Change the mode of a policy in one Autonomy Zone

PATCH/api/public/v1/policies/{public_id}

disabled | monitor | enforce, on the attachment at zone_id — every other zone keeps its own mode. Without zone_id, the AIP's only attachment: 409 ZONE_REQUIRED when it is in several, 409 NOT_ATTACHED in none; a zone_id that holds no attachment answers 409 INHERITED_HERE. Writes a policy_history row, bumps that zone's revision, and the next composition reflects it. Switching to Enforce on a policy with no enforceable atom answers 409 NOT_ACTIVATABLE. Switching a Disabled attachment on is refused the same way when an intent failed verification or can never fire, and is proved against the layers above that zone: 409 LOOSENS_LAYER with the counterexample, 503 PROOF_UNAVAILABLE when the proof cannot finish. Only a ratified policy can have its mode changed. An agent (OAuth) caller must send the version of the policy it read: missing answers 428 POLICY_VERSION_REQUIRED, one that is no longer current 409 POLICY_VERSION_STALE; the check runs on every call, a change that changes nothing included.

cURL

curl --fail-with-body -X PATCH 'https://app.openlatch.ai/api/public/v1/policies/<policy_public_id>' \
  -H "Authorization: Bearer $OPENLATCH_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"mode":"monitor","zone_id":"<zone_id>"}'

Python

import json
import os
import urllib.request

body = '{"mode":"monitor","zone_id":"<zone_id>"}'
request = urllib.request.Request(
    'https://app.openlatch.ai/api/public/v1/policies/<policy_public_id>',
    method='PATCH',
    data=body.encode(),
    headers={
        'Authorization': 'Bearer ' + os.environ['OPENLATCH_API_KEY'],
        'Content-Type': 'application/json',
    },
)
with urllib.request.urlopen(request) as response:
    text = response.read().decode()
    print(json.dumps(json.loads(text), indent=2) if text else response.status)

Bash

#!/usr/bin/env bash
set -euo pipefail

curl -sS --fail-with-body -X PATCH 'https://app.openlatch.ai/api/public/v1/policies/<policy_public_id>' \
  -H "Authorization: Bearer $OPENLATCH_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"mode":"monitor","zone_id":"<zone_id>"}' | jq .

PowerShell

$headers = @{
  Authorization = "Bearer $env:OPENLATCH_API_KEY"
}
$body = '{"mode":"monitor","zone_id":"<zone_id>"}'
Invoke-RestMethod -Method PATCH -Uri 'https://app.openlatch.ai/api/public/v1/policies/<policy_public_id>' -Headers $headers -ContentType 'application/json; charset=utf-8' -Body $body | ConvertTo-Json -Depth 20

Authorization

Role in the organization	This endpoint
owner	Allowed
admin	Allowed
editor	Allowed
viewer	Not allowed

A key carries the role its owner holds in the organization. See Authentication.

API key scope: policies:write

Path parameters

Parameter	Type	Description
public_id	string	Required.

Header parameters

Parameter	Type	Description
Idempotency-Key	string or null	Optional. Makes the request safe to retry: the same key and the same request, within 24 hours, returns the stored response with Idempotent-Replayed: true and runs once.

Request body

Field	Type	Description
mode	string — one of disabled, monitor, enforce	Required.
version	integer or null	The version of the policy the caller read. Required of an agent (OAuth) caller: missing answers 428 POLICY_VERSION_REQUIRED, a version that is no longer current 409 POLICY_VERSION_STALE. An API-key caller may send it and is checked when it does.
zone_id	string (uuid) or null

Response

• 200 OK — the call succeeded.
• 400 Bad Request — BAD_REQUEST
• 401 Unauthorized — UNAUTHORIZED
• 402 Payment Required — license_expired
• 403 Forbidden — FEATURE_DISABLED, FORBIDDEN, INSUFFICIENT_SCOPE
• 404 Not Found — NOT_FOUND
• 409 Conflict — CONFLICT, IDEMPOTENCY_IN_PROGRESS, INHERITED_HERE, LOOSENS_LAYER, NOT_ACTIVATABLE, NOT_ATTACHED, NOT_RATIFIED, POLICY_VERSION_STALE, SAME_LAYER_CONFLICT, ZONE_REQUIRED
• 422 Unprocessable Content — IDEMPOTENCY_KEY_REUSED, INVALID_ID, VALIDATION_ERROR
• 428 Precondition Required — POLICY_VERSION_REQUIRED
• 429 Too Many Requests — TOO_MANY_REQUESTS
• 500 Internal Server Error — INTERNAL_SERVER_ERROR, tenant_isolation_violation
• 503 Service Unavailable — ENGINE_UNAVAILABLE, FEATURE_STATE_UNAVAILABLE, PROOF_UNAVAILABLE, SERVICE_UNAVAILABLE

Response fields

Field	Type	Description
anomalies_7d	integer
attached_here	boolean	Whether the viewed zone holds its own attachment.
attachment_mode	string — one of disabled, monitor, enforce or null	The viewed zone's own attachment mode; null when it only inherits the AIP.
coverage	object	Required. D-66 — installs counted from stamped negotiation, never from mode + recent poll.
coverage.compatibility_unavailable_installs	integer	Required.
coverage.enforced_installs	integer	Required.
dimensions	array of string	Required.
display_title	string	The AIP's name: its title, else its generated_title, else its statement.
effective_layer	object or null	The zone whose attachment sets effective_mode when it is not layer; null otherwise.
effective_layer.inherited	boolean	Required.
effective_layer.label	string	Required.
effective_layer.unit_id	string	Required.
effective_layer.zone_id	string	Required.
effective_mode	string — one of disabled, monitor, enforce or null	The mode the AIP runs in at the viewed zone: the strictest attachment on its path.
id	string	Required.
intents	object	Required. How many of the policy's atoms are actually enforceable.
intents.enforceable	integer	Required.
intents.monitor_only	integer	Required.
intents.total	integer	Required.
layer	object	Required. The layer a policy row is labelled with: the zone being viewed when it holds the AIP, else the zone whose attachment sets its mode there. `inherited` is true when the viewed zone holds no attachment of it.
layer.inherited	boolean	Required.
layer.label	string	Required.
layer.unit_id	string	Required.
layer.zone_id	string	Required.
mode	string	Required. Deprecated: attachment_mode when the viewed zone holds it, else effective_mode.
preset	object or null
preset.application_id	string	Required.
preset.preset_id	string	Required.
preset.preset_name	string	Required.
preset.preset_policy_key	string	Required.
preset.preset_version	integer	Required.
public_id	string	Required.
statement	string	Required.
status	string	Required.
version	integer	Required.

Example response

{
  "anomalies_7d": 0,
  "attached_here": false,
  "attachment_mode": "disabled",
  "coverage": {
    "compatibility_unavailable_installs": 3,
    "enforced_installs": 3
  },
  "dimensions": [
    "string"
  ],
  "display_title": "",
  "effective_layer": {
    "inherited": false,
    "label": "string",
    "unit_id": "3f6c1a2e-8b4d-4c1f-9a7e-0d5b2c8e4f10",
    "zone_id": "3f6c1a2e-8b4d-4c1f-9a7e-0d5b2c8e4f10"
  },
  "effective_mode": "disabled",
  "id": "3f6c1a2e-8b4d-4c1f-9a7e-0d5b2c8e4f10",
  "intents": {
    "enforceable": 3,
    "monitor_only": 3,
    "total": 3
  },
  "layer": {
    "inherited": false,
    "label": "string",
    "unit_id": "3f6c1a2e-8b4d-4c1f-9a7e-0d5b2c8e4f10",
    "zone_id": "3f6c1a2e-8b4d-4c1f-9a7e-0d5b2c8e4f10"
  },
  "mode": "string",
  "preset": {
    "application_id": "3f6c1a2e-8b4d-4c1f-9a7e-0d5b2c8e4f10",
    "preset_id": "3f6c1a2e-8b4d-4c1f-9a7e-0d5b2c8e4f10",
    "preset_name": "release-bot",
    "preset_policy_key": "string",
    "preset_version": 3
  },
  "public_id": "3f6c1a2e-8b4d-4c1f-9a7e-0d5b2c8e4f10",
  "statement": "string",
  "status": "string",
  "version": 3
}

Related

• POST State sentences as a policy
• DELETE Delete a policy
• GET Read one ratified policy