Get access policy

Creates an access policy (role) in your project and assigns it to the listed practitioners. Use it to define a new role. **Auth:** Bearer token for a practitioner, project admin or System Owner session. The caller's access policy must grant `AccessPolicy:create` and `ProjectMembership:update` (a project admin who holds no access policy skips this check). **Scope:** The policy is created in the caller's project (from the token). ## Behaviour - You cannot create a policy above your own rank. Ranks come from the policy name or its `basedOn` display: `System Owner` is the highest, then `Admin`, then every other policy. Project admins rank as System Owner. - Ovok adds interactions the apps rely on: - `Consent`: `read`, `search`, `create`, `update`, always; - `DeviceUseStatement` and `EpisodeOfCare`: `read`, `search`, `create`, `update`, when the policy may create or update `Patient`; - `Provenance` and `AuditEvent`: `read`, `search`, when the policy is named `Admin` or `System Owner`. - `members` are profile references such as `Practitioner/<id>`. Each listed member's membership in your project now points to the new policy, replacing the policy it held before. A member with no membership in your project is skipped. - You cannot list a member whose current role ranks above yours. A member ranks as every policy their membership holds now (`accessPolicy` and any `access` entries), each ranked by its name. A project admin (`admin: true`) ranks as System Owner. - The policy and the membership changes commit together. Past 49 membership changes they are written in two steps. - The policy is then copied by name into each direct child project. A failed copy does not fail the request. - Returns the created policy with its members, as in `GET /v1/slim/policy/{id}`. ## Example ```bash curl -X POST 'https://api.sandbox.ovok.com/v1/slim/policy' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \ -H 'Content-Type: application/json' \ -d '{ "policy": { "resourceType": "AccessPolicy", "name": "Night shift", "resource": [{ "resourceType": "Patient", "interaction": ["read", "search"] }] }, "members": [{ "reference": "Practitioner/c3499c27-2973-0a7f-807e-fb8676a92dcb", "display": "Max Mustermann" }] }' ```