Patch Access Policy
Update an access policy; any field you omit keeps its value. apps, when sent, replaces the policy’s complete set of grants wholesale, so leave it out to keep every grant. No field can be null. Send is_everyone_condition: true to reset the condition to everyone; sending it together with a different access_condition returns 400. Listing an app twice, or an entitlement twice under one app, returns 400. An app or entitlement that doesn’t resolve returns 404 without saying which.
An access_condition may use only the attributes and operators the Lumos condition builder offers, with one operator per attribute, and a date-time value needs a time zone offset (2026-01-01T00:00:00Z). Any other condition returns 400 naming each problem.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
The access policy's ID, which GET /v1/access-policies returns as id.
Body
A merge-patch body. A field you omit keeps its value, and no field can be null.
The name of the access policy.
Explanation for why this policy exists.
500The status of the access policy, draft or published.
draft, published Whether the access policy is enabled.
The Lumos Condition object determining which identities qualify for this policy. Cannot be sent together with is_everyone_condition: true. For more information, see the Lumos Conditions documentation.
Send true to make the access policy apply to everyone, replacing its access_condition. false changes nothing. The everyone condition a read returns in access_condition counts as true.
The apps granted by this access policy. Replaces the current apps wholesale.
1Response
Successful Response
The full representation of an access policy returned by the V1 API.
The name of the access policy.
Explanation for why this policy exists.
500The unique ID of the access policy.
The status of the access policy.
draft, published Whether the access policy is enabled.
The apps and entitlements granted by this access policy.
The Lumos Condition object determining which identities qualify for this policy. For more information, see the Lumos Conditions documentation.
True when the policy applies to everyone in your organization. In that case, access_condition holds the condition Lumos uses to match everyone.
The users and groups that own this access policy. Returned only with expand=owners, owners.users, or owners.groups.