curl -X PUT 'https://api.github.com/orgs/example-org/actions/policies/10' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{}'

# PUT /orgs/{org}/actions/policies/{policy_id} (GitHub API)
Base URL: https://api.github.com
Auth: Authorization; GitHub token; required.
Request formats: application/json.
Last verified: 2026-09-18

> Update an organization Actions policy

## Critical Gotchas
* GitHub recommends an `Accept: application/vnd.github+json` header and an explicit `X-GitHub-Api-Version` header.
* Fine-grained tokens only authorize repositories and permissions selected when the token is created.

## cURL
curl -X PUT 'https://api.github.com/orgs/example-org/actions/policies/10' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{}'

## Parameters
| Name | In | Type | Required | Description |
| :--- | :--- | :--- | :--- | :--- |
| org | path | string | Yes | The organization name. The name is not case sensitive. |
| policy_id | path | integer | Yes | The ID of the policy. |
| name | body | string | No | The name of the policy. |
| enforcement | body | string | No | The enforcement level of the ruleset. `evaluate` allows admins to test rules... |
| conditions | body | object | No | Conditions for an organization Actions policy. The conditions object should c... |
| rules | body | object[] | No | An array of rules within the policy. |

## Response example
{"id":0,"name":"string"}

---
Need an API key? Get one at https://github.com/settings/tokens

PUT

PUT /orgs/{org}/actions/policies/{policy_id} — GitHub API

GitHub token (required); https://api.github.com

GitHub API

Update an organization Actions policy

Base URL: https://api.github.com
Auth: Authorization: Bearer <GITHUB_API_KEY>
Last verified: 2026-09-18 · upstream hash matched

Actions Try in browser→

Agents: curl -H "Accept: text/markdown" this URL
→ 294 tokens · Vary: Accept

Critical gotchas

GitHub recommends an Accept: application/vnd.github+json header and an explicit X-GitHub-Api-Version header.

Fine-grained tokens only authorize repositories and permissions selected when the token is created.

cURL

curl -X PUT 'https://api.github.com/orgs/example-org/actions/policies/10' \  -H "Authorization: Bearer $GITHUB_TOKEN" \  -H 'Accept: application/vnd.github+json' \  -H 'X-GitHub-Api-Version: 2026-03-10' \  -H 'Content-Type: application/json' \  -d '{}'

Parameters

Name	In	Type	Required	Description
org	path	string	Yes	The organization name. The name is not case sensitive.
policy_id	path	integer	Yes	The ID of the policy.
name	body	string	No	The name of the policy.
enforcement	body	string	No	The enforcement level of the ruleset. `evaluate` allows admins to test rules before enforcing them. Admins can view insights on the Rule Insights page (`evaluate` is only available with GitHub Enterprise).
conditions	body	object	No	Conditions for an organization Actions policy. The conditions object should contain one of `repository_name`, `repository_id`, or `repository_property`, and may also contain `workflow_path`.
rules	body	object[]	No	An array of rules within the policy.

Response 200 OK

{
  "id": 0,
  "name": "string",
  "target": "actions",
  "source_type": "Repository",
  "source": "string",
  "enforcement": "disabled",
  "conditions": {},
  "rules": [
    {
      "type": "restrict_actions_actors",
      "parameters": {
        "allowed_actors": [
          {
            "id": "[recursive or deeply nested schema]",
            "type": "[recursive or deeply nested schema]"
          }
        ]
      }
    }
  ],
  "node_id": "string",
  "_links": {
    "self": {
      "href": "string"
    },
    "html": {
      "href": "string"
    }
  },
  "created_at": "2026-09-03T00:00:00Z",
  "updated_at": "2026-09-03T00:00:00Z"
}

Get a free GitHub API key → sponsored