# Update access policy

Canonical page: https://docs.ovok.com/api/slim/policy/update-access-policy

`PUT /v1/slim/policy/{id}`

Replaces an access policy (role) of your project and sets exactly which practitioners hold it.

**Auth:** Bearer token for a practitioner, project admin or System Owner session. The caller's access policy must grant `Practitioner:create`, the right to invite users (a project admin who holds no access policy skips this check).
**Scope:** The policy must belong to the caller's project (from the token). Policies of parent or child projects can be read but not updated here.

## Behaviour

- `policy.id` must equal the `id` in the path.
- The policy body is replaced with `policy`. The same interactions as on create are added (`Consent`; `DeviceUseStatement` and `EpisodeOfCare` for policies that create or update `Patient`; `Provenance` and `AuditEvent` for `Admin` and `System Owner` policies).
- You cannot update a policy that ranks above you, nor rename one to a rank above you. Ranks: `System Owner`, then `Admin`, then every other policy.
- You cannot add or remove a member whose current role ranks above yours. A member ranks as every policy their membership holds now (`accessPolicy` and any `access` entries), each ranked by its name. A project admin (`admin: true`) ranks as System Owner.
- `members` is the complete list of holders, as references such as `Practitioner/<id>`:
  - a listed member's membership in your project now points to this policy, replacing the one it held;
  - a current holder not listed loses the policy. Medplum reads a membership with no policy as full access, so if that would leave them with none (no `access` entries, not a project admin), the request answers 409: move them to another role first;
  - you cannot remove yourself.
- The policy and the membership changes commit together. Past 49 membership changes they are written in two steps.
- The updated policy is then copied by name into each direct child project, also when it was renamed. A failed copy does not fail the request.
- Returns the updated policy with its members.


## Example

```bash
curl -X PUT 'https://api.sandbox.ovok.com/v1/slim/policy/c3499c27-2973-0a7f-807e-fb8676a92dcb' \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \
  -H 'Content-Type: application/json' \
  -d '{
    "policy": {
      "resourceType": "AccessPolicy",
      "id": "c3499c27-2973-0a7f-807e-fb8676a92dcb",
      "name": "Night shift",
      "resource": [{ "resourceType": "Patient", "interaction": ["read", "search", "update"] }]
    },
    "members": [{ "reference": "Practitioner/c3499c27-2973-0a7f-807e-fb8676a92dcb" }]
  }'
```