> ## Documentation Index
> Fetch the complete documentation index at: https://docs.devin.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Update an enterprise security profile

> Update an enterprise-owned security profile. Omitted fields are left
unchanged; explicit null clears net_policy / mcp_config.

Updates an enterprise-owned security profile. Running sessions keep the restrictions they resolved at their last boot or wake; changes apply to new sessions immediately and to existing sessions when they next resume.

## Permissions

Requires a [service user](https://docs.devin.ai/api-reference/v3/service-users/members-service-users.md) or [personal access token](https://docs.devin.ai/api-reference/personal-access-tokens.md) with the `ManageAccountSecureModeProfiles` permission at the enterprise level. Only available on enterprise accounts.

## Behavior

* Omitted fields are left unchanged.
* An explicit `null` clears the profile's opinion for `net_policy`, `mcp_config`, `slack_channel_access`, `slack_dm_scope`, `teams_channel_access`, `teams_dm_scope`, and `teams_group_chat_scope`. `null` is rejected for the other fields.
* `net_policy: null` means the profile has no network opinion, not deny-all. Use `{"allow": []}` for deny-all.
* `mcp_config.servers` lists MCP servers by slug (a marketplace slug such as `github`, or an installation's slug).


## OpenAPI

````yaml v3-openapi.yaml PATCH /v3beta1/enterprise/security-profiles/{profile_id}
openapi: 3.1.0
info:
  description: Devin v3 API with Service User authentication and RBAC
  title: Devin API v3
  version: 3.0.0
servers: []
security:
  - bearerAuth: []
paths:
  /v3beta1/enterprise/security-profiles/{profile_id}:
    patch:
      tags:
        - security-profiles
      summary: Update an enterprise security profile
      description: |-
        Update an enterprise-owned security profile. Omitted fields are left
        unchanged; explicit null clears net_policy / mcp_config.
      operationId: >-
        handle_update_security_profile_v3beta1_enterprise_security_profiles__profile_id__patch
      parameters:
        - in: path
          name: profile_id
          required: true
          schema:
            title: Profile Id
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityProfileUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EnterpriseSecurityProfileResponse'
          description: Successful Response
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Unauthorized
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Not Found
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Conflict
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Unprocessable Content
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Too Many Requests
components:
  schemas:
    SecurityProfileUpdateRequest:
      additionalProperties: false
      description: >-
        PATCH semantics: omitted fields are left unchanged; explicit null

        clears the nullable fields (net_policy, mcp_config,
        slack_channel_access,

        slack_dm_scope, teams_channel_access, teams_dm_scope,

        teams_group_chat_scope) and is rejected for the others.
      properties:
        devin_mcp_read_only:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Devin Mcp Read Only
        enforcement_level:
          anyOf:
            - enum:
                - recommended
                - mandatory
              type: string
            - type: 'null'
          title: Enforcement Level
        git_access_level:
          anyOf:
            - enum:
                - read_only
                - read_write
              type: string
            - type: 'null'
          title: Git Access Level
        mcp_config:
          anyOf:
            - $ref: '#/components/schemas/SecurityProfileMcpConfig'
            - type: 'null'
        name:
          anyOf:
            - maxLength: 128
              minLength: 1
              type: string
            - type: 'null'
          title: Name
        net_policy:
          anyOf:
            - $ref: '#/components/schemas/SecurityProfileNetPolicy'
            - type: 'null'
        remove_github_cli_token:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Remove Github Cli Token
        slack_channel_access:
          anyOf:
            - $ref: '#/components/schemas/SecurityProfileSlackChannelAccess'
            - type: 'null'
        slack_dm_scope:
          anyOf:
            - enum:
                - disabled
                - org_members
                - workspace
              type: string
            - type: 'null'
          title: Slack Dm Scope
        teams_channel_access:
          anyOf:
            - $ref: '#/components/schemas/SecurityProfileTeamsChannelAccess'
            - type: 'null'
        teams_dm_scope:
          anyOf:
            - enum:
                - disabled
                - installed_users
              type: string
            - type: 'null'
          title: Teams Dm Scope
        teams_group_chat_scope:
          anyOf:
            - enum:
                - disabled
                - origin_chat
              type: string
            - type: 'null'
          title: Teams Group Chat Scope
      title: SecurityProfileUpdateRequest
      type: object
    EnterpriseSecurityProfileResponse:
      additionalProperties: false
      description: |-
        An enterprise-owned security profile, shared with every org in the
        enterprise. The owning enterprise is implied by the caller's token.
      properties:
        created_at:
          title: Created At
          type: integer
        devin_mcp_read_only:
          description: >-
            When true, sessions may only call read-only Devin MCP tools (no
            session creation, automation management, or other write operations).
          title: Devin Mcp Read Only
          type: boolean
        enforcement_level:
          description: >-
            recommended profiles can be overridden by descendant bindings;
            mandatory profiles are a floor that descendant policies only narrow.
          enum:
            - recommended
            - mandatory
          title: Enforcement Level
          type: string
        git_access_level:
          enum:
            - read_only
            - read_write
          title: Git Access Level
          type: string
        mcp_config:
          anyOf:
            - $ref: '#/components/schemas/SecurityProfileMcpConfig'
            - type: 'null'
          description: null = this profile has no MCP opinion.
        name:
          title: Name
          type: string
        net_policy:
          anyOf:
            - $ref: '#/components/schemas/SecurityProfileNetPolicy'
            - type: 'null'
          description: >-
            null = this profile has no network opinion (it does NOT mean
            deny-all).
        profile_id:
          description: The security profile's ID.
          title: Profile Id
          type: string
        remove_github_cli_token:
          description: >-
            When true, the GitHub CLI token is removed from the session's
            machine, preventing direct GitHub API access.
          title: Remove Github Cli Token
          type: boolean
        slack_channel_access:
          anyOf:
            - $ref: '#/components/schemas/SecurityProfileSlackChannelAccess'
            - type: 'null'
          description: >-
            Ceiling on the Slack channels sessions governed by this profile may
            read and post in. null = this profile has no opinion and the
            organization's Slack setting applies.
        slack_dm_scope:
          anyOf:
            - enum:
                - disabled
                - org_members
                - workspace
              type: string
            - type: 'null'
          description: >-
            Ceiling on who may DM Devin in Slack under this profile. null = this
            profile has no opinion and the organization's Slack setting applies.
            'workspace' is narrowed to 'org_members' for enterprise accounts.
          title: Slack Dm Scope
        teams_channel_access:
          anyOf:
            - $ref: '#/components/schemas/SecurityProfileTeamsChannelAccess'
            - type: 'null'
          description: >-
            Ceiling on the Microsoft Teams channels sessions governed by this
            profile may read and post in. null = this profile has no opinion and
            the organization's Teams Default Access applies.
        teams_dm_scope:
          anyOf:
            - enum:
                - disabled
                - installed_users
              type: string
            - type: 'null'
          description: >-
            Ceiling on who Devin may DM in Microsoft Teams under this profile.
            null = this profile has no opinion and the organization's Teams
            Default Access applies.
          title: Teams Dm Scope
        teams_group_chat_scope:
          anyOf:
            - enum:
                - disabled
                - origin_chat
              type: string
            - type: 'null'
          description: >-
            Ceiling on which Teams group chats Devin may read under this
            profile; `origin_chat` = only the group chat the session was started
            from; null = no opinion, derived from the org's Teams Default Access
            like DMs.
          title: Teams Group Chat Scope
        updated_at:
          title: Updated At
          type: integer
      required:
        - profile_id
        - name
        - git_access_level
        - enforcement_level
        - devin_mcp_read_only
        - remove_github_cli_token
        - created_at
        - updated_at
      title: EnterpriseSecurityProfileResponse
      type: object
    ProblemDetail:
      description: >-
        RFC 9457 application/problem+json error body for the v3 API.


        detail is retained from the legacy {"detail": ...} body for back-compat;
        the

        other members are additive. errors carries field-level validation
        failures

        (422 only).
      properties:
        detail:
          anyOf:
            - type: string
            - type: 'null'
          description: A human-readable explanation specific to this occurrence.
          title: Detail
        error_code:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            Machine-readable code for blocked-action refusals (e.g.
            "user_frozen", "migrated_session").
          title: Error Code
        errors:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          description: Field-level validation errors (422 responses only).
          title: Errors
        instance:
          anyOf:
            - type: string
            - type: 'null'
          description: A URI reference (the request path) for this occurrence.
          title: Instance
        status:
          description: The HTTP status code.
          title: Status
          type: integer
        title:
          description: A short, human-readable summary of the problem type.
          title: Title
          type: string
        type:
          default: about:blank
          description: A URI reference identifying the problem type.
          title: Type
          type: string
      required:
        - title
        - status
      title: ProblemDetail
      type: object
    SecurityProfileMcpConfig:
      additionalProperties: false
      properties:
        servers:
          description: >-
            MCP servers sessions governed by this profile may use, keyed by
            slug: a marketplace slug (the slug field of the mcp-servers
            resource, e.g. 'github', 'notion') or an installation's slug. When a
            custom installation shares a slug with a marketplace server, the
            custom installation wins.
          items:
            type: string
          title: Servers
          type: array
      required:
        - servers
      title: SecurityProfileMcpConfig
      type: object
    SecurityProfileNetPolicy:
      additionalProperties: false
      properties:
        allow:
          description: >-
            Allowed destinations; anything not listed is blocked. Hostname
            entries support wildcards (e.g. *.github.com). An empty list is a
            valid deny-all policy.
          items:
            anyOf:
              - $ref: '#/components/schemas/SecurityProfileHostnameDestination'
              - $ref: '#/components/schemas/SecurityProfileIpv4Destination'
              - $ref: '#/components/schemas/SecurityProfileIpv6Destination'
          title: Allow
          type: array
      required:
        - allow
      title: SecurityProfileNetPolicy
      type: object
    SecurityProfileSlackChannelAccess:
      additionalProperties: false
      properties:
        channels:
          description: >-
            Channels allowed when mode is 'specific'; ignored (and returned
            empty) for the other modes.
          items:
            $ref: '#/components/schemas/SecurityProfileSlackChannel'
          title: Channels
          type: array
        mode:
          description: >-
            none = sessions may not read or post in any channel; specific = only
            the listed channels; all_public = any public channel the Slack app
            is a member of.
          enum:
            - none
            - specific
            - all_public
          title: Mode
          type: string
      required:
        - mode
      title: SecurityProfileSlackChannelAccess
      type: object
    SecurityProfileTeamsChannelAccess:
      additionalProperties: false
      properties:
        channels:
          description: >-
            Channels allowed when mode is 'specific'; ignored (and returned
            empty) for the other modes.
          items:
            $ref: '#/components/schemas/SecurityProfileTeamsChannel'
          title: Channels
          type: array
        mode:
          description: >-
            none = sessions may not read or post in any channel; specific = only
            the listed channels; installed_teams = any channel of a team the
            Devin app is installed in.
          enum:
            - none
            - specific
            - installed_teams
          title: Mode
          type: string
      required:
        - mode
      title: SecurityProfileTeamsChannelAccess
      type: object
    SecurityProfileHostnameDestination:
      additionalProperties: false
      properties:
        hostname:
          title: Hostname
          type: string
      required:
        - hostname
      title: SecurityProfileHostnameDestination
      type: object
    SecurityProfileIpv4Destination:
      additionalProperties: false
      properties:
        ipv4:
          title: Ipv4
          type: string
      required:
        - ipv4
      title: SecurityProfileIpv4Destination
      type: object
    SecurityProfileIpv6Destination:
      additionalProperties: false
      properties:
        ipv6:
          title: Ipv6
          type: string
      required:
        - ipv6
      title: SecurityProfileIpv6Destination
      type: object
    SecurityProfileSlackChannel:
      additionalProperties: false
      properties:
        channel_id:
          description: Slack channel ID.
          minLength: 1
          title: Channel Id
          type: string
        team_id:
          description: Slack workspace (team) ID.
          minLength: 1
          title: Team Id
          type: string
      required:
        - team_id
        - channel_id
      title: SecurityProfileSlackChannel
      type: object
    SecurityProfileTeamsChannel:
      additionalProperties: false
      properties:
        channel_id:
          description: Teams channel ID ('19:...@thread.tacv2').
          minLength: 1
          title: Channel Id
          type: string
        team_id:
          description: Entra group ID of the Microsoft Teams team.
          minLength: 1
          title: Team Id
          type: string
      required:
        - team_id
        - channel_id
      title: SecurityProfileTeamsChannel
      type: object
  securitySchemes:
    bearerAuth:
      description: 'Service User credential (prefix: cog_)'
      scheme: bearer
      type: http

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.