# Repair child project access policy drift

Canonical page: https://docs.ovok.com/api/sub-project/repair-child-project-access-policy-drift-3

`POST /v1/sub-project/access-policy/reconcile`

Repairs AccessPolicy drift in the direct children of your current project: it creates each missing copy and overwrites each changed one from your project's policy.

**Auth:** bearer token of a project admin (`ProjectMembership.admin`).
**Scope:** the caller's project (from the token) and its direct children. Grandchildren are not touched.

## Behaviour

- Uses the same comparison as `GET access-policy/drift` and returns what it found, in the same shape, before the repair.
- A `missing` policy is created in the child; a `changed` one is overwritten with your `compartment`, `resource` and `ipAccessRule`. Either way the child's copy is tagged with the id of your policy.
- An `orphan` with `copyOfDeletedPolicy: true` is deleted: it is a copy of a policy you have deleted. Members of the child who still hold it are locked out of the child until they are given another role.
- Any other `orphan` is listed and never deleted. A child's own policies carry no copy tag, and its patient-sharing templates are never deleted, whatever their tag.
- Idempotent: a second call finds nothing left to repair, apart from the orphans it keeps.
- The writes are not atomic. If one fails, the request fails; policies already written stay written, and you can call the route again.

## Example

```bash
curl -X POST 'https://api.sandbox.ovok.com/v1/internal/sub-project/access-policy/reconcile' \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk'
```