OVOK DOCS
Get startedOvokSignalsSDKsGuidesAPI referenceDeveloper resources
Sub Project

Repair child project access policy drift

  • Sandbox: available
  • Staging: available
  • Production: unknown
POST
/sub-project/access-policy/reconcile

Repairs AccessPolicy drift in the direct children of your current project: it creates each missing copy and overwrites each changed one from your project's policy.

Auth: bearer token of a project admin (ProjectMembership.admin). Scope: the caller's project (from the token) and its direct children. Grandchildren are not touched.

Behaviour

  • Uses the same comparison as GET access-policy/drift and returns what it found, in the same shape, before the repair.
  • A missing policy is created in the child; a changed one is overwritten with your compartment, resource and ipAccessRule. Either way the child's copy is tagged with the id of your policy.
  • An orphan with copyOfDeletedPolicy: true is deleted: it is a copy of a policy you have deleted. Members of the child who still hold it are locked out of the child until they are given another role.
  • Any other orphan is listed and never deleted. A child's own policies carry no copy tag, and its patient-sharing templates are never deleted, whatever their tag.
  • Idempotent: a second call finds nothing left to repair, apart from the orphans it keeps.
  • The writes are not atomic. If one fails, the request fails; policies already written stay written, and you can call the route again.

Example

curl -X POST 'https://api.sandbox.ovok.com/v1/internal/sub-project/access-policy/reconcile' \  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk'

Response Body

The differences found before the repair.

application/json
  1. response
count*integer

Number of drift entries.

Range0 <= value
drift*array<>
Example Request
curl -X POST 'https://api.sandbox.ovok.com/sub-project/access-policy/reconcile'
Example Response
{  "count": 0,  "drift": [    {      "childProjectId": "string",      "name": "string",      "policyId": "string",      "kind": "missing",      "copyOfDeletedPolicy": true    }  ]}

Check child project access policy drift GET

Compares the AccessPolicies of each direct child of your current project with your project's own, and reports the differences. Nothing is written. **Auth:** bearer token of a project admin (`ProjectMembership.admin`). **Scope:** the caller's project (from the token) and its direct children. Grandchildren are not compared. ## Behaviour - Policies are matched by `name`, and compared on `compartment`, `resource` and `ipAccessRule`. - Each difference is one `drift` entry with a `kind`: - `missing`: the child has no policy with that name. - `changed`: the child's policy differs from yours. - `orphan`: the child holds a policy whose name your project does not have. A child's own policies, such as its patient-sharing template, show up as orphans. - `copyOfDeletedPolicy` is true for an `orphan` that is a copy of one of your policies you have since deleted: every copy is tagged with the id of the policy it copies, and that policy is no longer in your project. It is false for every other entry, a child's own policies included, and always false for the two patient-sharing templates every project makes for itself, whatever their tag. - `count` is the number of entries. - `POST access-policy/reconcile` repairs the `missing` and `changed` entries and deletes the `copyOfDeletedPolicy` ones. ## Example ```bash curl -X GET 'https://api.sandbox.ovok.com/v1/internal/sub-project/access-policy/drift' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' ```

Repair child project access policy drift POST

Repairs AccessPolicy drift in the direct children of your current project: it creates each missing copy and overwrites each changed one from your project's policy. **Auth:** bearer token of a project admin (`ProjectMembership.admin`). **Scope:** the caller's project (from the token) and its direct children. Grandchildren are not touched. ## Behaviour - Uses the same comparison as `GET access-policy/drift` and returns what it found, in the same shape, before the repair. - A `missing` policy is created in the child; a `changed` one is overwritten with your `compartment`, `resource` and `ipAccessRule`. Either way the child's copy is tagged with the id of your policy. - An `orphan` with `copyOfDeletedPolicy: true` is deleted: it is a copy of a policy you have deleted. Members of the child who still hold it are locked out of the child until they are given another role. - Any other `orphan` is listed and never deleted. A child's own policies carry no copy tag, and its patient-sharing templates are never deleted, whatever their tag. - Idempotent: a second call finds nothing left to repair, apart from the orphans it keeps. - The writes are not atomic. If one fails, the request fails; policies already written stay written, and you can call the route again. ## Example ```bash curl -X POST 'https://api.sandbox.ovok.com/v1/internal/sub-project/access-policy/reconcile' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' ```