Skip to main content
PUT
Update Access Policy

Authentication and permissions

Token requirements: User-based token (OAuth) or Organization-scoped API key or Team-scoped API key. Send a bearer access token for one of these identities. The permissions and resource restrictions below also apply.
Permissions joined by + are all required; or separates alternatives. Full-access keys still cannot call endpoints marked unsupported. Team keys must allow every team checked by the request. OAuth access depends on the user’s roles and resource access.
  • Attach an approval procedure: With a non-empty approval_procedure_id, the procedure must be a named approval procedure in the policy’s team.
  • Remove the approval procedure: An empty approval_procedure_id removes the policy’s approval procedure.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

id
string
required

The ID of the access policy.

Body

application/json
name
string

The name of the access policy.

description
string

A description of the access policy.

maxAccessMinutes
integer<int32>

The maximum number of minutes that access can be granted for.

requireBusinessJustification
boolean | null

Whether a business justification is required when requesting access. Omit to leave unchanged.

The recommended duration in minutes for access requests (optional).

requireOnBehalfOfConfirmation
boolean | null

Whether requests made on behalf of others require the target user's confirmation. Omit to leave unchanged.

scopedId
string | null

Rekeys the policy's stable identity (apo_ + 22 base62 chars). Omit to leave unchanged. Must be unique within the team. The team-default policy cannot be rekeyed, and reserved sentinel values are rejected.

approvalProcedureId
string | null

The ID of a named approval procedure that must approve requests for roles governed by the policy. Omit to leave the policy's approval unchanged; send an empty string to remove it. Attaching requires permission to view approval procedures and removing requires permission to delete them.

Response

200 - application/json

Success

data
data · object

The updated access policy.