Check child project access policy drift
- Sandbox: available
- Staging: available
- Production: unknown
Compares the AccessPolicies of each direct child of your current project with your project's own, and reports the differences. Nothing is written.
Auth: bearer token of a project admin (ProjectMembership.admin).
Scope: the caller's project (from the token) and its direct children. Grandchildren are not compared.
Behaviour
- Policies are matched by
name, and compared oncompartment,resourceandipAccessRule. - Each difference is one
driftentry with akind:missing: the child has no policy with that name.changed: the child's policy differs from yours.orphan: the child holds a policy whose name your project does not have. A child's own policies, such as its patient-sharing template, show up as orphans.
copyOfDeletedPolicyis true for anorphanthat is a copy of one of your policies you have since deleted: every copy is tagged with the id of the policy it copies, and that policy is no longer in your project. It is false for every other entry, a child's own policies included, and always false for the two patient-sharing templates every project makes for itself, whatever their tag.countis the number of entries.POST access-policy/reconcilerepairs themissingandchangedentries and deletes thecopyOfDeletedPolicyones.
Example
curl -X GET 'https://api.sandbox.ovok.com/v1/internal/sub-project/access-policy/drift' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk'The differences found. Nothing was written.
application/json- response
count*integerNumber of drift entries.
0 <= valuedrift*array<>curl -X GET 'https://api.sandbox.ovok.com/sub-project/access-policy/drift'{ "count": 0, "drift": [ { "childProjectId": "string", "name": "string", "policyId": "string", "kind": "missing", "copyOfDeletedPolicy": true } ]}Update location in zone PUT
Updates a location in a zone: its name, floor, room and bed, the devices assigned to it, and the resident on those devices. **Auth:** Bearer token. The caller must be a practitioner, an admin, a super admin, or hold the "System Owner" access policy. The access policy must grant `Location:update` and `Device:update` (an admin or super admin who holds no access policy skips this check). **Scope:** The zone must belong to the caller's project (from the token), its parent project, or one of its sub-projects. The location must be in the caller's project, and its managing organization must be the zone. Devices and residents named in the body must be in your project or a sub-project. ## Behaviour - `name` is required and must be unique among the locations your token can search, not counting this one. - `floor`, `room` and `bed` replace only the values you send; omitted ones keep their stored value. The resulting floor, room and bed must not match another location in the zone. - `deviceId` (one UUID or a list) sets the devices at the location to exactly that set: devices not listed are removed from it, new ones are added. `null` removes every device. Omit `deviceId` to leave the devices unchanged. - `patientId` assigns that resident to the devices named in `deviceId`, or, without `deviceId`, to the location's single device. A resident assigned there before is unassigned from those devices. - **Omitting `patientId` unassigns the current resident from every device at the location** (and from the devices in `deviceId`). Send the current `patientId` to keep the resident. - A discharged resident cannot be assigned. - The write is atomic and takes a short write lock on the devices and locations it touches. - The response is the updated location, in the same shape as `GET /v1/slim/location/{id}`. ## Example ```bash curl -X PUT 'https://api.sandbox.ovok.com/v1/slim/zones/c3499c27-2973-0a7f-807e-fb8676a92dcb/locations/87ea5dfc-8b8e-384d-8489-79496e706390' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \ -H 'Content-Type: application/json' \ -d '{ "name": "Room 101 Bed 1", "room": "101", "bed": "1", "deviceId": "c3499c27-2973-0a7f-807e-fb8676a92dcb", "patientId": "87ea5dfc-8b8e-384d-8489-79496e706390" }' ```
Check child project access policy drift GET
Compares the AccessPolicies of each direct child of your current project with your project's own, and reports the differences. Nothing is written. **Auth:** bearer token of a project admin (`ProjectMembership.admin`). **Scope:** the caller's project (from the token) and its direct children. Grandchildren are not compared. ## Behaviour - Policies are matched by `name`, and compared on `compartment`, `resource` and `ipAccessRule`. - Each difference is one `drift` entry with a `kind`: - `missing`: the child has no policy with that name. - `changed`: the child's policy differs from yours. - `orphan`: the child holds a policy whose name your project does not have. A child's own policies, such as its patient-sharing template, show up as orphans. - `copyOfDeletedPolicy` is true for an `orphan` that is a copy of one of your policies you have since deleted: every copy is tagged with the id of the policy it copies, and that policy is no longer in your project. It is false for every other entry, a child's own policies included, and always false for the two patient-sharing templates every project makes for itself, whatever their tag. - `count` is the number of entries. - `POST access-policy/reconcile` repairs the `missing` and `changed` entries and deletes the `copyOfDeletedPolicy` ones. ## Example ```bash curl -X GET 'https://api.sandbox.ovok.com/v1/internal/sub-project/access-policy/drift' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' ```