Skip to main content
PATCH
Update a trusted workload policy
Requires keys:write on a management key or OAuth token, or a workspace owner or admin. Trusted workloads is in beta; workspaces without it get 404.
The platform, issuer and owner can’t change. Create a new policy instead. Changes reach the gateway within a minute. See Trusted Workloads for how policies work and how to manage them with Terraform.

Authorizations

Authorization
string
header
required

Bearer token authentication

Path Parameters

id
string<uuid>
required

Trusted workload policy id.

Body

application/json
name
string
Required string length: 1 - 100
status
enum<string>
Available options:
active,
disabled
claim_conditions
object

Extra claims the token must match, as claim name to allowed values, for example project_id and environment for Vercel, or repository_id and ref for GitHub Actions. Every claim must match one of its values. At most 15 claims and 20 values per claim; iss, aud, exp, iat, nbf and jti cannot be used, and the pinned owner claim is set with owner_id.

max_token_lifetime_seconds
integer

Longest token lifetime (exp minus iat or nbf) the policy accepts.

Required range: 60 <= x <= 43200

Response

Trusted workload policy updated

data
object
required

A trusted workload: tokens from this issuer, for the pinned owner and matching every claim condition, authenticate as the policy's key.

Last modified on October 29, 2026