Update the fleet's shell access policy (fleet alias)

PUT

/api/fleets/{fleet_id}/access-policy

Upsert the shell access policy for the fleet (organisation).

fleet_id is the organisation UUID. Alias for PUT /organizations/{organization_id}/access-policy — same logic, same auth gates (OWNER / ADMIN only), same policy.changed audit event.

Authorizations

• HTTPBearer

Parameters

Path Parameters

fleet_id

required

string format: uuid

Request Body ^required

Mutable fields for the PUT /access-policy endpoint.

All fields are optional — only supplied (non-None) values are applied. Validators enforce domain constraints so callers receive clear 422 errors rather than mysterious integrity violations or silent mis-configurations.

object

additions_require_approval

Any of:

boolean

boolean

null

null

allowed_tiers

Any of:

Array<string>

Array<string>

null

null

breakglass_enabled

Any of:

boolean

boolean

null

null

breakglass_notification_channels

Any of:

Array<string>

Array<string>

null

null

breakglass_session_timeout_minutes

Any of:

integer

integer

null

null

elevated_approval_mode

Any of:

string

string

null

null

elevated_approval_timeout_minutes

Any of:

integer

integer

null

null

elevated_session_timeout_minutes

Any of:

integer

integer

null

null

max_concurrent_sessions

Any of:

integer

integer

null

null

recording_retention_days

Any of:

integer

integer

null

null

recording_storage_quota_bytes

Any of:

integer

integer

null

null

standard_recording_enabled

Any of:

boolean

boolean

null

null

Responses

200

Successful Response

Full shell access policy document for an organisation.

is_default is True when no row exists yet in shell_access_policy and the response represents the documented model defaults. Once a PUT has been issued, is_default is always False.

id is None when the response is a virtual defaults object (is_default=True).

object

additions_require_approval

required

boolean

allowed_tiers

required

Array<string>

breakglass_enabled

required

boolean

breakglass_notification_channels

required

Array<string>

breakglass_session_timeout_minutes

required

integer

created_at

Any of:

string

string format: date-time

null

null

current_usage_bytes

Any of:

integer

integer

null

null

elevated_approval_mode

required

string

elevated_approval_timeout_minutes

required

integer

elevated_session_timeout_minutes

required

integer

id

Any of:

string

string format: uuid

null

null

is_default

boolean

max_concurrent_sessions

Any of:

integer

integer

null

null

organization_id

required

string format: uuid

recording_retention_days

required

integer

recording_storage_quota_bytes

Any of:

integer

integer

null

null

standard_recording_enabled

required

boolean

updated_at

Any of:

string

string format: date-time

null

null

422

Validation Error

object

detail

Array<object>

object

loc

required

Array

msg

required

string

type

required

string