# Update account federation policy

Launch stage: GA

`PATCH /api/2.0/accounts/{account_id}/federationPolicies/{policy_id}`

Update account federation policy.

API scopes: authentication

## Path parameters

- `account_id` (string, required)
  The account id for the federation policy.
- `policy_id` (string, required)
  The identifier for the federation policy.
  Example: `my-federation-policy`

## Query parameters

- `service_principal_id` (int64, required)
  The service principal id for the federation policy.
- `update_mask` (string, optional)
  The field mask specifies which fields of the policy to update. To specify multiple fields
   in the field mask, use comma as the separator (no space). The special value '*' indicates
   that all fields should be updated (full replacement). If unspecified, all fields that are
   set in the policy provided in the update request will overwrite the corresponding fields
   in the existing policy. Example value: 'description,oidc_policy.audiences'.

## Request body

- `description` (string, optional)
  Description of the federation policy.
  Example: `My federation policy description.`
- `oidc_policy` (object, optional)
  audit_mode INCLUDE is required on both this message field and its leaf fields so the OIDC
   policy configuration is captured in create/update audit logs (see go/auditlogs).
  - `issuer` (string, optional)
    The required token issuer, as specified in the 'iss' claim of federated tokens.
    Example: `https://myidp.example.com/oidc`
  - `subject` (string, optional)
    The required token subject, as specified in the subject claim of federated tokens.
     Must be specified for service principal federation policies. Must not be specified
     for account federation policies.
  - `audiences` (array of string, optional)
    The allowed token audiences, as specified in the 'aud' claim of federated tokens.
     The audience identifier is intended to represent the recipient of the token.
     Can be any non-empty string value. As long as the audience in the token matches
     at least one audience in the policy, the token is considered a match. If audiences
     is unspecified, defaults to your Databricks account id.
    Example: `databricks`
  - `subject_claim` (string, optional)
    The claim that contains the subject of the token. If unspecified, the default value
     is 'sub'.
    Example: `sub`
  - `jwks_uri` (string, optional)
    URL of the public keys used to validate the signature of federated tokens, in
     JWKS format. Most use cases should not need to specify this field. If jwks_uri
     and jwks_json are both unspecified (recommended), Databricks automatically
     fetches the public keys from your issuer’s well known endpoint. Databricks
     strongly recommends relying on your issuer’s well known endpoint for discovering
     public keys.
  - `jwks_json` (string, optional)
    The public keys used to validate the signature of federated tokens, in JWKS format.
     Most use cases should not need to specify this field. If jwks_uri and jwks_json
     are both unspecified (recommended), Databricks automatically fetches the public
     keys from your issuer’s well known endpoint. Databricks strongly recommends
     relying on your issuer’s well known endpoint for discovering public keys.

## Returns

Returns the FederationPolicy object.

## Response

```json
{
  "name": "string",
  "description": "My federation policy description.",
  "oidc_policy": {
    "issuer": "https://myidp.example.com/oidc",
    "subject": "string",
    "audiences": [
      "databricks"
    ],
    "subject_claim": "sub",
    "jwks_uri": "string",
    "jwks_json": "string"
  },
  "create_time": "string",
  "update_time": "string",
  "uid": "string",
  "service_principal_id": 0,
  "policy_id": "string"
}
```