> ## Documentation Index
> Fetch the complete documentation index at: https://docs.privy.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Update policy rules

Propose an intent to add, edit, or remove rules for a policy. Each rule action uses a different HTTP method and endpoint:

| Action        | Method   | Endpoint                                           |
| ------------- | -------- | -------------------------------------------------- |
| Add a rule    | `POST`   | `/v1/intents/policies/{policy_id}/rules`           |
| Update a rule | `PATCH`  | `/v1/intents/policies/{policy_id}/rules/{rule_id}` |
| Delete a rule | `DELETE` | `/v1/intents/policies/{policy_id}/rules/{rule_id}` |

The example below shows how to add a new rule.

<Info>
  Intents expire 72 hours after creation by default. Signers must
  [authorize](/transaction-management/intents/sign-intents) them within this window.
</Info>

<Tabs>
  <Tab title="REST API">
    ```bash theme={"system"}
    curl -X POST https://api.privy.io/v1/intents/policies/<policy_id>/rules \
      -u "<your-privy-app-id>:<your-privy-app-secret>" \
      -H "privy-app-id: <your-privy-app-id>" \
      -H "Content-Type: application/json" \
      -d '{
        "name": "Restrict destination address",
        "method": "eth_sendTransaction",
        "action": "ALLOW",
        "conditions": [
          {
            "field": "to",
            "field_source": "ethereum_transaction",
            "operator": "eq",
            "value": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"
          }
        ]
      }'
    ```
  </Tab>

  <Tab title="Node SDK">
    ```typescript {skip-check} theme={"system"}
    import {PrivyClient, type IntentCreatePolicyRuleParams} from '@privy-io/node';

    const client = new PrivyClient({
      appId: 'your-app-id',
      appSecret: 'your-app-secret'
    });

    const rule: IntentCreatePolicyRuleParams = {
      name: 'Restrict destination address',
      method: 'eth_sendTransaction',
      action: 'ALLOW',
      conditions: [
        {
          field: 'to',
          field_source: 'ethereum_transaction',
          operator: 'eq',
          value: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913'
        }
      ]
    };

    const intent = await client.intents().createPolicyRule('insert-policy-id', rule);

    console.log(intent.intent_id, intent.status, intent.authorization_details);
    ```
  </Tab>

  <Tab title="Go SDK">
    ```go theme={"system"}
    import privy "github.com/privy-io/go-sdk"

    client := privy.NewPrivyClient(privy.PrivyClientOptions{
        AppID:     "your-app-id",
        AppSecret: "your-app-secret",
    })

    intent, err := client.Intents.NewPolicyRule(ctx, "policy-id", privy.IntentNewPolicyRuleParams{
        PolicyRuleRequestBody: privy.PolicyRuleRequestBody{
            Name:   "Restrict destination address",
            Action: privy.PolicyActionAllow,
            Method: privy.PolicyMethodEthSendTransaction,
            Conditions: []privy.PolicyConditionUnion{
                {
                    OfEthereumTransaction: &privy.EthereumTransactionCondition{
                        Field:       privy.EthereumTransactionConditionFieldTo,
                        FieldSource: privy.EthereumTransactionConditionFieldSourceEthereumTransaction,
                        Operator:    privy.ConditionOperatorEq,
                        Value:       privy.ConditionValueUnion{OfString: privy.String("0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913")},
                    },
                },
            },
        },
    })
    ```
  </Tab>

  <Tab title="Ruby SDK">
    ```ruby theme={"system"}
    require "privy"

    client = Privy::PrivyClient.new(
      app_id: "your-app-id",
      app_secret: "your-app-secret"
    )

    intent = client.intents.create_policy_rule(
      "policy-id",
      name: "Restrict destination address",
      method_: "eth_sendTransaction",
      action: "ALLOW",
      conditions: [
        {
          field: "to",
          field_source: "ethereum_transaction",
          operator: "eq",
          value: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"
        }
      ]
    )

    puts(intent.intent_id, intent.status, intent.authorization_details)
    ```
  </Tab>

  <Tab title="Java SDK">
    ```java theme={"system"}
    import io.privy.api.PrivyClient;
    import io.privy.api.models.components.*;
    import io.privy.api.models.operations.IntentCreateRuleResponse;
    import java.util.List;

    PrivyClient client = PrivyClient.builder()
        .appId("your-privy-app-id")
        .appSecret("your-app-secret")
        .build();

    IntentCreateRuleResponse intent = client.intents().createRule(
        "insert-policy-id",
        PolicyRuleRequestBody.builder()
            .name("Restrict destination address")
            .method(PolicyMethod.ETH_SEND_TRANSACTION)
            .action(PolicyAction.ALLOW)
            .conditions(List.of(EthereumTransactionCondition.builder()
                .field(EthereumTransactionConditionField.TO)
                .fieldSource(EthereumTransactionConditionFieldSource.ETHEREUM_TRANSACTION)
                .operator(ConditionOperator.EQ)
                .value(ConditionValue.of("0xB00F0759DbeeF5E543Cc3E3B07A6442F5f3928a2"))
                .build()))
            .build(),
        null);
    ```
  </Tab>
</Tabs>

Each endpoint accepts the same request body as its synchronous counterpart ([create](/api-reference/policies/rules/create), [update](/api-reference/policies/rules/update), [delete](/api-reference/policies/rules/delete)) but does **not** require authorization signatures in the request.

View the [API reference](/api-reference/intents/create-rule) for submitting a rule intent.

## Next steps

<CardGroup cols={2}>
  <Card title="Sign intents" icon="signature" href="/transaction-management/intents/sign-intents">
    Add authorization signatures to execute a proposed intent.
  </Card>

  <Card title="Intent status" icon="arrows-spin" href="/transaction-management/intents/lifecycle">
    Track an intent from proposal to execution.
  </Card>
</CardGroup>