---
title: "Upsert one FAP resource block"
method: PUT
path: "/api/data-access/policy/{resource}"
tags: ["DataAccess"]
---

# Upsert one FAP resource block

`PUT /api/data-access/policy/{resource}`

## Request

- Base URL: `https://api.agentstack.tech` (the document declares no server; this is the origin it was published from)
- URL: `https://api.agentstack.tech/api/data-access/policy/{resource}`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Writes `resources.{resource}` and optional `globals` / `default_access`.

**Auth:** project **admin** (RBAC) **or** project **owner**.

Invalidates NeuralCache tag `project:{id}`. See FIELD_ACCESS_POLICY.md.

## Path parameters

- `resource` string, required: Resource key (e.g., 'orders', 'products')

## Query parameters

- `project_id` integer, required: Project ID

## Headers

- `Idempotency-Key` string

## Request body

- ResourcePolicyBody: Body for PUT /policy/{resource}
  - `resource_policy` object, required: Dict of field → descriptor. Shorthand: 'admin', OR: 'owner|admin', extended: {'read': 'user', 'write': 'admin', 'condition': '...'}. Special key '__default__' sets catch-all for this resource.
  - `default_access` string, nullable: Global fallback when no rule matches ('deny' or 'public'). Applies to the whole project policy.
  - `globals` object, nullable: If set, replaces project FAP globals: nested_path_mode (flat|dotted), max_mask_depth, default_access. Omit to leave unchanged.

## Response `200`

Merged full project policy after save

- unknown

## Other responses

- `400`: Bad Request
- `401`: Not authenticated
- `403`: Insufficient project access (read / admin / owner)
- `404`: Not Found
- `409`: Conflict
- `422`: Validation Error
- `429`: Too Many Requests
- `500`: Internal Server Error

---

[API](https://skmtc.dev/agentstack/apis/agentstack-core-api.md) · [All operations](https://skmtc.dev/agentstack/apis/agentstack-core-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agentstack/apis/agentstack-core-api/revisions/8ecf3406e74a?raw)