Update compliance policy

curl --request PATCH \
  --url https://api.trycomp.ai/v1/policies/{id} \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --data '
{
  "name": "Data Privacy Policy",
  "type": "policy",
  "description": "This policy outlines how we handle and protect personal data",
  "status": "draft",
  "content": [
    {
      "type": "heading",
      "attrs": {
        "level": 2,
        "textAlign": null
      },
      "content": [
        {
          "type": "text",
          "text": "Purpose"
        }
      ]
    },
    {
      "type": "paragraph",
      "attrs": {
        "textAlign": null
      },
      "content": [
        {
          "type": "text",
          "text": "Verify workforce integrity and grant the right access at start, revoke at end."
        }
      ]
    }
  ],
  "frequency": "yearly",
  "department": "it",
  "visibility": "ALL",
  "visibleToDepartments": [
    "hr",
    "Sales"
  ],
  "visibleToMemberIds": [
    "mem_abc123def456"
  ],
  "isRequiredToSign": true,
  "reviewDate": "2024-12-31T00:00:00.000Z",
  "assigneeId": "mem_abc123def456",
  "approverId": "mem_xyz789abc123",
  "policyTemplateId": "plt_template123",
  "signedBy": [
    "usr_123",
    "usr_456"
  ],
  "isArchived": false,
  "displayFormat": "EDITOR",
  "keepAcknowledgments": false
}
'

const options = {
  method: 'PATCH',
  headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: 'Data Privacy Policy',
    type: 'policy',
    description: 'This policy outlines how we handle and protect personal data',
    status: 'draft',
    content: [
      {
        type: 'heading',
        attrs: {level: 2, textAlign: null},
        content: [{type: 'text', text: 'Purpose'}]
      },
      {
        type: 'paragraph',
        attrs: {textAlign: null},
        content: [
          {
            type: 'text',
            text: 'Verify workforce integrity and grant the right access at start, revoke at end.'
          }
        ]
      }
    ],
    frequency: 'yearly',
    department: 'it',
    visibility: 'ALL',
    visibleToDepartments: ['hr', 'Sales'],
    visibleToMemberIds: ['mem_abc123def456'],
    isRequiredToSign: true,
    reviewDate: '2024-12-31T00:00:00.000Z',
    assigneeId: 'mem_abc123def456',
    approverId: 'mem_xyz789abc123',
    policyTemplateId: 'plt_template123',
    signedBy: ['usr_123', 'usr_456'],
    isArchived: false,
    displayFormat: 'EDITOR',
    keepAcknowledgments: false
  })
};

fetch('https://api.trycomp.ai/v1/policies/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.trycomp.ai/v1/policies/{id}"

payload = {
    "name": "Data Privacy Policy",
    "type": "policy",
    "description": "This policy outlines how we handle and protect personal data",
    "status": "draft",
    "content": [
        {
            "type": "heading",
            "attrs": {
                "level": 2,
                "textAlign": None
            },
            "content": [
                {
                    "type": "text",
                    "text": "Purpose"
                }
            ]
        },
        {
            "type": "paragraph",
            "attrs": { "textAlign": None },
            "content": [
                {
                    "type": "text",
                    "text": "Verify workforce integrity and grant the right access at start, revoke at end."
                }
            ]
        }
    ],
    "frequency": "yearly",
    "department": "it",
    "visibility": "ALL",
    "visibleToDepartments": ["hr", "Sales"],
    "visibleToMemberIds": ["mem_abc123def456"],
    "isRequiredToSign": True,
    "reviewDate": "2024-12-31T00:00:00.000Z",
    "assigneeId": "mem_abc123def456",
    "approverId": "mem_xyz789abc123",
    "policyTemplateId": "plt_template123",
    "signedBy": ["usr_123", "usr_456"],
    "isArchived": False,
    "displayFormat": "EDITOR",
    "keepAcknowledgments": False
}
headers = {
    "X-API-Key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

{
  "id": "pol_abc123def456",
  "name": "Data Privacy Policy",
  "type": "policy",
  "description": "This policy outlines how we handle and protect personal data",
  "status": "published",
  "content": [
    {
      "type": "heading",
      "attrs": {
        "level": 2
      },
      "content": [
        {
          "type": "text",
          "text": "Purpose"
        }
      ]
    }
  ],
  "frequency": "yearly",
  "department": "it",
  "isRequiredToSign": true,
  "signedBy": [
    "usr_123"
  ],
  "reviewDate": "2024-12-31T00:00:00.000Z",
  "isArchived": false,
  "createdAt": "2024-01-01T00:00:00.000Z",
  "updatedAt": "2024-01-15T00:00:00.000Z",
  "organizationId": "org_abc123def456",
  "assigneeId": "mem_abc123def456",
  "approverId": "mem_xyz789abc123"
}

{
  "message": "Validation failed"
}

{
  "message": "Unauthorized"
}

{
  "message": "Policy with ID pol_abc123def456 not found"
}

PATCH

policies

{id}

Update compliance policy

curl --request PATCH \
  --url https://api.trycomp.ai/v1/policies/{id} \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --data '
{
  "name": "Data Privacy Policy",
  "type": "policy",
  "description": "This policy outlines how we handle and protect personal data",
  "status": "draft",
  "content": [
    {
      "type": "heading",
      "attrs": {
        "level": 2,
        "textAlign": null
      },
      "content": [
        {
          "type": "text",
          "text": "Purpose"
        }
      ]
    },
    {
      "type": "paragraph",
      "attrs": {
        "textAlign": null
      },
      "content": [
        {
          "type": "text",
          "text": "Verify workforce integrity and grant the right access at start, revoke at end."
        }
      ]
    }
  ],
  "frequency": "yearly",
  "department": "it",
  "visibility": "ALL",
  "visibleToDepartments": [
    "hr",
    "Sales"
  ],
  "visibleToMemberIds": [
    "mem_abc123def456"
  ],
  "isRequiredToSign": true,
  "reviewDate": "2024-12-31T00:00:00.000Z",
  "assigneeId": "mem_abc123def456",
  "approverId": "mem_xyz789abc123",
  "policyTemplateId": "plt_template123",
  "signedBy": [
    "usr_123",
    "usr_456"
  ],
  "isArchived": false,
  "displayFormat": "EDITOR",
  "keepAcknowledgments": false
}
'

const options = {
  method: 'PATCH',
  headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: 'Data Privacy Policy',
    type: 'policy',
    description: 'This policy outlines how we handle and protect personal data',
    status: 'draft',
    content: [
      {
        type: 'heading',
        attrs: {level: 2, textAlign: null},
        content: [{type: 'text', text: 'Purpose'}]
      },
      {
        type: 'paragraph',
        attrs: {textAlign: null},
        content: [
          {
            type: 'text',
            text: 'Verify workforce integrity and grant the right access at start, revoke at end.'
          }
        ]
      }
    ],
    frequency: 'yearly',
    department: 'it',
    visibility: 'ALL',
    visibleToDepartments: ['hr', 'Sales'],
    visibleToMemberIds: ['mem_abc123def456'],
    isRequiredToSign: true,
    reviewDate: '2024-12-31T00:00:00.000Z',
    assigneeId: 'mem_abc123def456',
    approverId: 'mem_xyz789abc123',
    policyTemplateId: 'plt_template123',
    signedBy: ['usr_123', 'usr_456'],
    isArchived: false,
    displayFormat: 'EDITOR',
    keepAcknowledgments: false
  })
};

fetch('https://api.trycomp.ai/v1/policies/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.trycomp.ai/v1/policies/{id}"

payload = {
    "name": "Data Privacy Policy",
    "type": "policy",
    "description": "This policy outlines how we handle and protect personal data",
    "status": "draft",
    "content": [
        {
            "type": "heading",
            "attrs": {
                "level": 2,
                "textAlign": None
            },
            "content": [
                {
                    "type": "text",
                    "text": "Purpose"
                }
            ]
        },
        {
            "type": "paragraph",
            "attrs": { "textAlign": None },
            "content": [
                {
                    "type": "text",
                    "text": "Verify workforce integrity and grant the right access at start, revoke at end."
                }
            ]
        }
    ],
    "frequency": "yearly",
    "department": "it",
    "visibility": "ALL",
    "visibleToDepartments": ["hr", "Sales"],
    "visibleToMemberIds": ["mem_abc123def456"],
    "isRequiredToSign": True,
    "reviewDate": "2024-12-31T00:00:00.000Z",
    "assigneeId": "mem_abc123def456",
    "approverId": "mem_xyz789abc123",
    "policyTemplateId": "plt_template123",
    "signedBy": ["usr_123", "usr_456"],
    "isArchived": False,
    "displayFormat": "EDITOR",
    "keepAcknowledgments": False
}
headers = {
    "X-API-Key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

{
  "id": "pol_abc123def456",
  "name": "Data Privacy Policy",
  "type": "policy",
  "description": "This policy outlines how we handle and protect personal data",
  "status": "published",
  "content": [
    {
      "type": "heading",
      "attrs": {
        "level": 2
      },
      "content": [
        {
          "type": "text",
          "text": "Purpose"
        }
      ]
    }
  ],
  "frequency": "yearly",
  "department": "it",
  "isRequiredToSign": true,
  "signedBy": [
    "usr_123"
  ],
  "reviewDate": "2024-12-31T00:00:00.000Z",
  "isArchived": false,
  "createdAt": "2024-01-01T00:00:00.000Z",
  "updatedAt": "2024-01-15T00:00:00.000Z",
  "organizationId": "org_abc123def456",
  "assigneeId": "mem_abc123def456",
  "approverId": "mem_xyz789abc123"
}

{
  "message": "Validation failed"
}

{
  "message": "Unauthorized"
}

{
  "message": "Policy with ID pol_abc123def456 not found"
}

Authorizations

X-API-Key

string

header

required

API key for authentication

Headers

X-Organization-Id

string

Organization ID (required for session auth, optional for API key auth)

Path Parameters

string

required

Policy ID

Example:

"pol_abc123def456"

Body

application/json

Policy update data

name

string

Name of the policy

Example:

"Data Privacy Policy"

type

enum<string>

default:policy

Kind of document to create. Standards and procedures share the policy editor, versioning and control mappings but are never signable and do not appear on the trust portal.

Available options:

policy,

standard,

procedure

Example:

"policy"

description

string

Description of the policy

Example:

"This policy outlines how we handle and protect personal data"

status

enum<string>

Status of the policy

Available options:

draft,

published,

needs_review

Example:

"draft"

content

object[]

Content of the policy as TipTap JSON (array of nodes)

Example:

[
  {
    "type": "heading",
    "attrs": { "level": 2, "textAlign": null },
    "content": [{ "type": "text", "text": "Purpose" }]
  },
  {
    "type": "paragraph",
    "attrs": { "textAlign": null },
    "content": [
      {
        "type": "text",
        "text": "Verify workforce integrity and grant the right access at start, revoke at end."
      }
    ]
  }
]

frequency

enum<string>

Review frequency of the policy

Available options:

monthly,

quarterly,

yearly

Example:

"yearly"

department

string

Department this policy applies to. Built-in values: none, admin, gov, hr, it, itsm, qms. Custom department names are also accepted.

Maximum string length: 64

Example:

"it"

visibility

enum<string>

default:ALL

Who has to sign this policy once it is published. ALL (the default) publishes it to every employee. DEPARTMENT restricts it to members matching any visibleToDepartments entry or individually listed in visibleToMemberIds. The same audience is used for the employee portal, publish emails and compliance counts. Creating or expanding a restricted audience requires the organization policy-audiences rollout flag.

Available options:

ALL,

DEPARTMENT

Example:

"ALL"

visibleToDepartments

string[]

Departments included when visibility is DEPARTMENT. Select at least one department or individual member; both lists are ignored for ALL. Matched case-insensitively against each member's department. Built-in values: admin, gov, hr, it, itsm, qms. Custom department names are also accepted.

Maximum array length: 100

Maximum string length: 64

Example:

["hr", "Sales"]

visibleToMemberIds

string[]

Additional active organization member IDs with existing portal access in the restricted audience (visibility DEPARTMENT). Members match either a selected department or this list. Selection does not grant access or role obligations. Ignored for ALL.

Maximum array length: 5000

Example:

["mem_abc123def456"]

isRequiredToSign

boolean

Whether this policy requires a signature

Example:

true

reviewDate

string

Review date for the policy

Example:

"2024-12-31T00:00:00.000Z"

assigneeId

string

Member ID of the organization member this policy is assigned to — must belong to this organization

Example:

"mem_abc123def456"

approverId

string | null

Active organization member ID to request approval from, not proof of an existing approval. Creates or updates with new content stage a version in needs_review. A draft without content submits its newest version; an existing pending version can be reassigned without content. An already-published policy without new content must use submit-for-approval with a specific draft version. The assigned member must accept or deny using their session, MCP OAuth identity, or API key; owner fallback cannot approve. Authors can recall approval to edit again. Repeating an approver while a version is pending does not resubmit it.

Example:

"mem_xyz789abc123"

policyTemplateId

string

ID of the policy template this policy is based on

Example:

"plt_template123"

signedBy

string[]

List of user IDs who have signed this policy

Example:

["usr_123", "usr_456"]

isArchived

boolean

Whether to archive this policy

Example:

false

displayFormat

enum<string>

Display format for this policy

Available options:

EDITOR,

PDF

Example:

"EDITOR"

keepAcknowledgments

boolean

Publish as a minor change. When this update publishes the policy (new content on a published policy, or status set to published), keep existing employee acknowledgments for a previously published policy. First publication still requires acknowledgment. Use only for corrections that do not change what the policy requires. Defaults to false.

Example:

false

Response

Policy updated successfully

string

required

The policy ID

Example:

"pol_abc123def456"

name

string

required

Name of the policy

Example:

"Data Privacy Policy"

type

enum<string>

default:policy

required

Kind of document (ENG-898). Policies only are signable and appear on the trust portal; standards and procedures share everything else.

Available options:

policy,

standard,

procedure

Example:

"policy"

description

string | null

required

Description of the policy

Example:

"This policy outlines how we handle and protect personal data"

status

enum<string>

required

Status of the policy

Available options:

draft,

published,

needs_review

Example:

"draft"

content

object[]

required

Content of the policy as TipTap JSON (array of nodes)

Example:

[
  {
    "type": "heading",
    "attrs": { "level": 2, "textAlign": null },
    "content": [{ "type": "text", "text": "Purpose" }]
  },
  {
    "type": "paragraph",
    "attrs": { "textAlign": null },
    "content": [
      {
        "type": "text",
        "text": "Verify workforce integrity and grant the right access at start, revoke at end."
      }
    ]
  }
]

frequency

enum<string> | null

required

Review frequency of the policy

Available options:

monthly,

quarterly,

yearly

Example:

"yearly"

department

string | null

required

Department this policy applies to. May be one of the built-in values (none, admin, gov, hr, it, itsm, qms) or a custom department name.

Example:

"it"

isRequiredToSign

boolean

required

Whether this policy requires a signature

Example:

true

signedBy

string[]

required

List of user IDs who have signed this policy

Example:

["usr_123", "usr_456"]

reviewDate

string<date-time> | null

required

Review date for the policy

Example:

"2024-12-31T00:00:00.000Z"

isArchived

boolean

required

Whether this policy is archived

Example:

false

archivedAt

string<date-time> | null

required

When the policy was archived by framework sync

Example:

"2024-02-01T00:00:00.000Z"

createdAt

string<date-time>

required

When the policy was created

Example:

"2024-01-01T00:00:00.000Z"

updatedAt

string<date-time>

required

When the policy was last updated

Example:

"2024-01-15T00:00:00.000Z"

lastArchivedAt

string<date-time> | null

required

When the policy was last archived

Example:

"2024-02-01T00:00:00.000Z"

lastPublishedAt

string<date-time> | null

required

When the policy was last published

Example:

"2024-01-10T00:00:00.000Z"

organizationId

string

required

Organization ID this policy belongs to

Example:

"org_abc123def456"

assigneeId

string | null

required

Member ID of the organization member this policy is assigned to — the id of the expanded assignee

Example:

"mem_abc123def456"

approverId

string | null

required

Member ID of the organization member who approved this policy

Example:

"mem_xyz789abc123"

policyTemplateId

string | null

required

ID of the policy template this policy is based on

Example:

"plt_template123"

visibility

enum<string>

Who has to sign this policy: ALL employees, or a restricted audience (DEPARTMENT) matching visibleToDepartments or visibleToMemberIds.

Available options:

ALL,

DEPARTMENT

Example:

"ALL"

visibleToDepartments

string[]

Departments included in the restricted audience. Individual members in visibleToMemberIds are included too.

Example:

["hr"]

visibleToMemberIds

string[]

Individual organization member IDs included in the restricted policy audience.

Example:

["mem_abc123def456"]

outgoingReferences

object[]

Documents this document references (ENG-898), e.g. a standard pointing at the policies it implements. Present on single-document responses.

Show child attributes

incomingReferences

object[]

Documents that reference this document (read-only reverse half of outgoingReferences). Present on single-document responses.

Show child attributes

Overview

Reference

Update compliance policy | Comp AI API

Authorizations

Headers

Path Parameters

Body

Response