# Replace a Draft's Rules

The draft's rules, replaced by these, in their order.

## Overview

- Only a draft, and only by its author: `409` `POLICY_SET_NOT_DRAFT` for a set in another status (it never changes again: copy it into a new draft), `403` `POLICY_SET_NOT_AUTHOR` for another administrator.
- `rules`: up to 500 ([Rules](https://docs.aureahub.com/docs/guide-policy-sets.md)); `[]` empties the draft. `400` `POLICY_RULES_INVALID` for a rule written wrong — nothing is replaced.
- `200` with the set and its new rules.

## Endpoint

### `PUT /v1/policy-sets/{setId}/rules`

Authentication: bearer token required.

Replaces a draft's rules, in order.

**Path parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `setId` | string | yes | The draft's id |

**Request body**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `rules` | object[] | yes | Up to 500 rules, in order |

**Responses**

`409` Not a draft

```json
{
  "statusCode": 409,
  "error": "ConflictError",
  "message": "A policy set that is active is not edited: copy it into a new draft",
  "details": { "code": "POLICY_SET_NOT_DRAFT", "status": "active" }
}
```

`403` Not the author

```json
{
  "statusCode": 403,
  "error": "ForbiddenError",
  "message": "Only the author of a draft edits or submits it: copy it into a draft of your own",
  "details": { "code": "POLICY_SET_NOT_AUTHOR" }
}
```

---

Web version: https://docs.aureahub.com/#policy-set-rules