> ## Documentation Index
> Fetch the complete documentation index at: https://ona.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Update Security Policy

> Updates a security policy.

`Unary` · [`Security`](https://ona.com/docs/api-reference/generated/security/overview)

Updates a security policy.

Use this method to:

* Rename a security policy
* Change enforcement rules
* Update auditing behavior

### Examples

* Update security policy:

  Promotes one executable rule from audit to block while leaving unmatched
  executables allowed. Updating an assigned policy validates
  materializability; updating an unassigned policy only stores its spec.

  ```yaml theme={null}
  securityPolicyId: "d2c94c27-3b76-4a42-b88c-95a85e392c68"
  spec:
    executables:
      defaultEffect: EFFECT_ALLOW
      rules:
        - path: "npx"
          effect: EFFECT_BLOCK
        - path: "/usr/bin/curl"
          effect: EFFECT_BLOCK
  ```

## Endpoint

```text theme={null}
POST /api/gitpod.v1.SecurityService/UpdateSecurityPolicy
```

Send a Bearer token as described in [Authentication](https://ona.com/docs/api-reference.md#authenticate-requests). If your organization uses a custom management-plane domain, replace `https://app.ona.com` with that domain.

## Request example

```bash cURL theme={null}
export ONA_HOST=https://app.ona.com
export ONA_API_KEY=<your-token>

curl --request POST \
  --url "$ONA_HOST/api/gitpod.v1.SecurityService/UpdateSecurityPolicy" \
  --header "Authorization: Bearer $ONA_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
  "securityPolicyId": "https://example.com"
}'
```

```python Python theme={null}
import gitpod.v1.security_pb2 as security_pb2
from ona_sdk import create_client_from_env

ona = create_client_from_env()
request = security_pb2.UpdateSecurityPolicyRequest(
    security_policy_id="https://example.com",
)
response = ona.services.security.update_security_policy(request)
print(response)
```

```typescript TypeScript theme={null}
import { create } from "@bufbuild/protobuf";
import { createClientFromEnv } from "@gitpod/sdk";
import { UpdateSecurityPolicyRequestSchema } from "@gitpod/sdk/gitpod/v1/security_pb";

async function main() {
  const ona = createClientFromEnv();
  const request = create(UpdateSecurityPolicyRequestSchema, {
    securityPolicyId: "https://example.com",
  });
  const response = await ona.services.security.updateSecurityPolicy(request);
  console.log(response);
}

main().catch(console.error);
```

```go Go theme={null}
package main

import (
	"context"
	"fmt"
	"log"

	"connectrpc.com/connect"
	"github.com/gitpod-io/gitpod-sdk-go/sdk"
	gitpodpb "github.com/gitpod-io/gitpod-sdk-go/v1"
)

func main() {
	ona, err := sdk.NewFromEnv()
	if err != nil {
		log.Fatal(err)
	}

	request := connect.NewRequest(&gitpodpb.UpdateSecurityPolicyRequest{
		SecurityPolicyId: "https://example.com",
	})
	response, err := ona.Services.Security.UpdateSecurityPolicy(context.Background(), request)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(response.Msg)
}
```

```json Request body theme={null}
{
  "securityPolicyId": "https://example.com"
}
```

## Request

`gitpod.v1.UpdateSecurityPolicyRequest`

| Field | Type | Required | Description |
| - | - | - | - |
| `securityPolicyId` | string | No | Constraints: `string.uuid=true`. |
| `metadata` | [Metadata](#type-gitpod-v1-security-policy-metadata) | No | |
| `spec` | [Spec](#type-gitpod-v1-security-policy-spec) | No | |

## Response

`gitpod.v1.UpdateSecurityPolicyResponse`

| Field | Type | Required | Description |
| - | - | - | - |
| `securityPolicy` | [SecurityPolicy](#type-gitpod-v1-security-policy) | Yes | Constraints: `required=true`. |

## Related types

> [accordion] SecurityPolicy
>
> `gitpod.v1.SecurityPolicy`
>
> | Field | Type | Required | Description |
> | - | - | - | - |
> | `id` | string | No | Constraints: `string.uuid=true`. |
> | `metadata` | [Metadata](#type-gitpod-v1-security-policy-metadata) | Yes | Constraints: `required=true`. |
> | `spec` | [Spec](#type-gitpod-v1-security-policy-spec) | Yes | Constraints: `required=true`. |
> | `organizationId` | string | No | Constraints: `string.uuid=true`. |
> | `createdAt` | RFC 3339 timestamp | No | |
> | `updatedAt` | RFC 3339 timestamp | No | |

> [accordion] Metadata
>
> `gitpod.v1.SecurityPolicy.Metadata`
>
> | Field | Type | Required | Description |
> | - | - | - | - |
> | `name` | string | No | Constraints: `string.max_len=80, string.min_len=1`. |

> [accordion] Spec
>
> `gitpod.v1.SecurityPolicy.Spec`
>
> | Field | Type | Required | Description |
> | - | - | - | - |
> | `ports` | [PortPolicy](#type-gitpod-v1-security-policy-spec-port-policy) | No | |
> | `executables` | [ExecutablePolicy](#type-gitpod-v1-security-policy-spec-executable-policy) | No | executables is the public Veto Exec GA policy surface. |

> [accordion] ExecutablePolicy
>
> `gitpod.v1.SecurityPolicy.Spec.ExecutablePolicy`
>
> | Field | Type | Required | Description |
> | - | - | - | - |
> | `defaultEffect` | [Effect](#enum-gitpod-v1-security-policy-effect) | No | default\_effect controls executables that do not match a rule. For Veto Exec, omit this field or set it to EFFECT\_ALLOW. EFFECT\_UNSPECIFIED is normalized to EFFECT\_ALLOW. |
> | `rules` | array of Rule | No | rules contains executable-specific audit or block decisions. |

> [accordion] PortPolicy
>
> `gitpod.v1.SecurityPolicy.Spec.PortPolicy`
>
> | Field | Type | Required | Description |
> | - | - | - | - |
> | `maxAdmissionLevel` | [AdmissionLevel](#enum-gitpod-v1-admission-level) | No | max\_admission\_level caps the maximum admission level for user-opened ports in environments assigned this security policy. UNSPECIFIED applies no additional cap. |

> [accordion] AdmissionLevel
>
> Admission level describes who can access an environment instance and its ports.
>
> | Value | Number | Description |
> | - | -: | - |
> | `ADMISSION_LEVEL_UNSPECIFIED` | 0 | |
> | `ADMISSION_LEVEL_OWNER_ONLY` | 1 | **Deprecated.** ADMISSION\_LEVEL\_OWNER\_ONLY means the environment can only be accessed by the creator. Deprecated: Use ADMISSION\_LEVEL\_CREATOR\_ONLY instead. |
> | `ADMISSION_LEVEL_EVERYONE` | 2 | ADMISSION\_LEVEL\_EVERYONE means the environment (including ports) can be accessed by everyone. |
> | `ADMISSION_LEVEL_ORGANIZATION` | 3 | ADMISSION\_LEVEL\_ORGANIZATION means the environment (including ports) can be accessed by all members of the organization. |
> | `ADMISSION_LEVEL_CREATOR_ONLY` | 4 | ADMISSION\_LEVEL\_CREATOR\_ONLY means the environment (including ports) can only be accessed by the user who created the environment. |

> [accordion] Effect
>
> | Value | Number | Description |
> | - | -: | - |
> | `EFFECT_UNSPECIFIED` | 0 | |
> | `EFFECT_ALLOW` | 1 | |
> | `EFFECT_BLOCK` | 2 | |
> | `EFFECT_AUDIT` | 3 | |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.