Update Access Policy

curl --request PUT \
  --url https://api.lumos.com/v1/access-policies/{access_policy_id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "apps": [
    {
      "id": "1a2b3c4d-5e6f-7890-abcd-ef1234567890",
      "is_preapproved": true
    }
  ],
  "business_justification": "Everyone at the company uses Slack.",
  "is_enabled": true,
  "is_everyone_condition": true,
  "name": "Company-wide Slack access",
  "status": "published"
}
'

import requests

url = "https://api.lumos.com/v1/access-policies/{access_policy_id}"

payload = {
    "apps": [
        {
            "id": "1a2b3c4d-5e6f-7890-abcd-ef1234567890",
            "is_preapproved": True
        }
    ],
    "business_justification": "Everyone at the company uses Slack.",
    "is_enabled": True,
    "is_everyone_condition": True,
    "name": "Company-wide Slack access",
    "status": "published"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    apps: [{id: '1a2b3c4d-5e6f-7890-abcd-ef1234567890', is_preapproved: true}],
    business_justification: 'Everyone at the company uses Slack.',
    is_enabled: true,
    is_everyone_condition: true,
    name: 'Company-wide Slack access',
    status: 'published'
  })
};

fetch('https://api.lumos.com/v1/access-policies/{access_policy_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.lumos.com/v1/access-policies/{access_policy_id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    'apps' => [
        [
                'id' => '1a2b3c4d-5e6f-7890-abcd-ef1234567890',
                'is_preapproved' => true
        ]
    ],
    'business_justification' => 'Everyone at the company uses Slack.',
    'is_enabled' => true,
    'is_everyone_condition' => true,
    'name' => 'Company-wide Slack access',
    'status' => 'published'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.lumos.com/v1/access-policies/{access_policy_id}"

	payload := strings.NewReader("{\n  \"apps\": [\n    {\n      \"id\": \"1a2b3c4d-5e6f-7890-abcd-ef1234567890\",\n      \"is_preapproved\": true\n    }\n  ],\n  \"business_justification\": \"Everyone at the company uses Slack.\",\n  \"is_enabled\": true,\n  \"is_everyone_condition\": true,\n  \"name\": \"Company-wide Slack access\",\n  \"status\": \"published\"\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://api.lumos.com/v1/access-policies/{access_policy_id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"apps\": [\n    {\n      \"id\": \"1a2b3c4d-5e6f-7890-abcd-ef1234567890\",\n      \"is_preapproved\": true\n    }\n  ],\n  \"business_justification\": \"Everyone at the company uses Slack.\",\n  \"is_enabled\": true,\n  \"is_everyone_condition\": true,\n  \"name\": \"Company-wide Slack access\",\n  \"status\": \"published\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.lumos.com/v1/access-policies/{access_policy_id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"apps\": [\n    {\n      \"id\": \"1a2b3c4d-5e6f-7890-abcd-ef1234567890\",\n      \"is_preapproved\": true\n    }\n  ],\n  \"business_justification\": \"Everyone at the company uses Slack.\",\n  \"is_enabled\": true,\n  \"is_everyone_condition\": true,\n  \"name\": \"Company-wide Slack access\",\n  \"status\": \"published\"\n}"

response = http.request(request)
puts response.read_body

{
  "name": "<string>",
  "business_justification": "<string>",
  "id": "<string>",
  "status": "draft",
  "is_enabled": true,
  "apps": [
    {
      "id": "<string>",
      "label": "<string>",
      "is_preapproved": true,
      "entitlements": [
        {
          "id": "<string>",
          "label": "<string>"
        }
      ]
    }
  ],
  "access_condition": {},
  "is_everyone_condition": true,
  "owners": {
    "users": [
      {
        "id": "<string>",
        "email": "<string>",
        "given_name": "<string>",
        "family_name": "<string>",
        "status": "staged"
      }
    ],
    "groups": [
      {
        "id": "<string>",
        "app_id": "<string>",
        "integration_specific_id": "<string>",
        "name": "<string>",
        "description": "<string>",
        "group_lifecycle": "synced",
        "source_app_id": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

Access Policies

Update Access Policy

Replace an access policy. The apps you send become the policy’s complete set of grants; anything omitted is removed. Listing an app twice, or an entitlement twice under one app, returns 400. An app or entitlement that doesn’t resolve returns 404 without saying which.

An access_condition may use only the attributes and operators the Lumos condition builder offers, with one operator per attribute, and a date-time value needs a time zone offset (2026-01-01T00:00:00Z). Any other condition returns 400 naming each problem.

PUT

access-policies

{access_policy_id}

Update Access Policy

curl --request PUT \
  --url https://api.lumos.com/v1/access-policies/{access_policy_id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "apps": [
    {
      "id": "1a2b3c4d-5e6f-7890-abcd-ef1234567890",
      "is_preapproved": true
    }
  ],
  "business_justification": "Everyone at the company uses Slack.",
  "is_enabled": true,
  "is_everyone_condition": true,
  "name": "Company-wide Slack access",
  "status": "published"
}
'

import requests

url = "https://api.lumos.com/v1/access-policies/{access_policy_id}"

payload = {
    "apps": [
        {
            "id": "1a2b3c4d-5e6f-7890-abcd-ef1234567890",
            "is_preapproved": True
        }
    ],
    "business_justification": "Everyone at the company uses Slack.",
    "is_enabled": True,
    "is_everyone_condition": True,
    "name": "Company-wide Slack access",
    "status": "published"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    apps: [{id: '1a2b3c4d-5e6f-7890-abcd-ef1234567890', is_preapproved: true}],
    business_justification: 'Everyone at the company uses Slack.',
    is_enabled: true,
    is_everyone_condition: true,
    name: 'Company-wide Slack access',
    status: 'published'
  })
};

fetch('https://api.lumos.com/v1/access-policies/{access_policy_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.lumos.com/v1/access-policies/{access_policy_id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    'apps' => [
        [
                'id' => '1a2b3c4d-5e6f-7890-abcd-ef1234567890',
                'is_preapproved' => true
        ]
    ],
    'business_justification' => 'Everyone at the company uses Slack.',
    'is_enabled' => true,
    'is_everyone_condition' => true,
    'name' => 'Company-wide Slack access',
    'status' => 'published'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.lumos.com/v1/access-policies/{access_policy_id}"

	payload := strings.NewReader("{\n  \"apps\": [\n    {\n      \"id\": \"1a2b3c4d-5e6f-7890-abcd-ef1234567890\",\n      \"is_preapproved\": true\n    }\n  ],\n  \"business_justification\": \"Everyone at the company uses Slack.\",\n  \"is_enabled\": true,\n  \"is_everyone_condition\": true,\n  \"name\": \"Company-wide Slack access\",\n  \"status\": \"published\"\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://api.lumos.com/v1/access-policies/{access_policy_id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"apps\": [\n    {\n      \"id\": \"1a2b3c4d-5e6f-7890-abcd-ef1234567890\",\n      \"is_preapproved\": true\n    }\n  ],\n  \"business_justification\": \"Everyone at the company uses Slack.\",\n  \"is_enabled\": true,\n  \"is_everyone_condition\": true,\n  \"name\": \"Company-wide Slack access\",\n  \"status\": \"published\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.lumos.com/v1/access-policies/{access_policy_id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"apps\": [\n    {\n      \"id\": \"1a2b3c4d-5e6f-7890-abcd-ef1234567890\",\n      \"is_preapproved\": true\n    }\n  ],\n  \"business_justification\": \"Everyone at the company uses Slack.\",\n  \"is_enabled\": true,\n  \"is_everyone_condition\": true,\n  \"name\": \"Company-wide Slack access\",\n  \"status\": \"published\"\n}"

response = http.request(request)
puts response.read_body

{
  "name": "<string>",
  "business_justification": "<string>",
  "id": "<string>",
  "status": "draft",
  "is_enabled": true,
  "apps": [
    {
      "id": "<string>",
      "label": "<string>",
      "is_preapproved": true,
      "entitlements": [
        {
          "id": "<string>",
          "label": "<string>"
        }
      ]
    }
  ],
  "access_condition": {},
  "is_everyone_condition": true,
  "owners": {
    "users": [
      {
        "id": "<string>",
        "email": "<string>",
        "given_name": "<string>",
        "family_name": "<string>",
        "status": "staged"
      }
    ],
    "groups": [
      {
        "id": "<string>",
        "app_id": "<string>",
        "integration_specific_id": "<string>",
        "name": "<string>",
        "description": "<string>",
        "group_lifecycle": "synced",
        "source_app_id": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "detail": "<string>",
    "type": "validation",
    "code": "<string>",
    "errors": [
      {
        "field": "<string>",
        "code": "<string>",
        "message": "<string>"
      }
    ]
  }
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

access_policy_id

string

required

The access policy's ID, which GET /v1/access-policies returns as id.

Body

application/json

name

string

required

The name of the access policy.

business_justification

string

required

Explanation for why this policy exists.

Maximum string length: 500

apps

AccessPolicyAppInput · object[]

required

The apps granted by this access policy.

Minimum array length: 1

Show child attributes

status

enum<string> | null

The status of the access policy, draft or published. Defaults to draft.

Available options:

draft,

published

is_enabled

boolean | null

Whether the access policy is enabled. Defaults to false when supported.

access_condition

object | null

The Lumos Condition object determining which identities qualify for this policy. Required unless is_everyone_condition is true. This is a recursive JSON structure that allows you to define complex rules for filtering and matching identities using operators like equals, in, and, or, and not. For more information, see the Lumos Conditions documentation.

is_everyone_condition

boolean

default:false

Whether the access policy applies to everyone. Send true without access_condition, or false (the default) with one; sending both returns 400, unless access_condition is the everyone condition a read returns.

Response

Successful Response

The full representation of an access policy returned by the V1 API.

name

string

required

The name of the access policy.

business_justification

string

required

Explanation for why this policy exists.

Maximum string length: 500

string

required

The unique ID of the access policy.

status

enum<string>

required

The status of the access policy.

Available options:

draft,

published

is_enabled

boolean

required

Whether the access policy is enabled.

apps

AccessPolicyAppOutput · object[]

required

The apps and entitlements granted by this access policy.

Show child attributes

access_condition

object

required

The Lumos Condition object determining which identities qualify for this policy. For more information, see the Lumos Conditions documentation.

is_everyone_condition

boolean

required

read-only

True when the policy applies to everyone in your organization. In that case, access_condition holds the condition Lumos uses to match everyone.

owners

OwnersOutput · object | null

The users and groups that own this access policy. Returned only with expand=owners, owners.users, or owners.groups.

Show child attributes

Quick Start

Lumos API

API Reference

Guides

Migrate from v0

Lumos Connectors

Webhooks

Tools

Update Access Policy

Authorizations

Path Parameters

Body

Response