# Update Launch stage: GA `PUT /api/2.0/accounts/{account_id}/network-policies/{network_policy_id}` Updates a network policy. This allows you to modify the configuration of a network policy. API scopes: networking ## Path parameters - `network_policy_id` (string, optional) The unique identifier for the network policy. Example: `example-policy-name` Constraints: `^[a-zA-Z0-9_.-]{1,32}$` - `account_id` (string, optional) Your account ID. You can find your account ID in your accounts console. Example: `123e4567-e89b-12d3-a456-426614174000` ## Request body - `network_policy` (object, optional) Updated network policy configuration details. - `network_policy_id` (string, optional) The unique identifier for the network policy. Example: `example-policy-name` Constraints: `^[a-zA-Z0-9_.-]{1,32}$` - `account_id` (string, optional) The associated account ID for this Network Policy object. Example: `123e4567-e89b-12d3-a456-426614174000` - `egress` (object, optional) The network policies applying for egress traffic. - `network_access` (object, optional) The access policy enforced for egress traffic to the internet. - `restriction_mode` (string, optional) The restriction mode that controls how serverless workloads can access the internet. Possible values: `RESTRICTION_MODE_UNSPECIFIED`, `FULL_ACCESS`, `RESTRICTED_ACCESS` Example: `RESTRICTED_ACCESS` - `allowed_internet_destinations` (array of object, optional) List of internet destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode. - `allowed_storage_destinations` (array of object, optional) List of storage destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode. - `policy_enforcement` (object, optional) Optional. When policy_enforcement is not provided, we default to ENFORCE_MODE_ALL_SERVICES - `blocked_internet_destinations` (array of object, optional, Beta) List of internet destinations that serverless workloads are blocked from accessing. These destinations are enforced when restriction mode is RESTRICTED_ACCESS or DRY_RUN. Currently supports DNS_NAME type only; IP_RANGE support is planned. - `ingress` (object, optional) The network policies applying for ingress traffic. - `public_access` (object, optional) The network policy restrictions for public access to the workspace. Configures how public internet traffic is allowed or denied access. - `restriction_mode` (string, optional) Possible values: `FULL_ACCESS`, `RESTRICTED_ACCESS` Example: `RESTRICTED_ACCESS` - `deny_rules` (array of object, optional) - `allow_rules` (array of object, optional) - `private_access` (object, optional, Beta) The network policy restrictions for private access. Configures how requests arriving over private connectivity are governed. - `restriction_mode` (string, optional, Beta) The restriction mode for private access. Possible values: `ALLOW_ALL_REGISTERED_ENDPOINTS`, `RESTRICTED_ACCESS` Example: `ALLOW_ALL_REGISTERED_ENDPOINTS` - `deny_rules` (array of object, optional, Beta) Deny rules are evaluated first. A request matching any deny rule is denied, regardless of allow rules. Only applies when restriction_mode is RESTRICTED_ACCESS. - `allow_rules` (array of object, optional, Beta) Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS. **Azure:** Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS. Requests arriving through the workspace's Azure Private Link (ui-api) endpoints are allowed even without a matching allow rule, unless explicitly denied by a deny rule whose origin is azure_workspace_private_link or all_private_access. - `ingress_dry_run` (object, optional) The ingress policy for dry run mode. Dry run will always run even if the request is allowed by the ingress policy. When this field is set, the policy will be evaluated and emit logs only without blocking requests. - `public_access` (object, optional) The network policy restrictions for public access to the workspace. Configures how public internet traffic is allowed or denied access. - `restriction_mode` (string, optional) Possible values: `FULL_ACCESS`, `RESTRICTED_ACCESS` Example: `RESTRICTED_ACCESS` - `deny_rules` (array of object, optional) - `allow_rules` (array of object, optional) - `private_access` (object, optional, Beta) The network policy restrictions for private access. Configures how requests arriving over private connectivity are governed. - `restriction_mode` (string, optional, Beta) The restriction mode for private access. Possible values: `ALLOW_ALL_REGISTERED_ENDPOINTS`, `RESTRICTED_ACCESS` Example: `ALLOW_ALL_REGISTERED_ENDPOINTS` - `deny_rules` (array of object, optional, Beta) Deny rules are evaluated first. A request matching any deny rule is denied, regardless of allow rules. Only applies when restriction_mode is RESTRICTED_ACCESS. - `allow_rules` (array of object, optional, Beta) Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS. **Azure:** Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS. Requests arriving through the workspace's Azure Private Link (ui-api) endpoints are allowed even without a matching allow rule, unless explicitly denied by a deny rule whose origin is azure_workspace_private_link or all_private_access. ## Returns Returns the AccountNetworkPolicy object. ## Response ```json { "network_policy_id": "example-policy-name", "account_id": "123e4567-e89b-12d3-a456-426614174000", "egress": { "network_access": {} }, "ingress": { "public_access": {}, "private_access": {} }, "ingress_dry_run": { "public_access": {}, "private_access": {} } } ```