# update_payment_policy
Source:
PATCH
/v1/payments/policies/{payment\_policy\_id}
Select code samplecURL (shell:curl)
```js
const url = 'https://app.everruns.com/api/v1/payments/policies/example';
const options = {
method: 'PATCH',
headers: {'Content-Type': 'application/json'},
body: '{"allowed_capabilities":["weather.lookup","shipping.quote","currency.convert"],"allowed_hosts":["api.shippo.com","api.openweathermap.org","api.exchangerate.host"],"max_amount_usd_per_day":1,"max_amount_usd_per_request":1,"max_amount_usd_per_turn":1,"metadata":"example","rail_preference":["mpp_tempo","x402_base"],"require_approval_above_usd":1,"status":"disabled"}'
};
try {
const response = await fetch(url, options);
const data = await response.json();
console.log(data);
} catch (error) {
console.error(error);
}
```
```sh
curl --request PATCH \
--url https://app.everruns.com/api/v1/payments/policies/example \
--header 'Content-Type: application/json' \
--data '{ "allowed_capabilities": [ "weather.lookup", "shipping.quote", "currency.convert" ], "allowed_hosts": [ "api.shippo.com", "api.openweathermap.org", "api.exchangerate.host" ], "max_amount_usd_per_day": 1, "max_amount_usd_per_request": 1, "max_amount_usd_per_turn": 1, "metadata": "example", "rail_preference": [ "mpp_tempo", "x402_base" ], "require_approval_above_usd": 1, "status": "disabled" }'
```
* Production APIapp.everruns.com/api/v1/payments/policies/{payment\_policy\_id}
Update a payment policy. Only provided fields are modified.
## Parameters
### Path Parameters
**payment\_policy\_id**
required
string
Payment policy ID
## Request Bodyrequired
Media typeapplication/json
Request body for the `update_payment_policy` operation.
object
**allowed\_capabilities**
New capability allowlist. Outer `None` leaves the field unchanged.
Array\ | null
##### Example
```json
[
"weather.lookup",
"shipping.quote",
"currency.convert"
]
```
**allowed\_hosts**
New host allowlist. Outer `None` leaves the field unchanged.
Array\ | null
##### Example
```json
[
"api.shippo.com",
"api.openweathermap.org",
"api.exchangerate.host"
]
```
**max\_amount\_usd\_per\_day**
New per-day cap (USD). Outer `None` leaves the field unchanged; inner `None` clears the cap.
number | null format: double
**max\_amount\_usd\_per\_request**
New per-request cap (USD). **Enforced** by the payment authority. Outer `None` leaves the field unchanged; inner `None` clears the cap.
number | null format: double
**max\_amount\_usd\_per\_turn**
New per-turn cap (USD). Outer `None` leaves the field unchanged; inner `None` clears the cap.
number | null format: double
**metadata**
New free-form metadata. Replaces the existing metadata blob entirely when set. Example: `{"owner_team": "ops", "ticket": "OPS-1248", "review_due": "2026-09-01"}`.
**rail\_preference**
New rail preference order. Outer `None` leaves the field unchanged.
Array\ | null
##### Example
```json
[
"mpp_tempo",
"x402_base"
]
```
**require\_approval\_above\_usd**
New approval threshold (USD). **Advisory only — not yet enforced.** Outer `None` leaves the field unchanged; inner `None` disables the (future) gate.
number | null format: double
**status**
New lifecycle status. Valid values: `active`, `disabled`.
string | null
##### Example
```plaintext
disabled
```
## Responses
### 200
Payment policy updated
Media typeapplication/json
A payment policy — the binding between a paying account and a subject (virtual user, session) that controls which paid calls are authorized and at what spend caps.
object
**allowed\_capabilities**
required
Capability IDs this policy permits paid calls for. Empty list means no capability gating.
Array\
**allowed\_hosts**
required
HTTP host allowlist for paid outbound calls. Empty list means no host gating.
Array\
**created\_at**
required
Timestamp when this policy was created (RFC 3339).
string format: date-time
**id**
required
Prefixed public identifier. See [ID Schema](https://everruns.com/docs/advanced/id-schema/).
string
/^paypol\_\[0-9a-f]{32}$/
**max\_amount\_usd\_per\_day**
Maximum cumulative amount (USD) over a rolling 24 hours, enforced before signing by reserving each request’s maximum. `None` means no per-day cap.
number | null format: double
**max\_amount\_usd\_per\_request**
Maximum amount (USD) any single paid request may settle for. **Enforced** by the payment authority at policy selection. `None` means no per-request cap.
number | null format: double
**max\_amount\_usd\_per\_turn**
Maximum cumulative amount (USD) per agent turn, enforced before signing by reserving each request’s maximum against the turn. A request with no turn binding fails closed. `None` means no per-turn cap.
number | null format: double
**metadata**
required
Free-form metadata attached to this policy.
**organization\_id**
required
Owning organization’s prefixed public identifier.
string
**payment\_account\_id**
required
Payment account this policy authorizes spending from.
string
/^payacct\_\[0-9a-f]{32}$/
**rail\_preference**
required
Preferred settlement rails in priority order; the authority picks the first available.
Array\
Allowed values: mpp\_tempo x402\_base
**require\_approval\_above\_usd**
Threshold (USD) above which a request would require explicit human approval. **Advisory only — not yet enforced.** Stored on the policy for forward compatibility; no approval gate is wired up yet. `None` disables the (future) gate.
number | null format: double
**status**
required
Current lifecycle status of this policy.
string
Allowed values: active disabled pending succeeded failed released
**subject\_id**
required
Prefixed identifier of the bound subject.
string
**subject\_type**
required
Class of subject this policy binds to (e.g. `virtual_user`, `session`).
string
**updated\_at**
required
Timestamp when this policy was last updated (RFC 3339).
string format: date-time
##### Example
```json
{
"allowed_capabilities": [
"paid_search",
"paid_image_gen"
],
"allowed_hosts": [
"api.openai.com",
"api.anthropic.com"
],
"created_at": "2026-04-01T10:00:00Z",
"id": "paypol_01933b5a000070008000000000000001",
"max_amount_usd_per_day": 50,
"max_amount_usd_per_request": 2.5,
"max_amount_usd_per_turn": 5,
"organization_id": "org_01933b5a000070008000000000000001",
"payment_account_id": "payacct_01933b5a000070008000000000000001",
"rail_preference": [
"mpp_tempo"
],
"require_approval_above_usd": 10,
"status": "active",
"subject_id": "identity_01933b5a000070008000000000000001",
"subject_type": "virtual_user",
"updated_at": "2026-05-20T14:00:00Z"
}
```
### 400
Invalid input
Media typeapplication/json
Standard error response.
Wire shape is [RFC 9457 Problem Details](https://www.rfc-editor.org/rfc/rfc9457): every error response includes `title` and `status`, and may include `detail`, `code`, `allowed_actions`, `retry_after_seconds`, `instance`, and `type`. The content type is rewritten to `application/problem+json` with the `application/problem+json` content type.
object
**allowed\_actions**
Recovery actions the caller can take next.
Array\