Skip to content
Docs
Policy Bundle
Update

Apply a Policy Bundle for the calling user

API Reference
Policy Bundle

Apply a Policy Bundle for the calling user

client.PolicyBundle.Update(ctx, body, params) (*Response, error)
PUT/policy/bundle

Accepts an edited Policy Bundle archive and applies it as the active user-scope PolicySetVersion for the calling user.

The user's policy set is seeded from the system-default policies on first access, forked into customer-owned policies; a user bundle therefore contains only customer-owned policies. Applying an edit creates a new version of the affected policy, and a new_policy entry adds a further customer-owned policy. Platform-owned catalog policies are never edited in place by this operation.

The request body codec is determined from Content-Type. The only codec supported today is application/vnd.keycard.policy-bundle.v1+tar+gzip.

Supports optimistic concurrency via If-Match: when supplied, the server applies the bundle only if the supplied ETag matches the current bundle ETag; otherwise responds 412 Precondition Failed.

On success the server returns the materialized bundle (in the same codec) and its new ETag.

ParametersExpand Collapse
body Reader

tar+gzip Policy Bundle archive. manifest.json is required (see PolicyBundleManifest); schema.cedarschema is optional and ignored — the server validates against its attested schema for manifest.schema.version. The manifest's policies[] list is authoritative for the resulting set: each entry must have a matching policies/<public_id>.cedar (or, for a new_policy entry, policies/<new_policy>.cedar) member, and a member with no manifest entry is dropped. Only the sha fields are advisory and recomputed server-side. Duplicate or unrecognized entries are rejected with bundle_invalid. See the PolicyBundle tag for the layout.

params PolicyBundleUpdateParams
IfMatch param.Field[string]optional

Header param: Optimistic concurrency ETag. When supplied, the server applies the bundle only if the value matches the current bundle ETag; otherwise responds 412 Precondition Failed.

XClientRequestID param.Field[string]optional

Header param: Unique request identifier specified by the originating caller and passed along by proxies.

formatuuid
ReturnsExpand Collapse
type PolicyBundleUpdateResponse interface{…}

Apply a Policy Bundle for the calling user

package main

import (
  "bytes"
  "context"
  "fmt"
  "io"

  "github.com/keycardai/keycard-go"
  "github.com/keycardai/keycard-go/option"
)

func main() {
  client := keycard.NewClient(
    option.WithAPIKey("My API Key"),
  )
  policyBundle, err := client.PolicyBundle.Update(
    context.TODO(),
    io.Reader(bytes.NewBuffer([]byte("some file contents"))),
    keycard.PolicyBundleUpdateParams{

    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", policyBundle)
}
Returns Examples