Update a DLP rule

Update an existing DLP rule to adjust its condition, action or metadata. The update creates a new version of the rule as a draft. To activate it, publish it in a ruleset.

Permissions

info

This action requires the following DLP (Data Loss Prevention) role:

• rule_editor

Console

Console

1 / 4In the DLP console, click Rules in the side menu.

1 / 4

1. In the DLP console, click Rules in the sidebar.
2. Click the name of the rule to update in the list.

Editable fields

You can modify the following elements:

Field	Description
Name	Name of the rule
Description	Description of the rule
Condition	DSL expression of the condition
Action	Action type (pass, block, modify, monitor) and associated configuration

Version history

Click History to view the version history of the rule. Each version displays:

• the version number;
• the author of the change;
• the date of the change;
• the status (Draft or Published).

Saving

Click Save as Draft to save the changes as a draft. The rule appears in the list with the "Draft" status. To activate the updated rule, publish it in a ruleset.

API

The PUT /api/v1/rules/{id} request updates an existing DLP rule. The request body is identical to the create request.

Request example

{
  "name": "block-aws-keys",
  "description": "Block AWS access keys (updated)",
  "platform_type": "mistral-platform",
  "condition": "tool_arguments matches_detector @preset:aws_access_key_id",
  "action": {
    "type": "block",
    "message": "Request contains an AWS access key — action blocked"
  }
}

Response example

{
  "id": "rule-550e8400",
  "name": "block-aws-keys",
  "description": "Block AWS access keys (updated)",
  "platform_type": "mistral-platform",
  "condition": "tool_arguments matches_detector @preset:aws_access_key_id",
  "action": {
    "type": "block",
    "message": "Request contains an AWS access key — action blocked"
  },
  "draft": true,
  "version": 2,
  "created_at": "2026-08-27T10:00:00Z",
  "updated_at": "2026-08-27T11:00:00Z"
}