# Publish a Policy Set

`awaiting_quorum` → `active`: the set becomes the tenant's policy, and the one it replaces is archived.

## Overview

- When the tenant's quorum applies — two administrators or more, or the `institutional` profile — an administrator other than the set's author publishes it; the author answers `403` `POLICY_QUORUM_AUTHOR`. With a single administrator on the `legacy` profile, the author publishes alone. [Who Publishes](https://docs.aureahub.com/docs/guide-policy-sets.md).
- Only a set awaiting its quorum: `409` `POLICY_SET_NOT_AWAITING` otherwise.
- `200` with the set: `activatedAt`, `activatedBy` and, when the publisher is not the author, `approverUserIds`.
- On the institutional profile the published set decides every signature from then on; on any other it is evaluated and logged, and publishing changes no answer of any route ([Policy Sets](https://docs.aureahub.com/docs/guide-policy-sets.md)).
- **A passkey step-up**: `stepUpToken`, your passkey's `policy_set.publish` step-up on this set ([Passkeys & Step-Up](https://docs.aureahub.com/docs/guide-passkeys.md)). Where your tenant's step-up mode is `enforce` — on request; a tenant on the institutional profile by its profile —, it is required: without it `403` `STEP_UP_REQUIRED`, with one that is not for this `403` `STEP_UP_INVALID`, checked after the publication's own checks; nothing is published. In `log` the right one is used, and a missing or wrong one refuses nothing. The body is optional; any other field in it is ignored.

## Endpoint

### `POST /v1/policy-sets/{setId}/publish`

Authentication: bearer token required.

Makes a submitted set the tenant's active one.

**Path parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `setId` | string | yes | The set's id |

**Request body**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `stepUpToken` | string | no | Your passkey's `policy_set.publish` step-up token for this set, 1–200 characters: required where your tenant's step-up mode is `enforce` |

**Responses**

`403` The author

```json
{
  "statusCode": 403,
  "error": "ForbiddenError",
  "message": "The tenant's quorum applies: an administrator other than the author publishes this policy set",
  "details": { "code": "POLICY_QUORUM_AUTHOR" }
}
```

`409` Not awaiting

```json
{
  "statusCode": 409,
  "error": "ConflictError",
  "message": "A policy set that is draft is not published: submit a draft first",
  "details": { "code": "POLICY_SET_NOT_AWAITING", "status": "draft" }
}
```

`403` Step-up required

```json
{
  "statusCode": 403,
  "error": "ForbiddenError",
  "message": "Confirm this with your passkey: ask POST /v1/auth/step-up/options for this action, then send its stepUpToken",
  "details": {
    "code": "STEP_UP_REQUIRED",
    "action": "policy_set.publish",
    "tenantId": "6f1e2d3c-4b5a-4968-8776-a5b4c3d2e1f0"
  }
}
```

---

Web version: https://docs.aureahub.com/#policy-set-publish