# Check child project access policy drift

Canonical page: https://docs.ovok.com/api/sub-project/check-child-project-access-policy-drift-4

`GET /v1/internal/sub-project/access-policy/drift`

Compares the AccessPolicies of each direct child of your current project with your project's own, and reports the differences. Nothing is written.

**Auth:** bearer token of a project admin (`ProjectMembership.admin`).
**Scope:** the caller's project (from the token) and its direct children. Grandchildren are not compared.

## Behaviour

- Policies are matched by `name`, and compared on `compartment`, `resource` and `ipAccessRule`.
- Each difference is one `drift` entry with a `kind`:
  - `missing`: the child has no policy with that name.
  - `changed`: the child's policy differs from yours.
  - `orphan`: the child holds a policy whose name your project does not have. A child's own policies, such as its patient-sharing template, show up as orphans.
- `copyOfDeletedPolicy` is true for an `orphan` that is a copy of one of your policies you have since deleted: every copy is tagged with the id of the policy it copies, and that policy is no longer in your project. It is false for every other entry, a child's own policies included, and always false for the two patient-sharing templates every project makes for itself, whatever their tag.
- `count` is the number of entries.
- `POST access-policy/reconcile` repairs the `missing` and `changed` entries and deletes the `copyOfDeletedPolicy` ones.

## Example

```bash
curl -X GET 'https://api.sandbox.ovok.com/v1/internal/sub-project/access-policy/drift' \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk'
```