Docs

Elastic Compute Service

Patch management

UpdatePatchBaseline - Updates a patch baseline

Call UpdatePatchBaseline to update a patch baseline.

Usage notes

Preset patch baselines for Ubuntu and Debian are view-only and cannot be modified.

After baseline update, we recommend immediately performing a patch scan on the target instance to verify the applicability of the new rules and avoid compliance exceptions caused by incorrect rules. Learn more.

When you call this operation, if you do not pass in optional parameters, the original configuration is retained.

Debugging

API Explorer

You can initiate calls online through API Explorer without paying attention to the signature generation process and quickly obtain the call results.

Go to debug

Request parameters

Only the request parameters specific to this operation and some common parameters are listed below. For more information, refer to Common parameters.

Action string required Sample value: UpdatePatchBaseline

The operation that you want to perform. Value: UpdatePatchBaseline.

Version string required Sample value: 2020-04-01

The API version. Value: 2020-04-01.

Sources object[] Optional Sample value: --

The patch repositories used to specify alternative patch repositories. You can specify internal YUM or APT repositories.

Products string[] required Sample value: Ubuntu24.04

The operating system versions to which the patch repository applies. Valid values:

Ubuntu:

Ubuntu 24

Ubuntu 22

Ubuntu 20

Ubuntu 18

Ubuntu 16

Debian

Debian 12

Debian 11

Debian 10

Debian 9

Debian 8

Name string required Sample value: UbunutuSource

The specified name of the patch repository.

Configuration string required Sample value: deb http://security.ubuntu.com/ubuntu jammy main

The patch repository configuration value. Value:

It must follow the software repository format of the target operating system.

It must include core fields, such as valid repository address, version identifier, and component type, with no syntax errors.

Length range: 1–1024 characters.

ApprovedPatchesComplianceLevel string Optional Sample value: UNSPECIFIED

Defines the compliance level for approved patches. This parameter specifies the severity of a compliance violation when an approved patch is detected as missing. Value:

UNSPECIFIED (default): Temporary level for pending classification.

tip

If this parameter not specified, UNSPECIFIED is returned by default.

CRITICAL: Highest compliance risk level.

HIGH: High priority level.

MEDIUM: Medium priority level for routine remediation.

LOW: Low priority level for deferred remediation.

INFORMATIONAL: Non-risk informational level.

BaselineId string required Sample value: bl-xffsafgewgdf****

The patch baseline ID. You can obtain it by calling CreatePatchBaseline. Only one patch baseline ID can be passed in at a time.

Name string Optional Sample value: Win2019-Prod-Critical-7day-Approval

The name of the patch baseline. Value:

It must start with a letter or a Chinese character.

It can contain only Chinese characters, letters, digits, underscores (_), hyphens (-), and English periods (.).

It must be 1 to 128 characters in length.

tip

We recommend that you use a name that clearly reflects its purpose.

Description string Optional Sample value: The description of baseline.

The description of the patch baseline. Value:

It must start with a letter or a Chinese character.

It can contain only Chinese characters, letters, digits, underscores (_), hyphens (-), equal signs (=), English commas (,), English periods (.), Chinese commas (，), Chinese periods (。), and spaces.

It must be 0 to 256 characters in length.

ApprovalRules object[] required Sample value: --

The patch baseline installation rules used to automatically approve patches. Value:

At least 1 installation rule must be configured.

Up to 10 installation rules can be configured.

EnableNonSecurity boolean Optional Sample value: true

Whether to enable non-security patch updates. Value:

true: Enable.

false (default): Do not enable.

ComplianceLevel string Optional Sample value: CRITICAL

The compliance severity level of approved patches. Value:

UNSPECIFIED (default): Temporary level for pending classification.

tip

If this parameter not specified, UNSPECIFIED is returned by default.

CRITICAL: Highest compliance risk level.

HIGH: High priority level.

MEDIUM: Medium priority level for routine remediation.

LOW: Low priority level for deferred remediation.

INFORMATIONAL: Non-risk informational level.

ApproveUntilDate string Optional Sample value: 2020-04-01

The deadline for automatic approval. Patches released before this date are automatically approved.

Format: YYYY-MM-DD.

Evaluation time: The deadline is evaluated based on UTC time. For example, if this parameter is set to 2025-11-16, all patches released before 2025-11-16T23:59:59Z and matching the rules are approved.

tip

You must specify either ApproveAfterDays or ApproveUntilDate.

ApproveAfterDays integer Optional Sample value: 10

Specifies the number of days after a patch is released to automatically approve it. Value:

Valid values: 0–360 days. For example, a value of 7 means the patch is automatically approved 7 days after its release.

Evaluation time: The patch release date is evaluated based on UTC time.

tip

Either ApproveAfterDays or ApproveUntilDate must be specified.

PatchFilterGroup object[] required Sample value: --

The group of patch filter conditions that apply to the patch baseline installation rules.

Key string required Sample value: PRODUCT

The filter dimension (patch attribute key).

tip

Different operating systems support different keys.

Values string[] required Sample value: Ubuntu24.04

The value matching the corresponding key.

RejectedPatches string[] Optional Sample value: ["example"]

The list of patches explicitly rejected in the patch baseline, expressed as a string array. 1–50 patches are supported.

RejectedPatchesAction string Optional Sample value: BLOCK

The operation for rejected patches. This parameter specifies how the system processes patches added to the RejectedPatches list. Value:

ALLOW_AS_DEPENDENCY (default): If a rejected patch is a dependency of a required software package, the system allows installation of the rejected patch to ensure normal operation of the main software package. In this case, the compliance status of the patch is INSTALLED_OTHER.

BLOCK: Strictly blocks the installation of any patch in the RejectedPatches list. If a patch to be installed depends on a rejected patch, neither patch can be installed.

If a patch is installed before being rejected, its compliance status is INSTALLED_REJECTED.

If this rule is triggered during installation, the operation status is FAILED.

tip

This parameter takes effect only when the RejectedPatches parameter is configured.

If RejectedPatches is configured but this parameter is not specified, ALLOW_AS_DEPENDENCY is returned by default.

ApprovedPatches string[] Optional Sample value: ["example"]

The list of explicitly approved patches in the baseline, expressed as a string array. This parameter specifies patches that are always approved and installed, even if they do not match the rules in ApprovalRules. 1–50 patches are supported.

ApprovedPatchesEnableNonSecurity boolean Optional Sample value: true

Specifies whether the approved patches list includes non-security patch updates for managed instances. Value:

true: Non-security updates in the ApprovedPatches list are evaluated and installed in addition to security patches.

false (default): Only security-related updates in the ApprovedPatches list are evaluated and installed.

Response parameters

Only the response parameters specific to this operation are listed below. For more information, refer to the response structure.

BaselineId string Sample value: bl-xffsafgewgdf****

The ID of the patch baseline.

Sample request

POST /?Version=2020-04-01&Action=UpdatePatchBaseline HTTP/1.1​
Host: ecs.cn-beijing.volcengineapi.com​
AccessKey: AK*****************​
SecretKey: TXpS***************​
ServiceName: ecs​
Region: cn-beijing​
X-Top-Account-Id: 21000*****​
Content-Type: application/json​
​
{​
    "BaselineId": "bl-12345678ab****",​
    "Description": "Production Environment Ubuntu Base Line",​
    "ApprovedPatches": ["nginx"]​
}​

Sample response

{​
    "ResponseMetadata": {​
        "RequestId": "202306011000000000000000000****",​
        "Action": "UpdatePatchBaseline",​
        "Version": "2020-04-01",​
        "Service": "ecs",​
        "Region": "cn-beijing"​
    },​
    "Result": {​
        "BaselineId": "bl-533456899ff****"​
    }​
}​

Error codes

The table below lists the business-related error codes of the operation. For more information, refer to Common error codes.

Status code	Error code	Error message	Description
400	InvalidArgument	The specified argument is invalid.	The specified parameter is invalid.
500	InternalError	An internal error has occurred.	An internal error occurred. Try again. If multiple attempts fail, submit a ticket.

Last updated: 2026.03.30 11:55:54