> ## Documentation Index
> Fetch the complete documentation index at: https://spillway.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Update an approval policy.



## OpenAPI

````yaml /api-reference/openapi.json patch /api/approval-policies/{id}
openapi: 3.1.0
info:
  title: Spillway API
  version: 1.0.0
  description: >-
    The control plane for AI spend. One OpenAI-compatible gateway (`/v1/*`) plus
    a governance and administration API (`/api/*`). Request bodies are generated
    from the zod schemas in `@spillway/shared` — the single source of truth.
servers:
  - url: http://localhost:3000
    description: Local dev
security: []
paths:
  /api/approval-policies/{id}:
    patch:
      tags:
        - Approvals
      summary: Update an approval policy.
      parameters:
        - schema:
            type: string
            format: uuid
          required: true
          name: id
          in: path
        - schema:
            type: string
            format: uuid
            example: 601c5d19-0b88-42f7-acda-d1d31abd100d
          required: false
          name: X-Spillway-Org
          in: header
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  minLength: 1
                  maxLength: 120
                definition:
                  type: object
                  properties:
                    tiers:
                      type: array
                      items:
                        type: object
                        properties:
                          min_amount_usd:
                            type: string
                            pattern: ^\d+(\.\d{1,6})?$
                          auto_approve:
                            type: boolean
                          steps:
                            type: array
                            items:
                              type: object
                              properties:
                                approvers:
                                  type: object
                                  properties:
                                    roles:
                                      type: array
                                      items:
                                        type: string
                                    user_ids:
                                      type: array
                                      items:
                                        type: string
                                quorum:
                                  anyOf:
                                    - type: string
                                      enum:
                                        - all
                                    - type: string
                                      enum:
                                        - any
                                    - type: integer
                                      minimum: 1
                                notify_only:
                                  type: boolean
                              required:
                                - approvers
                                - quorum
                        required:
                          - min_amount_usd
                      minItems: 1
                    expiry_hours:
                      type: integer
                      exclusiveMinimum: 0
                  required:
                    - tiers
                enabled:
                  type: boolean
              additionalProperties: false
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties: {}
                description: Resource object.
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - sessionToken: []
components:
  schemas:
    Error:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              enum:
                - budget_exceeded
                - rate_limited
                - model_not_allowed
                - key_not_found
                - key_revoked
                - key_paused
                - rule_deny
                - all_providers_failed
                - upstream_error
                - invalid_request
                - internal_error
                - unauthenticated
                - forbidden
                - not_found
                - conflict
                - validation_error
                - org_required
                - last_owner
                - key_expired
                - service_unavailable
                - no_candidates
                - provider_key_decrypt_failed
                - provider_unavailable
                - upstream_parse_error
                - request_too_large
                - model_not_found
                - no_route_available
                - approval_required
                - tier_required
                - plan_upgrade_required
                - cel_parse_error
                - cel_type_error
                - cel_cost_exceeded
                - cel_ast_too_large
                - cel_banned_macro
                - cel_regex_too_long
                - approval_chain_unsatisfiable
                - not_pending
                - self_approval_not_allowed
                - not_an_approver
                - unknown_effect
                - invalid_action_token
                - threshold_condition_not_isolated
            message:
              type: string
            details:
              type: object
              additionalProperties: {}
          required:
            - code
            - message
      required:
        - error
      description: Control-plane error envelope (§1.4).
  securitySchemes:
    sessionToken:
      type: http
      scheme: bearer
      description: >-
        WorkOS session access token (human dashboard sessions) on the control
        plane.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.