List project relationships
- Sandbox: available
- Staging: available
- Production: unknown
Returns where your current project sits in the project hierarchy: its parent and its direct children.
Auth: bearer token of a project admin (ProjectMembership.admin).
Scope: the caller's project (from the token).
Behaviour
parentProjectIdisnullfor a project with no parent.subProjectIdslists direct children only.- The result is cached for up to 5 minutes. Creating or deleting a child through Ovok clears the cache; other changes can take that long to show.
Example
curl -X GET 'https://api.sandbox.ovok.com/v1/internal/sub-project' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk'application/json- response
currentProjectId*stringparentProjectId*stringsubProjectIds*array<string>curl -X GET 'https://api.sandbox.ovok.com/sub-project'{ "currentProjectId": "string", "parentProjectId": "string", "subProjectIds": [ "string" ]}Repair child project access policy drift POST
Repairs AccessPolicy drift in the direct children of your current project: it creates each missing copy and overwrites each changed one from your project's policy. **Auth:** bearer token of a project admin (`ProjectMembership.admin`). **Scope:** the caller's project (from the token) and its direct children. Grandchildren are not touched. ## Behaviour - Uses the same comparison as `GET access-policy/drift` and returns what it found, in the same shape, before the repair. - A `missing` policy is created in the child; a `changed` one is overwritten with your `compartment`, `resource` and `ipAccessRule`. Either way the child's copy is tagged with the id of your policy. - An `orphan` with `copyOfDeletedPolicy: true` is deleted: it is a copy of a policy you have deleted. Members of the child who still hold it are locked out of the child until they are given another role. - Any other `orphan` is listed and never deleted. A child's own policies carry no copy tag, and its patient-sharing templates are never deleted, whatever their tag. - Idempotent: a second call finds nothing left to repair, apart from the orphans it keeps. - The writes are not atomic. If one fails, the request fails; policies already written stay written, and you can call the route again. ## Example ```bash curl -X POST 'https://api.sandbox.ovok.com/v1/internal/sub-project/access-policy/reconcile' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' ```
Create a sub tenant POST
Creates a child project (sub-tenant) of your current project. Use it from admin tooling and from headless integrations that hold an admin client token. **Auth:** bearer token of a project admin (`ProjectMembership.admin`). Setting `parentProjectId` also requires a super admin. **Scope:** the parent is the caller's project (from the token), or `parentProjectId` for a super admin. ## Behaviour - Creates, all or nothing: the `Project` (with the standard Ovok project features, `extension` copied as given, and its own Signals tenant), its tenant code, the parent's link to it, a Practitioner and an admin membership in the new project, and the parent-child relationship. If a step fails, the steps already done are undone. - **User session:** the new project is owned by your user, the Practitioner copies your profile, and the membership is yours. The response is `{ "success": true }`. - **Client application session** (no user): the new project is owned by the parent project. The response is `{ "success": true, "projectId": "..." }`. - A concurrent create of the same name under the same parent is refused with 409 and writes nothing. A later create with the same name makes a second project. - Served at both `/v1/internal/sub-project` and `/sub-project`. ## Example ```bash curl -X POST 'https://api.sandbox.ovok.com/v1/internal/sub-project' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \ -H 'Content-Type: application/json' \ -d '{ "name": "My Medical Project" }' ```