# Update an advanced API access policy (/docs/apis/management/resources/PatchApiAccessAdvancedPolicy)

`PATCH /resources/api_resources/{api_id}/policies/advanced/{policy_id}`

Applies a partial update to the specified advanced API access policy. Only fields included in the request are updated.

Base URL: `https://{tenant}.{region}.monocloud.com/api`, where `{tenant}`, `{region}` (one of us, eu, in) come from your tenant. Authentication: send your Management API key in the `X-API-KEY` header.

## Parameters

- `api_id` (path) (string, required) The unique identifier of the API resource.
- `policy_id` (path) (string, required) The unique identifier of the API access policy.

## Request body

JSON, required. The request payload used to update the policy.

- `enabled` (boolean) Indicates whether the policy is enabled.
- `name` (string) Human-readable name for the policy.
- `description` (string) Description that explains the purpose of the policy.
- `actions` (PatchApiAccessPolicyActionsRequest) Action settings applied when the policy fires.
  - `access_token_type` (string) Overrides whether access tokens are issued as self-contained JWTs or opaque reference tokens. When unset, the API resource default is used. ScaleX subscription required to use reference tokens. Reference tokens improve revocation control and reduce token exposure, but require protected resources to use token introspection. One of: `jwt`, `reference`.
  - `access_token_lifetime` (integer, int32) Overrides the access token lifetime (in seconds). When unset, the API resource default is used.
  - `allow_multi_audience` (boolean) Overrides whether access tokens issued for this resource may include additional audiences. When unset, the API resource default is used. ScaleX subscription required to allow multi-audience tokens.
  - `allow_user_info_access` (boolean) Overrides whether access tokens issued for this resource may include identity scopes and be used with identity endpoints such as UserInfo. When unset, the API resource default is used. ScaleX subscription required to allow UserInfo access.
  - `bind_tokens_to_session` (boolean) Overrides whether access tokens issued for this resource are bound to the user session and revoked when the session ends. When unset, the API resource default is used. ScaleX subscription required to use session binding.
- `cedar` (string) The Cedar policy source used during evaluation for advanced policies.
- `error` (string) Optional denial message returned to the client when this policy rejects a token request. If unset, a generic denial message is returned.

## Response body

`200`, JSON. The advanced API access policy was updated successfully

Returns `AdvancedApiAccessPolicy`.

- `id` (string, required) The unique identifier of the policy.
- `enabled` (boolean, required) Indicates whether the policy is enabled.
- `name` (string, required) Human-readable name for the policy.
- `description` (string) Description that explains the purpose of the policy.
- `type` (string, required) The policy authoring mode. Basic policies are authored using structured conditions; advanced policies are authored using Cedar policy source. One of: `basic`, `advanced`.
- `is_permitted` (boolean, required) Indicates whether the policy grants access when matched.
- `cedar` (string, required) The Cedar policy source used during evaluation for advanced policies.
- `actions` (ApiAccessPolicyActions, required) Action settings applied when the policy matches.
  - `access_token_type` (string) Overrides whether access tokens are issued as self-contained JWTs or opaque reference tokens. When unset, the API resource default is used. One of: `jwt`, `reference`.
  - `access_token_lifetime` (integer, int32) Overrides the access token lifetime (in seconds). When unset, the API resource default is used.
  - `allow_multi_audience` (boolean) Overrides whether access tokens issued for this resource may include additional audiences. When unset, the API resource default is used. ScaleX subscription required to allow multi-audience tokens.
  - `allow_user_info_access` (boolean) Overrides whether access tokens issued for this resource may include identity scopes and be used with identity endpoints such as UserInfo. When unset, the API resource default is used. ScaleX subscription required to allow UserInfo access.
  - `bind_tokens_to_session` (boolean) Overrides whether access tokens issued for this resource are bound to the user session and revoked when the session ends. When unset, the API resource default is used. ScaleX subscription required to use session binding.
- `creation_time` (integer, required, date-time) Specifies the creation time of the policy (in Epoch).
- `last_updated` (integer, required, date-time) Specifies the last update time of the policy (in Epoch).
- `revision` (integer, required, int32) Specifies the current version of the policy. Incremented on every update.
- `error` (string) Optional denial message returned to the client when this policy rejects a token request. If unset, a generic denial message is returned.

## Errors

- `400` Bad Request
  - `type` (string, required) A URI reference that identifies the error type. When accessed, it may provide human-readable documentation.
  - `title` (string, required) A short, human-readable summary of the error.
  - `status` (integer, required, int32) The HTTP status code associated with this error response.
  - `trace_id` (string, required) A unique identifier for the request, used for tracing and diagnostics.
  - `detail` (string) A human-readable explanation specific to this occurrence of the error.
  - `instance` (string) A URI reference that identifies the specific occurrence of the error.
- `401` Unauthorized
- `403` Forbidden
- `404` Not Found
  Same body as `400`.
- `422` Unprocessable Entity
  - `type` (string, required) A URI reference that identifies the error type. When accessed, it may provide human-readable documentation.
  - `title` (string, required) A short, human-readable summary of the error.
  - `status` (integer, required, int32) The HTTP status code associated with this error response.
  - `trace_id` (string, required) A unique identifier for the request, used for tracing and diagnostics.
  - `detail` (string) A human-readable explanation specific to this occurrence of the error.
  - `instance` (string) A URI reference that identifies the specific occurrence of the error.
  - `errors` (Record<string, string[]>, required) A key-value map of validation errors, where each key represents a request field and the value contains one or more messages describing why the request could not be processed.

## Example (MonoCloud .NET SDK)

```csharp
using MonoCloud.Management;
using MonoCloud.Management.Models;
using MonoCloud.Management.Core.Base;

var apiClient = new MonoCloudManagementClient(new MonoCloudConfig("<your-domain>", "[[API-Key]]"));


var apiId = "EF12vwe266fUHM6dh5Gup";

var policyId = "GIbxRmxz2tIyQDVdGR4yE";

var requestBody = new PatchApiAccessAdvancedPolicyRequest
  {
    Enabled = true,
    Name = "Billing access policy",
    Description = "Restricts billing API access to admins during business hours",
    Actions = new PatchApiAccessPolicyActionsRequest
    {
      AccessTokenType = AccessTokenTypes.Jwt,
      AccessTokenLifetime = 3600,
      AllowMultiAudience = false,
      AllowUserInfoAccess = true,
      BindTokensToSession = true,
    },
    Cedar = "permit (principal, action, resource == Api::"https://api.example.com/billing");",
    Error = "Access to the billing API requires admin approval.",
  };


var result = await apiClient.Resources.PatchApiAccessAdvancedPolicyAsync(apiId, policyId, requestBody);
```

## Example (MonoCloud Javascript SDK)

```javascript
import { MonoCloudManagementClient } from '@monocloud/management';

const apiClient = MonoCloudManagementClient.init({ domain: '<your-domain>', apiKey: '[[API-Key]]' });

const apiId = 'EF12vwe266fUHM6dh5Gup';

const policyId = 'GIbxRmxz2tIyQDVdGR4yE';

const requestBody = {
  enabled: true,
  name: 'Billing access policy',
  description: 'Restricts billing API access to admins during business hours',
  actions: {
    access_token_type: 'jwt',
    access_token_lifetime: 3600,
    allow_multi_audience: false,
    allow_user_info_access: true,
    bind_tokens_to_session: true
  },
  cedar: 'permit (principal, action, resource == Api::"https://api.example.com/billing");',
  error: 'Access to the billing API requires admin approval.'
};

const result = apiClient.resources.patchApiAccessAdvancedPolicy(apiId, policyId, requestBody);
```