must use the schema's listed values.
projectsarray<object>optional
Project records associated with the policy. Each project requires `lastBomImport`, `name`, and `uuid`.
tagsarray<object>optional
Unique tags associated with the policy. Each tag requires a `name`.
uuidstringrequired
The policy's UUID, in UUID format.
violationStatestringrequired
The policy violation state: `INFO`, `WARN`, or `FAIL`.
Allowed:INFOWARNFAIL

3 status codes
200Returns the updated policy object, including its policy settings, conditions, associated projects, and tags.
globalbooleanoptional
includeChildrenbooleanoptional
invertTagMatchbooleanoptional
namestringrequired
onlyLatestProjectVersionbooleanoptional
operatorstringrequired
Allowed:ALLANY
policyConditionsarray<object>optional
projectsarray<object>optional
tagsarray<object>optional
uuidstringrequired
violationStatestringrequired
Allowed:INFOWARNFAIL
401Returned when the authenticated user is unauthorized to update the policy.
404Returned when the policy could not be found.

Error handling

A 401 is returned when the authenticated user lacks POLICY_MANAGEMENT or POLICY_MANAGEMENT_UPDATE. A 404 is returned when the policy identified by uuid cannot be found. If you send a body, name, operator, uuid, and violationState are required; operator must be ALL or ANY, violationState must be INFO, WARN, or FAIL, and uuid must use UUID format.