Update policy¶

PATCH/policies/{policyId}

Endpoint API · Policy Management

Update policy. Note you can only change the settings for a base policy and roles with only assignment permissions can only change the ChangeUsersOrDevicesPolicyAppliesTo field.

Parameters¶

Name	In	Type	Required	Description
`X-Tenant-ID`	header	string (uuid)	Yes	Tenant ID.
`policyId`	path	string (uuid)	Yes	Policy ID.

Request body¶

Content type: application/json

Request body fields

namestring

Policy name.
Must match the pattern ^\S(?:.*\S)?$. Must be at most 100 characters long.

priorityinteger

Policy priority.

enabledboolean

Whether the policy is turned on.

disableAtstring (date-time)

When the policy should be turned off. Set to null to remove the scheduled disable time.

appliesToOption 1 or Option 2

Option 1

Endpoints or endpoint-groups the policy is applied to.

Show child attributesHide child attributes

endpointsarray of string (uuid)

Items must be unique.

endpointGroupsarray of string (uuid)

Items must be unique.

Option 2

Users or user-groups the policy is applied to.

Show child attributesHide child attributes

usersarray of string (uuid)

Items must be unique.

userGroupsarray of string (uuid)

Items must be unique.

addAppliesToOption 1 or Option 2

Option 1

Endpoints or endpoint-groups the policy is applied to.

Show child attributesHide child attributes

endpointsarray of string (uuid)

Items must be unique.

endpointGroupsarray of string (uuid)

Items must be unique.

Option 2

Users or user-groups the policy is applied to.

Show child attributesHide child attributes

usersarray of string (uuid)

Items must be unique.

userGroupsarray of string (uuid)

Items must be unique.

removeAppliesToOption 1 or Option 2

Option 1

Endpoints or endpoint-groups the policy is applied to.

Show child attributesHide child attributes

endpointsarray of string (uuid)

Items must be unique.

endpointGroupsarray of string (uuid)

Items must be unique.

Option 2

Users or user-groups the policy is applied to.

Show child attributesHide child attributes

usersarray of string (uuid)

Items must be unique.

userGroupsarray of string (uuid)

Items must be unique.

settingsobject

Keys have specific names documented here.

Request samples¶

cURLPythonPowerShellGoJavaScript

curl -X PATCH "https://api-<data-region>.central.sophos.com/endpoint/v1/policies/<policyId>" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
  \"name\": \"Block Acme app\"
}"

import requests

response = requests.patch(
    "https://api-<data-region>.central.sophos.com/endpoint/v1/policies/<policyId>",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
        "Content-Type": "application/json",
    },
    json={'name': 'Block Acme app'},
)
print(response.json())

$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
    "Content-Type" = "application/json"
}
$body = '{
  "name": "Block Acme app"
}'
Invoke-RestMethod -Method PATCH -Uri "https://api-<data-region>.central.sophos.com/endpoint/v1/policies/<policyId>" -Headers $headers -Body $body -ContentType "application/json"

package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, err := http.NewRequest("PATCH", "https://api-<data-region>.central.sophos.com/endpoint/v1/policies/<policyId>", strings.NewReader(`{
  "name": "Block Acme app"
}`))
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}

const response = await fetch("https://api-<data-region>.central.sophos.com/endpoint/v1/policies/<policyId>", {
  method: "PATCH",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
  "name": "Block Acme app"
}),
});
const data = await response.json();
console.log(data);

Responses¶

`200` — Updated policy.¶

Response fields

idstring (uuid)required

Unique API identifier for the policy.

namestringrequired

Policy name.
Must be at most 50 characters long.

typestringrequired

Policy type.
Must be one of: threat-protection, peripheral-control, application-control, web-control, agent-updating, windows-firewall, device-encryption, data-collection-and-investigation, endpoint-dns-protection, server-threat-protection, server-peripheral-control, server-application-control, server-web-control, server-lockdown, server-agent-updating, server-windows-firewall, server-file-integrity-monitoring, server-linux-runtime-detection, server-data-collection-and-investigation.

lockedByManagingAccountbooleanrequired

Whether the policy is managed by a partner or organization, 'true' mean yes.

priorityintegerrequired

Policy priority.

tenantobjectrequired

Tenant these resources belong to.

Show child attributesHide child attributes

idstring (uuid)required

namestring

enabledbooleanrequired

Whether the policy is turned on.

settingsobjectrequired

Keys have specific names documented here.

appliesToOption 1 or Option 2

Option 1

Endpoints or endpoint-groups the policy is applied to.

Show child attributesHide child attributes

endpointsarray of string (uuid)

Items must be unique.

endpointGroupsarray of string (uuid)

Items must be unique.

Option 2

Users or user-groups the policy is applied to.

Show child attributesHide child attributes

usersarray of string (uuid)

Items must be unique.

userGroupsarray of string (uuid)

Items must be unique.

disableAtstring (date-time)

When the policy should be turned off.

createdAtstring (date-time)

Time the policy was created.

createdByobject

Show child attributesHide child attributes

idstringrequired

Principal ID.

typestring (enum)required

Type of the Principal.
Must be one of: user, service.

namestring

Principal name.

accountTypestring

Account type.
Must be one of: partner, tenant, organization.

accountIdstring (uuid)

Account ID.

updatedAtstring (date-time)

Time the policy was last updated.

updatedByobject

Show child attributesHide child attributes

idstringrequired

Principal ID.

typestring (enum)required

Type of the Principal.
Must be one of: user, service.

namestring

Principal name.

accountTypestring

Account type.
Must be one of: partner, tenant, organization.

accountIdstring (uuid)

Account ID.

Errors¶

Status	Meaning
`400`	Bad request. If it is a base policy, then only settings can be updated. If the role of the caller only has assignment permissions, then only appliesTo field can be updated.
`404`	Can't find setting value.
`409`	Can't update base policies and policies locked by a managing account.
`500`	Unexpected error.

All error responses share the same shape — see the error response object.

Response examples¶

`200`¶

{
  "id": "00000000-0000-0000-0000-000000000000",
  "name": "string",
  "type": "threat-protection",
  "lockedByManagingAccount": true,
  "priority": 0,
  "tenant": {
    "id": "00000000-0000-0000-0000-000000000000",
    "name": "string"
  },
  "enabled": true,
  "settings": {
    "endpoint.malware.enabled": {
      "value": true,
      "recommendedValue": true,
      "sophosManaged": true
    },
    "endpoint.scans.scheduled.days": {
      "format": "string",
      "value": [
        "monday",
        "wednesday",
        "friday"
      ]
    },
    "endpoint.scans.scheduled.hour": {
      "value": "21:00"
    },
    "endpoint.scans.scheduled.start-from": {
      "value": "2020-05-13T21:00:01.000Z",
      "format": "date-time"
    },
    "endpoint.disk-encryption.key-expiration": {
      "value": 24,
      "unit": "hours",
      "recommendedValue": 48
    }
  },
  "appliesTo": {
    "endpoints": [
      "137430ce-3e8a-11eb-b378-0242ac130002",
      "5dfbf8e4-98c9-43a7-8fbd-e197d714c6a3"
    ],
    "endpointGroups": [
      "2116ec26-3e8a-11eb-b378-0242ac130002",
      "67c54c41-6ef3-42c4-9d54-04f7bc905056"
    ]
  },
  "disableAt": "2026-07-28T00:00:00Z",
  "createdAt": "2026-07-28T00:00:00Z",
  "createdBy": {
    "id": "string",
    "type": "user",
    "name": "string",
    "accountType": "partner",
    "accountId": "00000000-0000-0000-0000-000000000000"
  },
  "updatedAt": "2026-07-28T00:00:00Z",
  "updatedBy": {
    "id": "string",
    "type": "user",
    "name": "string",
    "accountType": "partner",
    "accountId": "00000000-0000-0000-0000-000000000000"
  }
}

See the guide for a narrative walkthrough of this API.

Update policy¶

Parameters¶

Request body¶

Request samples¶

Responses¶

200 — Updated policy.¶

Errors¶

Response examples¶

200¶

`200` — Updated policy.¶

`200`¶