DataAccess

Upsert one FAP resource block

Writes resources.{resource} and optional globals / default_access.

Auth: project admin (RBAC) or project owner.

Invalidates NeuralCache tag project:{id}. See FIELD_ACCESS_POLICY.md.

put/api/data-access/policy/{resource}

Request

  • Base URL: https://api.agentstack.tech (the document declares no server; this is the origin it was published from)
  • URL: https://api.agentstack.tech/api/data-access/policy/{resource}
  • Auth: one of:
    • API key in header X-API-Key
    • HTTP bearer

Path parameters

resourcestring required

Resource key (e.g., 'orders', 'products')

Query parameters

project_idinteger required

Project ID

Headers

Idempotency-Keystring

Client-generated key to make mutating requests idempotent.

Request body

resource_policyobject required

Dict of field → descriptor. Shorthand: 'admin', OR: 'owner|admin', extended: {'read': 'user', 'write': 'admin', 'condition': '...'}. Special key 'default' sets catch-all for this resource.

default_accessstring nullable

Global fallback when no rule matches ('deny' or 'public'). Applies to the whole project policy.

globalsobject nullable

If set, replaces project FAP globals: nested_path_mode (flat|dotted), max_mask_depth, default_access. Omit to leave unchanged.

Example request

{
  "resource_policy": {
    "__default__": "deny",
    "cost_price": "admin",
    "id": "public",
    "name": "public",
    "price": "user"
  }
}

Response

Merged full project policy after save

unknown required

Changes

No recorded changes to this operation across all 1 revision of this API.