> ## Documentation Index
> Fetch the complete documentation index at: https://base-a060aa97-roethke-b20-upgrade-pages.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# IPolicyRegistry.updateAllowlist

> Sets membership of a batch of accounts in an ALLOWLIST policy.

## Signature

```solidity IPolicyRegistry.sol theme={null}
function updateAllowlist(uint64 policyId, bool allowed, address[] calldata accounts) external;
```

| Field | Value |
| - | - |
| Selector | `0x3388fb5b` |
| Canonical signature | `updateAllowlist(uint64,bool,address[])` |

## Description

Sets each address in `accounts` to `allowed` (add or remove) in an `ALLOWLIST` policy. The change takes effect on the next `isAuthorized` call against this policy. Every token and composite that references `policyId` sees the updated membership immediately, no second write on the token is needed.

Membership batches are capped by the registry, currently at 64 accounts. A larger batch reverts `BatchSizeTooLarge(maxBatchSize)`, which carries the limit.

## Parameters

| Name | Type | Description |
| - | - | - |
| `policyId` | `uint64` | The allowlist policy to update. |
| `allowed` | `bool` | `true` to add accounts to the set; `false` to remove them. |
| `accounts` | `address[]` | Accounts to update. Maximum 64 per call. |

## Reverts

| Error | Condition |
| - | - |
| `Unauthorized()` | Caller is not the current policy admin. |
| `PolicyNotFound()` | `policyId` does not exist in the registry. |
| `IncompatiblePolicyType()` | The policy exists but is not an `ALLOWLIST`. |
| `BatchSizeTooLarge(maxBatchSize)` | `accounts.length` exceeds 64. |

## Events

Emits `AllowlistUpdated(policyId, updater, allowed, accounts)` on success.

## Access Control

Callable only by the current admin of `policyId`. Any other caller reverts `Unauthorized`.

## Example

```solidity Add accounts to an allowlist theme={null}
address[] memory accounts = new address[](2);
accounts[0] = alice;
accounts[1] = bob;
IPolicyRegistry(registry).updateAllowlist(kycId, true, accounts);
```

After this call, `isAuthorized(kycId, alice)` and `isAuthorized(kycId, bob)` return `true`. Any token or composite policy already pointing at `kycId` reflects this without a separate `updatePolicy` call on the token.

To remove an account, pass `false`:

```solidity Remove an account from an allowlist theme={null}
address[] memory removed = new address[](1);
removed[0] = alice;
IPolicyRegistry(registry).updateAllowlist(kycId, false, removed);
```

<Note>
  Only the current admin of a policy can call `updateAllowlist`. If you need a different party to manage membership, use `stageUpdateAdmin` and `finalizeUpdateAdmin` to transfer administration first.
</Note>