> ## Documentation Index > Fetch the complete documentation index at: https://docs.meshqu.com/llms.txt > Use this file to discover all available pages before exploring further. # Update draft version rules in place > Autosave-style mutation of an in-flight draft version. Replaces the rules JSONB on the existing draft row — does NOT create a new version and does NOT write an audit entry. Returns 409 if the target version is not a draft; returns 404 if the version does not exist for the caller's tenant. ## OpenAPI ````yaml /api/openapi.json patch /v1/policies/{id}/versions/{version} openapi: 3.1.0 info: title: MeshQu API description: >- Governance infrastructure for policy-aware AI decisions. MeshQu does not run tools. It governs decisions about them. version: 1.9.0 contact: name: MeshQu Support email: support@meshqu.com license: name: Proprietary servers: - url: https://api.meshqu.com description: Deployed environment security: - apiKey: [] tenantId: [] tags: - name: Operations description: Health, readiness, metrics, and signing keys - name: Policies description: Policy management - name: Policy Groups description: Policy group management - name: Decisions description: Policy evaluation and recording - name: Chains description: Decision chain verification and sealing - name: Receipts description: Public receipt and bundle retrieval - name: Forms description: Attestation forms and public submission - name: Alerts description: Alert management and webhooks - name: Audit description: Audit log retrieval and verification - name: API Keys description: API key administration - name: Admin description: Tenant and platform administration - name: Dashboard description: Console dashboard data - name: Metrics description: Decision and overview metrics - name: Fields description: Field catalogue - name: Settings description: Tenant settings - name: Rule Creation Logs description: Rule authoring telemetry paths: /v1/policies/{id}/versions/{version}: patch: tags: - Policies summary: Update draft version rules in place description: >- Autosave-style mutation of an in-flight draft version. Replaces the rules JSONB on the existing draft row — does NOT create a new version and does NOT write an audit entry. Returns 409 if the target version is not a draft; returns 404 if the version does not exist for the caller's tenant. operationId: patchV1PoliciesByIdVersionsByVersion parameters: - schema: format: uuid type: string in: path name: id required: true - schema: minimum: 1 type: integer in: path name: version required: true requestBody: required: true content: application/json: schema: type: object properties: rules: minItems: 1 type: array items: type: object properties: code: minLength: 1 maxLength: 50 type: string name: minLength: 1 maxLength: 200 type: string description: maxLength: 1000 type: string rule_type: anyOf: - type: string enum: - presence - type: string enum: - temporal - type: string enum: - threshold - type: string enum: - list - type: string enum: - expression condition: anyOf: - additionalProperties: true type: object properties: required_fields: type: array items: type: string forbidden_fields: type: array items: type: string min_length: type: object additionalProperties: type: integer - additionalProperties: true type: object properties: field: type: string not_expired: type: boolean not_future: type: boolean reference_field: type: string max_days_after: type: integer min_days_before: type: integer - additionalProperties: true type: object properties: field: type: string min: type: number max: type: number greater_than: type: number less_than: type: number - additionalProperties: true type: object properties: field: type: string allowed: type: array items: type: string forbidden: type: array items: type: string case_sensitive: type: boolean - additionalProperties: true type: object properties: expression: type: string severity: anyOf: - type: string enum: - low - type: string enum: - medium - type: string enum: - high - type: string enum: - critical is_active: default: true type: boolean when: anyOf: - additionalProperties: false type: object properties: field: type: string equals: anyOf: - type: string - type: number - type: boolean required: - field - equals - additionalProperties: false type: object properties: field: type: string in: type: array items: anyOf: - type: string - type: number required: - field - in - additionalProperties: false type: object properties: field: type: string exists: type: boolean required: - field - exists - additionalProperties: false type: object properties: all: type: array items: 83abff0b-e22a-4f98-ae9c-b4e78ccc21bb required: - all - additionalProperties: false type: object properties: any: type: array items: 83abff0b-e22a-4f98-ae9c-b4e78ccc21bb required: - any source_ref: type: object properties: document: maxLength: 500 type: string section: maxLength: 200 type: string url: maxLength: 2000 type: string replaces_rule_code: maxLength: 50 description: >- Advisory lineage: rule code this replaces (not included in snapshot hash) type: string required: - code - name - rule_type - condition - severity change_reason: minLength: 1 maxLength: 1000 type: string responses: '200': description: Default Response content: application/json: schema: type: object properties: id: format: uuid type: string policy_id: format: uuid type: string version: type: integer rules: type: array items: type: object properties: code: minLength: 1 maxLength: 50 type: string name: minLength: 1 maxLength: 200 type: string description: maxLength: 1000 type: string rule_type: anyOf: - type: string enum: - presence - type: string enum: - temporal - type: string enum: - threshold - type: string enum: - list - type: string enum: - expression condition: anyOf: - additionalProperties: true type: object properties: required_fields: type: array items: type: string forbidden_fields: type: array items: type: string min_length: type: object additionalProperties: type: integer - additionalProperties: true type: object properties: field: type: string not_expired: type: boolean not_future: type: boolean reference_field: type: string max_days_after: type: integer min_days_before: type: integer - additionalProperties: true type: object properties: field: type: string min: type: number max: type: number greater_than: type: number less_than: type: number - additionalProperties: true type: object properties: field: type: string allowed: type: array items: type: string forbidden: type: array items: type: string case_sensitive: type: boolean - additionalProperties: true type: object properties: expression: type: string severity: anyOf: - type: string enum: - low - type: string enum: - medium - type: string enum: - high - type: string enum: - critical is_active: default: true type: boolean when: anyOf: - additionalProperties: false type: object properties: field: type: string equals: anyOf: - type: string - type: number - type: boolean required: - field - equals - additionalProperties: false type: object properties: field: type: string in: type: array items: anyOf: - type: string - type: number required: - field - in - additionalProperties: false type: object properties: field: type: string exists: type: boolean required: - field - exists - additionalProperties: false type: object properties: all: type: array items: 83abff0b-e22a-4f98-ae9c-b4e78ccc21bb required: - all - additionalProperties: false type: object properties: any: type: array items: 83abff0b-e22a-4f98-ae9c-b4e78ccc21bb required: - any source_ref: type: object properties: document: maxLength: 500 type: string section: maxLength: 200 type: string url: maxLength: 2000 type: string replaces_rule_code: maxLength: 50 description: >- Advisory lineage: rule code this replaces (not included in snapshot hash) type: string required: - code - name - rule_type - condition - severity is_active: type: boolean status: description: >- Lifecycle status: draft → submitted → ratified → superseded (or back to draft on reject) anyOf: - type: string enum: - draft - type: string enum: - submitted - type: string enum: - ratified - type: string enum: - superseded ratified_by: type: string ratified_at: format: date-time type: string submitted_by: type: string submitted_at: format: date-time type: string rejected_by: type: string rejected_at: format: date-time type: string rejection_reason: type: string created_at: format: date-time type: string created_by: anyOf: - type: string - type: 'null' change_reason: anyOf: - type: string - type: 'null' required: - id - policy_id - version - rules - is_active - status - created_at - created_by - change_reason '400': description: Default Response content: application/json: schema: type: object properties: error: type: object properties: code: description: Error code type: string message: description: Human-readable message type: string details: description: Additional error details required: - code - message correlation_id: description: Request correlation ID type: string required: - error '404': description: Default Response content: application/json: schema: type: object properties: error: type: object properties: code: description: Error code type: string message: description: Human-readable message type: string details: description: Additional error details required: - code - message correlation_id: description: Request correlation ID type: string required: - error '409': description: Default Response content: application/json: schema: type: object properties: error: type: object properties: code: description: Error code type: string message: description: Human-readable message type: string details: description: Additional error details required: - code - message correlation_id: description: Request correlation ID type: string required: - error components: securitySchemes: apiKey: type: http scheme: bearer bearerFormat: mqu_ description: >- MeshQu API key passed as a bearer token: `Authorization: Bearer mqu_…`. Mint one in the console (Settings → API keys). tenantId: type: apiKey name: X-MeshQu-Tenant-Id in: header description: >- Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked. ````