# Change one or more rules of the shipping policy

`PUT /api/v1/address/policy`

- Authentication: Secret API key as a bearer token
- Billing: Free.
- Group: Address

Names only the rules that change; the rest stay as they were, and the change applies to the account's next lookup. `max_risk_score: null` ignores the score, `block_signals: []` blocks on no signal, `require_exists: true` blocks every address a register did not confirm — which is every address in a country with no register installed, so switch it on only for the countries you ship to. A body naming none of the three rules is refused with a 422 keyed `policy`, because that is the shape a misspelled key takes.

## Request body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `max_risk_score` | integer | null | no | Block when risk_score is above this; null ignores the score. |
| `block_signals` | string[] | null | no | Signals that block whenever they fire, whatever the score. |
| `require_exists` | boolean | no | Block unless a register confirmed the building (exists true). |

## Example request

```bash
curl -X PUT https://spaw.co/api/v1/address/policy \
  -H "Authorization: Bearer sk_live_…" \
  -H "Content-Type: application/json" \
  -d '{
  "max_risk_score": 40,
  "block_signals": [
    "undeliverable",
    "placeholder",
    "vacant",
    "mail_drop"
  ]
}'
```

## Responses

### 200 — The policy now in force.

## Error codes

- `UNAUTHENTICATED` — https://spaw.co/docs/errors/UNAUTHENTICATED
- `RATE_LIMITED` — https://spaw.co/docs/errors/RATE_LIMITED
- `VALIDATION_FAILED` — https://spaw.co/docs/errors/VALIDATION_FAILED

---

Canonical page: https://spaw.co/docs/api/update-address-policy · OpenAPI document: https://spaw.co/openapi.json · All endpoints: https://spaw.co/docs/api