> This page is for Self-Hosted, version v3.0 (default). > For other versions, use one of these documentation indexes: > - v3.0 (default): https://docs.nvidia.com/run-ai/self-hosted/v3.0/llms.txt > - v2.26: https://docs.nvidia.com/run-ai/self-hosted/v2.26/llms.txt > - v2.25: https://docs.nvidia.com/run-ai/self-hosted/v2.25/llms.txt > - v2.24: https://docs.nvidia.com/run-ai/self-hosted/v2.24/llms.txt > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/run-ai/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/run-ai/_mcp/server. # Patch a policy. [experimental] PATCH http://localhost:8080/api/v1/policies/{PolicyId} Content-Type: application/json Merge rules into an existing policy, keyed by rule identity. Reference: https://docs.nvidia.com/run-ai/self-hosted/reference/rest-api/endpoints/policies/policy/patch-gvk-policy ## Authentication - `Authorization` header (bearer token, required) — Bearer authentication ## Request ### Path parameters - `PolicyId` (string, required) — The unique identifier for the policy. ### Body (application/json) This endpoint expects an UpdateGvkPolicyReq. - `description` (string, optional) — A description of the policy. - `rules` (list of PolicyRule, optional) — The rules declared on this policy. Each rule targets a field in the workload spec and constrains its allowed values through its enforcements. ## Response ### 200 The updated policy. - `createdAt` (datetime, required) — The timestamp for when the policy was created. - `createdBy` (string, required) — Identifier of the user who created the policy. - `id` (string, required) — The unique identifier for the policy. - `scope` (enum, required) - Allowed values: `system`, `tenant`, `cluster`, `department`, `project` - `updatedAt` (datetime, required) — The timestamp for when the policy was last updated. - `updatedBy` (string, required) — Identifier of the user who last updated the policy. - `workloadType` (GVK, required) — Specifies the Group, Version, and Kind (GVK) of the Kubernetes resource that defines the workload. - `clusterId` (string, optional, nullable) — The id of the cluster the policy applies to. Required when the scope is cluster. - `departmentId` (string, optional, nullable) — The id of the department the policy applies to. Required when the scope is department. - `description` (string, optional) — A description of the policy. - `effectiveRules` (list of EffectiveRulesEffectiveRulesItems, optional) — The merged rule set in effect for this policy, including rules inherited from broader scopes (cluster, then department, then project). Each entry adds the sourceOfRule indicating where the rule was defined. Returned in responses only; not accepted in requests. - `projectId` (string, optional, nullable) — The id of the project the policy applies to. Required when the scope is project. - `rules` (list of PolicyRule, optional) — The rules declared on this policy. Each rule targets a field in the workload spec and constrains its allowed values through its enforcements. - `status` (PolicyStatus, optional, nullable) — Configuration issues detected by the server for this policy. Returned in responses only; not accepted in requests. ## Errors ### 400 Bad Request Error Bad request. - `code` (integer, required) - `message` (string, required) - `details` (string, optional) ### 401 Unauthorized Error Unauthorized - `code` (integer, required) - `message` (string, required) - `details` (string, optional) ### 403 Forbidden Error Forbidden - `code` (integer, required) - `message` (string, required) - `details` (string, optional) ### 404 Not Found Error The specified resource was not found - `code` (integer, required) - `message` (string, required) - `details` (string, optional) ### 503 Service Unavailable Error unexpected error - `code` (integer, required) - `message` (string, required) - `details` (string, optional) ## Types ### PolicyRule A single policy rule. It combines the rule's identity (the field it targets, along with the spec selector, optional item selector, and selector parameters) with its enforcements (the behavior that constrains the field's allowed values). - `field` (string, required) — The unique name of the field. - `specSelector` (string, required) — The unique name of the spec selector - `enforcements` (list of PolicyRuleEnforcement, required) — The set of enforcements that define the rule's behavior. Each enforcement pairs an enforcement type with its value, and multiple enforcements may combine on a single rule to constrain the targeted field. - `itemSelector` (string, optional, nullable) — The name of the item selector that picks specific items of an itemized field. Omit for non-itemized fields. - `selectorParams` (map from string to any, optional) — The parameter values supplied to the spec selector and item selector at evaluation time, as a key-value map. - `allowOverride` (boolean, optional, nullable) — when false, a child scope cannot override this rule. default to false. ### GVK Specifies the Group, Version, and Kind (GVK) of the Kubernetes resource that defines the workload. - `version` (string, required) — The API version of the resource within the specified group. - `kind` (string, required) — The type of Kubernetes resource being referenced. - `group` (string, optional, nullable) — The API group of the Kubernetes resource. Empty string for core resources like Pod. ### EffectiveRulesEffectiveRulesItems The origin of an effective rule. Identifies the scope at which the rule was defined and the matching project, department, or cluster id. Set by the server on effective rules in responses only; leave empty in requests. - `field` (string, required) — The unique name of the field. - `specSelector` (string, required) — The unique name of the spec selector - `enforcements` (list of PolicyRuleEnforcement, required) — The set of enforcements that define the rule's behavior. Each enforcement pairs an enforcement type with its value, and multiple enforcements may combine on a single rule to constrain the targeted field. - `sourceOfRule` (SourceOfRule, required) — This field is used by the system along with effective rules, in order to specify the org unit from which this effective rule has been derived. It should be left empty when sending apply policy requests. - `itemSelector` (string, optional, nullable) — The name of the item selector that picks specific items of an itemized field. Omit for non-itemized fields. - `selectorParams` (map from string to any, optional) — The parameter values supplied to the spec selector and item selector at evaluation time, as a key-value map. - `allowOverride` (boolean, optional, nullable) — when false, a child scope cannot override this rule. default to false. ### PolicyStatus Configuration issues detected by the server for the policy, along with its current phase. - `phase` (enum, optional) — The current phase of the policy. Supported values include: - Ready: The policy is fully validated, and all rules are successfully applied to the workload. - PendingUpdate: Configuration components (e.g., specSelector, itemSelector) have changed. The policy is awaiting validation to ensure the full rule set remains functional; this validation occurs the next time the policy is applied. - Degraded: One or more policy rules cannot be applied due to recent configuration changes. While the policy remains active, some rules may be ignored during enforcement. - Allowed values: `Ready`, `PendingUpdate`, `Degraded` - `issues` (list of string, optional) — The list of configuration issues detected for the policy. ### PolicyRuleEnforcement A single enforcement on a policy rule. Exactly one enforcement type is expressed per object (for example set, default, required, blocked, options, match, or one of the grouped range, length, elements, items, or quantityRange constraints); combine multiple enforcement objects on a rule to apply several constraints to the same field. ### SourceOfRule This field is used by the system along with effective rules, in order to specify the org unit from which this effective rule has been derived. It should be left empty when sending apply policy requests. - `scope` (enum, required) - Allowed values: `system`, `tenant`, `cluster`, `department`, `project` - `projectId` (integer, optional) — The id of the project. - `departmentId` (string, optional) — The id of the department. - `clusterId` (string, optional) — The id of the cluster. - `isFallback` (boolean, optional) — source of this rule is the fallback policy ### PolicyEnforcementSet - `set` (map from string to any, optional) — Enforces the value of the field. ### PolicyEnforcementDefault - `default` (map from string to any, optional) — Sets the value of the field when the user does not supply one. ### PolicyEnforcementRequired - `required` (boolean, optional, nullable, default: false) — Requires the field to have a value, supplied either in the submission or by a policy default. ### PolicyEnforcementBlocked - `blocked` (boolean, optional, nullable, default: false) — Prevents the field from being assigned any value. Inverse of "required". ### PolicyEnforcementLength - `length` (PolicyEnforcementLengthLength, optional, nullable) — Enforces the field's length (character count for strings, element count for slices, arrays, and maps) to fall within the inclusive range [min, max]. At least one of `min`/`max` must be specified. ### PolicyEnforcementOptions - `options` (list of string, optional, nullable) — Restricts the value of the field to one of the listed options. ### PolicyEnforcementMatch - `match` (string, optional, nullable) — Requires the value of the field to match the regular expression. ### PolicyEnforcementRange - `range` (PolicyEnforcementRangeRange, optional, nullable) — Enforces a numeric value to fall within the inclusive range [min, max], optionally restricted to increments of `step` starting from `min`. ### PolicyEnforcementElements - `elements` (PolicyEnforcementElementsElements, optional, nullable) — Enforces the number of elements in an array field to fall within the inclusive range [min, max]. At least one of `min`/`max` must be specified. ### PolicyEnforcementItems - `items` (PolicyEnforcementItemsItems, optional, nullable) — Enforces the number of items produced by a field's itemSelector to fall within the inclusive range [min, max]. At least one of `min`/`max` must be specified. Applies only to fields that declare itemSelectors. ### PolicyEnforcementQuantityRange - `quantityRange` (PolicyEnforcementQuantityRangeQuantityRange, optional, nullable) — Enforces a Kubernetes resource quantity to fall within the inclusive range [min, max], optionally restricted to increments of `step` starting from `min`. All bounds must be valid Kubernetes quantities such as 100m, 1Gi, or 500Mi. ### PolicyEnforcementLengthLength Enforces the field's length (character count for strings, element count for slices, arrays, and maps) to fall within the inclusive range [min, max]. At least one of `min`/`max` must be specified. - `min` (integer, optional, nullable) — Enforces the minimum length. - `max` (integer, optional, nullable) — Enforces the maximum length. ### PolicyEnforcementRangeRange Enforces a numeric value to fall within the inclusive range [min, max], optionally restricted to increments of `step` starting from `min`. - `min` (double, optional, nullable) — Enforces the minimum numeric value of the field. - `max` (double, optional, nullable) — Enforces the maximum numeric value of the field. - `step` (double, optional, nullable) — Restricts the field value to specific numeric increments starting from `min` (or from 0 when `min` is absent). Must be greater than 0. ### PolicyEnforcementElementsElements Enforces the number of elements in an array field to fall within the inclusive range [min, max]. At least one of `min`/`max` must be specified. - `min` (integer, optional, nullable) — Enforces the minimum number of elements. - `max` (integer, optional, nullable) — Enforces the maximum number of elements. ### PolicyEnforcementItemsItems Enforces the number of items produced by a field's itemSelector to fall within the inclusive range [min, max]. At least one of `min`/`max` must be specified. Applies only to fields that declare itemSelectors. - `min` (integer, optional, nullable) — Enforces the minimum number of items. - `max` (integer, optional, nullable) — Enforces the maximum number of items. ### PolicyEnforcementQuantityRangeQuantityRange Enforces a Kubernetes resource quantity to fall within the inclusive range [min, max], optionally restricted to increments of `step` starting from `min`. All bounds must be valid Kubernetes quantities such as 100m, 1Gi, or 500Mi. - `min` (string, optional, nullable) — Enforces the minimum quantity value of the field. - `max` (string, optional, nullable) — Enforces the maximum quantity value of the field. - `step` (string, optional, nullable) — Restricts the field value to specific quantity increments starting from `min` (or from 0 when `min` is absent). ## Examples **Request** ```json {} ``` **Response** ```json { "createdAt": "2024-01-15T09:30:00Z", "createdBy": "string", "id": "string", "scope": "system", "updatedAt": "2024-01-15T09:30:00Z", "updatedBy": "string", "workloadType": { "version": "v1", "kind": "Deployment", "group": "apps" }, "clusterId": "string", "departmentId": "string", "description": "a short description of the policy", "effectiveRules": [ { "field": "containerPort", "specSelector": "containerByName", "enforcements": [ { "set": { "containerPort": 1234, "protocol": "TCP" } } ], "sourceOfRule": { "scope": "project", "projectId": 3 }, "itemSelector": "string", "selectorParams": { "containerName": "my-container" }, "allowOverride": true } ], "projectId": "string", "rules": [ { "field": "containerPort", "specSelector": "containerByName", "enforcements": [ { "set": { "containerPort": 1234, "protocol": "TCP" } } ], "itemSelector": "string", "selectorParams": { "containerName": "my-container" }, "allowOverride": true } ], "status": { "phase": "Ready", "issues": [ "configuration-issue-1", "configuration-issue-2" ] } } ``` **SDK Code** ```python import requests url = "http://localhost:8080/api/v1/policies/PolicyId" payload = {} headers = { "Authorization": "Bearer ", "Content-Type": "application/json" } response = requests.patch(url, json=payload, headers=headers) print(response.json()) ``` ```javascript const url = 'http://localhost:8080/api/v1/policies/PolicyId'; const options = { method: 'PATCH', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "http://localhost:8080/api/v1/policies/PolicyId" payload := strings.NewReader("{}") req, _ := http.NewRequest("PATCH", url, payload) req.Header.Add("Authorization", "Bearer ") req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("http://localhost:8080/api/v1/policies/PolicyId") http = Net::HTTP.new(url.host, url.port) request = Net::HTTP::Patch.new(url) request["Authorization"] = 'Bearer ' request["Content-Type"] = 'application/json' request.body = "{}" response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.patch("http://localhost:8080/api/v1/policies/PolicyId") .header("Authorization", "Bearer ") .header("Content-Type", "application/json") .body("{}") .asString(); ``` ```php request('PATCH', 'http://localhost:8080/api/v1/policies/PolicyId', [ 'body' => '{}', 'headers' => [ 'Authorization' => 'Bearer ', 'Content-Type' => 'application/json', ], ]); echo $response->getBody(); ``` ```csharp using RestSharp; var client = new RestClient("http://localhost:8080/api/v1/policies/PolicyId"); var request = new RestRequest(Method.PATCH); request.AddHeader("Authorization", "Bearer "); request.AddHeader("Content-Type", "application/json"); request.AddParameter("application/json", "{}", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```swift import Foundation let headers = [ "Authorization": "Bearer ", "Content-Type": "application/json" ] let parameters = [] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "http://localhost:8080/api/v1/policies/PolicyId")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "PATCH" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```