> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentcard.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Save a preset

> Save a named preset, or replace its rules. Saving filters nothing until the preset is attached.

The rules are replaced, not merged: send every rule the preset should hold. A replacement keeps every attachment, and purchases already counted toward a cap stay counted, so replacing the rules never resets a rolling window. Saving a preset attaches it to nothing; attach it to a stored card. Takes a platform access token or an API key. See [Set rules on a card](/vault/set-rules-on-a-card).

Write the rules one of three ways: as the fields below, as `preset` with a built-in name (`daily`, `cli_only`, `weekday_meals`, or `ai_labs`), or as `privileges`, an array of rules in the same shape a card preset takes.

<ParamField path="name" type="string" required>1 to 64 letters, digits, hyphens or underscores, starting with a letter or digit.</ParamField>
<ParamField body="total" type="number">Cap on the purchases under each attachment, over all time, in US dollars.</ParamField>
<ParamField body="per_day" type="number">Rolling 24-hour cap, in US dollars, for the purchases under each attachment.</ParamField>
<ParamField body="per_week" type="number">Rolling 7-day cap, in US dollars.</ParamField>
<ParamField body="per_month" type="number">Rolling 30-day cap, in US dollars.</ParamField>
<ParamField body="categories" type="string">Categories the merchant must be in, comma-separated: `meals`, `groceries`, `travel`, `software`, `ai`, `wellness`, `retail`. Judged on the merchant Agentcard names from `checkout_origin` and the payment request, never on the `merchant` text.</ParamField>
<ParamField body="only_merchants" type="string">Comma-separated patterns the merchant's name or checkout host must match, such as `EXAMPLE SHOP,shop.example.com`. The `merchant` text your agent sends is not matched.</ParamField>
<ParamField body="only_in" type="string">Places the merchant must be in, comma-separated: a country (`US`, `Canada`), a US state (`California`, `US-CA`), or a region (`europe`, `north-america`, `apac`).</ParamField>
<ParamField body="currencies" type="string">The currencies a purchase may be in, comma-separated, by code or common name: `usd,eur` or `dollars,euros`.</ParamField>
<ParamField body="only_days" type="string">`mon,tue`, or `weekdays` / `weekends`.</ParamField>
<ParamField body="only_hours" type="string">For example `9-17`, 24-hour clock, in `timezone`.</ParamField>
<ParamField body="timezone" type="string">IANA zone for `only_days` and `only_hours`. Default `UTC`.</ParamField>
<ParamField body="only_from" type="string">Where purchases may come from. Vault purchases come from your agent and count as `api`.</ParamField>
<ParamField body="mode" type="string">What the preset does when a purchase breaks any of its rules: `strict` refuses it (the default), `watch` lets it through and tells you.</ParamField>
<ParamField body="preset" type="string">A built-in name instead of the fields above.</ParamField>
<ParamField body="privileges" type="object[]">The rules as an array, for a rule the fields do not cover, such as `{"kind": "merchant_allow", "patterns": ["BRAXTER'S DELI"]}`.</ParamField>

<RequestExample>
  ```bash cURL theme={null}
  curl -X PUT https://api.agentcard.sh/api/v2/vault/presets/office-supplies \
    -H "Authorization: Bearer $ORG_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"per_day": 50, "only_merchants": "EXAMPLE SHOP,ACME", "currencies": "usd"}'
  ```
</RequestExample>

<ResponseExample>
  ```json 200 theme={null}
  {
    "object": "vault_preset",
    "name": "office-supplies",
    "id": "cmtvwbc0g000bjpcc88yiyx8z",
    "version": 1,
    "summary": "Up to $50.00 per day. Merchants: EXAMPLE SHOP, ACME. Currency: USD.",
    "attachments": []
  }
  ```
</ResponseExample>

A merchant Agentcard does not know has no category and no country, so a category or place rule on a `strict` preset refuses a purchase there with `category_unknown` or `geo_unknown`; see [Where the merchant comes from](/vault/set-rules-on-a-card#where-the-merchant-comes-from).

**Errors.** `400 policy_invalid` when the name or the rules cannot be read; the message names the field or the rule. `502 policy_update_failed` when the rules could not be saved; nothing changed.