Access Service | Equinix Product Documentation

Update Access Policy

Request

Allows a user to update the definition of an access policy identified by the accessPolicyId. The access policy is updated in the project identified by the projectId. It is possible that some of the objects referenced by the updated access policy no longer exist or are no longer accessible. Such cases will produce an error unless the allowBadRefs parameter is set to "existing". Setting this parameter allows users to update access policies even if something unrelated to their update has changed since the access policy was created. Using this flag allows urgent access policy changes to be made without requiring the caller to address issues outside of their immediate concrent. Access to this operation is controlled by the access policy being accessed.

The auth token's access policy must allow action:use/updateAccessPolicy.

Security

bearerAuth

Path

projectIdProjectId (string) or * (string)required

One of:

Globally unique identifier of a project.

string(ProjectId)

accessPolicyIdAccessPolicyId (string) or Ern (string)required

One of:

Uniquely identifies an access policy within a project.

string(AccessPolicyId)

Bodyapplication/jsonrequired

tagsobject, <= 10 properties(Tags)required

Additional user-controlled data about this resource.

descriptionstring^.{0,500}$

Example:"A description string."

permissionsArray of any, unique(UserRectSet)required

A set of permissions, each of which may be an inline permission, a permission set reference, or a foreign access policy reference.

intersectArray of any, unique(UserRectSet)

Entries must appear in both the intersect field and the permissions to be in the results from this permission object.

subtractArray of objects, unique(InlinePermission)

Entries in the subtract field are not included in the results from this permission object.

allowBadRefsstring

Indicates that the access policy should be updated even if it includes invalid references to permission objects. Setting to "existing" will allow existing invalid references to remain, but will complain if new invalid references are introduced. Setting to "additional" will allow both existing and new invalid references to be accepted without complaint.

Enum:"existing""additional"

Example:"additional"

lastRevstring, [ 1 .. 256 ] characters(LastResourceRev)required

An opaque string that represents the expected revision of a given resource. This is provided when a resource is updated so that if a concurrent update has occurred since the resource was read, then the collision will be detected.

Example:"abc123"

Payload

{
  "tags": {
    "property1": "my tag value",
    "property2": "my tag value"
  },
  "description": "A description string.",
  "permissions": [
    { … }
  ],
  "intersect": [
    { … }
  ],
  "subtract": [
    { … }
  ],
  "allowBadRefs": "additional",
  "lastRev": "abc123"
}

Responses

Success

Bodyapplication/json

descriptionstring^.{0,500}$

Example:"A description string."

tagsobject, <= 10 properties(Tags)required

Additional user-controlled data about this resource.

updatedAtstring(UpdatedAt)^.*$

A string timestamp indicating when the resource was last updated. Formatted like: "2025-02-12T17:24:19.033772087Z"

Example:"2024-01-15T12:00:00Z"

permissionsArray of any, unique(UserRectSet)required

A set of permissions, each of which may be an inline permission, a permission set reference, or a foreign access policy reference.

createdBystring(CreatedBy)^.*$

A string indicating the principal who invoked an operation to create the resource.

Example:"principal:ABCD-EFG-12345:idp:example-user"

createdAtstring(CreatedAt)^.*$

A string timestamp indicating when the resource was created. Formatted like: "2025-02-12T17:24:19.033772087Z"

Example:"2024-01-15T12:00:00Z"

revstring(ResourceRev)^.*$required

An opaque string that represents the revision of a given resource. Each time the resource is updated, this value changes.

Example:"abc123"

approvedAtstring(UpdatedAt)^.*$

A string timestamp indicating when the resource was last updated. Formatted like: "2025-02-12T17:24:19.033772087Z"

Example:"2024-01-15T12:00:00Z"

ernstring(Ern)^ern:(?<cloud>[^:]{1,50}):(?<service>[^:/]{1,...required

Equinix resource name, a universally unique identifier for a resource across all clouds, regions, and services. Formatted as "ern:<cloudId>:<serviceId>:<regionId>:<projectId>:<resourceType>:<resourceId>".

Example:"ern:eqix:equinix/sts:global:abc-123:SomeType:res-id"

disabledPolicyany

Value:true

Example:true

updatedBystring(UpdatedBy)^.*$

A string indicating the principal who last invoked an operation to update the resource.

Example:"principal:ABCD-EFG-12345:idp:example-user"

managedany

Value:true

Example:true

intersectArray of any, unique(UserRectSet)

Entries must appear in both the intersect field and the permissions to be in the results from this permission object.

subtractArray of objects, unique(InlinePermission)

Entries in the subtract field are not included in the results from this permission object.

accessPolicyIdAccessPolicyId (string) or ManagedPolicyId (string)required

One of:

Uniquely identifies an access policy within a project.

string(AccessPolicyId)

approvedBystring(ApprovedBy)^.*$

A string indicating the principal who invoked an operation to approve the resource.

Example:"principal:ABCD-EFG-12345:idp:example-user"

Response

{
  "description": "A description string.",
  "tags": {
    "property1": "my tag value",
    "property2": "my tag value"
  },
  "updatedAt": "2024-01-15T12:00:00Z",
  "permissions": [
    { … }
  ],
  "createdBy": "principal:ABCD-EFG-12345:idp:example-user",
  "createdAt": "2024-01-15T12:00:00Z",
  "rev": "abc123",
  "approvedAt": "2024-01-15T12:00:00Z",
  "ern": "ern:eqix:equinix/sts:global:abc-123:SomeType:res-id",
  "disabledPolicy": true,
  "updatedBy": "principal:ABCD-EFG-12345:idp:example-user",
  "managed": true,
  "intersect": [
    { … }
  ],
  "subtract": [
    { … }
  ],
  "accessPolicyId": "accesspolicy:my-policy",
  "approvedBy": "principal:ABCD-EFG-12345:idp:example-user"
}