OVOK DOCS
Get startedOvokSignalsSDKsGuidesAPI referenceDeveloper resources
Sub Project

Repair child project access policy drift

  • Sandbox: available
  • Staging: available
  • Production: unknown
POST
/v1/sub-project/access-policy/reconcile

Repairs AccessPolicy drift in the direct children of your current project: it creates each missing copy and overwrites each changed one from your project's policy.

Auth: bearer token of a project admin (ProjectMembership.admin). Scope: the caller's project (from the token) and its direct children. Grandchildren are not touched.

Behaviour

  • Uses the same comparison as GET access-policy/drift and returns what it found, in the same shape, before the repair.
  • A missing policy is created in the child; a changed one is overwritten with your compartment, resource and ipAccessRule. Either way the child's copy is tagged with the id of your policy.
  • An orphan with copyOfDeletedPolicy: true is deleted: it is a copy of a policy you have deleted. Members of the child who still hold it are locked out of the child until they are given another role.
  • Any other orphan is listed and never deleted. A child's own policies carry no copy tag, and its patient-sharing templates are never deleted, whatever their tag.
  • Idempotent: a second call finds nothing left to repair, apart from the orphans it keeps.
  • The writes are not atomic. If one fails, the request fails; policies already written stay written, and you can call the route again.

Example

curl -X POST 'https://api.sandbox.ovok.com/v1/internal/sub-project/access-policy/reconcile' \  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk'

Response Body

The differences found before the repair.

application/json
  1. response
count*integer

Number of drift entries.

Range0 <= value
drift*array<>
Example Request
curl -X POST 'https://api.sandbox.ovok.com/v1/sub-project/access-policy/reconcile'
Example Response
{  "count": 0,  "drift": [    {      "childProjectId": "string",      "name": "string",      "policyId": "string",      "kind": "missing",      "copyOfDeletedPolicy": true    }  ]}

Repair child project access policy drift POST

Repairs AccessPolicy drift in the direct children of your current project: it creates each missing copy and overwrites each changed one from your project's policy. **Auth:** bearer token of a project admin (`ProjectMembership.admin`). **Scope:** the caller's project (from the token) and its direct children. Grandchildren are not touched. ## Behaviour - Uses the same comparison as `GET access-policy/drift` and returns what it found, in the same shape, before the repair. - A `missing` policy is created in the child; a `changed` one is overwritten with your `compartment`, `resource` and `ipAccessRule`. Either way the child's copy is tagged with the id of your policy. - An `orphan` with `copyOfDeletedPolicy: true` is deleted: it is a copy of a policy you have deleted. Members of the child who still hold it are locked out of the child until they are given another role. - Any other `orphan` is listed and never deleted. A child's own policies carry no copy tag, and its patient-sharing templates are never deleted, whatever their tag. - Idempotent: a second call finds nothing left to repair, apart from the orphans it keeps. - The writes are not atomic. If one fails, the request fails; policies already written stay written, and you can call the route again. ## Example ```bash curl -X POST 'https://api.sandbox.ovok.com/v1/internal/sub-project/access-policy/reconcile' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' ```

Repair child project access policy drift POST

Repairs AccessPolicy drift in the direct children of your current project: it creates each missing copy and overwrites each changed one from your project's policy. **Auth:** bearer token of a project admin (`ProjectMembership.admin`). **Scope:** the caller's project (from the token) and its direct children. Grandchildren are not touched. ## Behaviour - Uses the same comparison as `GET access-policy/drift` and returns what it found, in the same shape, before the repair. - A `missing` policy is created in the child; a `changed` one is overwritten with your `compartment`, `resource` and `ipAccessRule`. Either way the child's copy is tagged with the id of your policy. - An `orphan` with `copyOfDeletedPolicy: true` is deleted: it is a copy of a policy you have deleted. Members of the child who still hold it are locked out of the child until they are given another role. - Any other `orphan` is listed and never deleted. A child's own policies carry no copy tag, and its patient-sharing templates are never deleted, whatever their tag. - Idempotent: a second call finds nothing left to repair, apart from the orphans it keeps. - The writes are not atomic. If one fails, the request fails; policies already written stay written, and you can call the route again. ## Example ```bash curl -X POST 'https://api.sandbox.ovok.com/v1/internal/sub-project/access-policy/reconcile' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' ```