auth.v1.PolicyService
UpdateApiPolicy
Change selected fields on an existing API key policy template.
Request
curl --request POST \ \
--url 'https://api.testnet.polyester.com/auth.v1.PolicyService/UpdateApiPolicy' \
--header 'Content-Type: application/json' \
--header 'Connect-Protocol-Version: 1' \
--data '{
"expectedRevision": "1",
"policy": {
"actions": [
"TRADE_SPOT"
],
"description": "Example configuration for the API playground.",
"isTemplate": false,
"name": "value",
"spotMarketScope": "ALL",
"spotMarkets": [
{
"symbolId": 1
}
]
},
"policyId": "1",
"updateMask": {
"paths": [
"value"
]
}
}'Responses
{
"policy": {
"actions": [
"TRADE_SPOT"
],
"createdAt": "2025-01-01T00:00:00Z",
"description": "Allow market and account data reads.",
"id": "1",
"isTemplate": false,
"name": "Read-Only Analytics",
"revision": "1",
"sourceTemplateId": "1",
"spotMarketScope": "ALL",
"spotMarkets": [
{
"symbolId": 1
}
],
"updatedAt": "2025-01-01T00:00:00Z"
}
}auth.v1.UpdateApiPolicyRequestauth.v1.UpdateApiPolicyResponsePolicy identifier (opaque ID).
Human-readable policy name. Create requires a non-empty value; update validates it after merging fields selected by update_mask.
Optional policy description for dashboards and audits. Maximum 256 characters.
Allowed spot markets for this API key policy.
Market-level scope for spot markets. When unspecified, defaults to ALL.
High-level actions enabled for the API key policy. An empty list grants no access. Up to 64 unique explicit actions are allowed.
Whether this policy should be treated as a reusable template.
The set of field mask paths.
Revision returned by the latest successful read. Stale revisions fail with a conflict before no-op detection.
Policy identifier (opaque ID).
Human-readable policy name.
Optional policy description for dashboards and audits.
Stable numeric pair ID.
High-level actions enabled for this API key. Up to 64 unique explicit actions may be returned.
Market-level scope for spot markets. When ALL, spot_markets is returned for display only and is not enforced.
When true, this policy is intended to be reused as a template across multiple API keys. When false, it represents a single-key instance.
Optional source template this policy was copied from (opaque ID). This is audit metadata only and does not imply live linkage.
Creation time in UTC.
Last update time in UTC.
Monotonic resource revision used for conditional updates.
| Key | HTTP status | Connect code | Error | When |
|---|---|---|---|---|
| unauthenticated | 401 | unauthenticated | Unauthenticated | Authentication required. |
| permission-denied | 403 | permission_denied | Permission Denied | Permission denied. |
| invalid-argument | 400 | invalid_argument | Invalid Argument | Invalid argument. |
| not-found | 404 | not_found | Not Found | Not found. |
| unavailable | 503 | unavailable | Unavailable | Service unavailable. |