---
title: "POST /v1/{+parent}/accessLevels:replaceAll"
method: POST
path: "/v1/{+parent}/accessLevels:replaceAll"
tags: ["accessPolicies"]
---

# POST /v1/{+parent}/accessLevels:replaceAll

`POST /v1/{+parent}/accessLevels:replaceAll`

Replaces all existing access levels in an access policy with the access levels provided. This is done atomically. The long-running operation from this RPC has a successful status after all replacements propagate to long-lasting storage. If the replacement contains errors, an error response is returned for the first error encountered. Upon error, the replacement is cancelled, and existing access levels are not affected. The Operation.response field contains ReplaceAccessLevelsResponse. Removing access levels contained in existing service perimeters result in an error.

## Path parameters

- `parent` string, required

## Request body

- ReplaceAccessLevelsRequest — A request to replace all existing Access Levels in an Access Policy with the Access Levels provided. This is done atomically.
  - `accessLevels` AccessLevel[] — Required. The desired Access Levels that should replace all existing Access Levels in the Access Policy.
    - `name` string — Identifier. Resource name for the `AccessLevel`. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The `access_level` component must begin with a letter, followed by alphanumeric characters or `_`. Its maximum length is 50 characters. After you create an `AccessLevel`, you cannot change its `name`.
    - `title` string — Human readable title. Must be unique within the Policy.
    - `custom` CustomLevel — `CustomLevel` is an `AccessLevel` using the Cloud Common Expression Language to represent the necessary conditions for the level to apply to a request. See CEL spec at: https://github.com/google/cel-spec
      - `expr` Expr — Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
        - `expression` string — Textual representation of an expression in Common Expression Language syntax.
        - `description` string — Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
        - `location` string — Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
        - `title` string — Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
    - `basic` BasicLevel — `BasicLevel` is an `AccessLevel` using a set of recommended features.
      - `combiningFunction` 'AND' | 'OR' — How the `conditions` list should be combined to determine if a request is granted this `AccessLevel`. If AND is used, each `Condition` in `conditions` must be satisfied for the `AccessLevel` to be applied. If OR is used, at least one `Condition` in `conditions` must be satisfied for the `AccessLevel` to be applied. Default behavior is AND.
      - `conditions` Condition[] — Required. A list of requirements for the `AccessLevel` to be granted.
        - `devicePolicy` DevicePolicy — `DevicePolicy` specifies device specific restrictions necessary to acquire a given access level. A `DevicePolicy` specifies requirements for requests from devices to be granted access levels, it does not do any enforcement on the device. `DevicePolicy` acts as an AND over all specified fields, and each repeated field is an OR over its elements. Any unset fields are ignored. For example, if the proto is { os_type : DESKTOP_WINDOWS, os_type : DESKTOP_LINUX, encryption_status: ENCRYPTED}, then the DevicePolicy will be true for requests originating from encrypted Linux desktops and encrypted Windows desktops.
          - `osConstraints` OsConstraint[] — Allowed OS versions, an empty list allows all types and all versions.
            - `minimumVersion` string — The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: `"major.minor.patch"`. Examples: `"10.5.301"`, `"9.2.1"`.
            - `osType` 'OS_UNSPECIFIED' | 'DESKTOP_MAC' | 'DESKTOP_WINDOWS' | 'DESKTOP_LINUX' | 'DESKTOP_CHROME_OS' | 'ANDROID' | 'IOS' — Required. The allowed OS type.
            - `requireVerifiedChromeOs` boolean — Only allows requests from devices with a verified Chrome OS. Verifications includes requirements that the device is enterprise-managed, conformant to domain policies, and the caller has permission to call the API targeted by the request.
          - `allowedEncryptionStatuses` string[] — Allowed encryptions statuses, an empty list allows all statuses.
          - `requireAdminApproval` boolean — Whether the device needs to be approved by the customer admin.
          - `allowedDeviceManagementLevels` string[] — Allowed device management levels, an empty list allows all management levels.
          - `requireScreenlock` boolean — Whether or not screenlock is required for the DevicePolicy to be true. Defaults to `false`.
          - `requireCorpOwned` boolean — Whether the device needs to be corp owned.
        - `requiredAccessLevels` string[] — A list of other access levels defined in the same `Policy`, referenced by resource name. Referencing an `AccessLevel` which does not exist is an error. All access levels listed must be granted for the Condition to be true. Example: "`accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME"`
        - `ipSubnetworks` string[] — CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
        - `negate` boolean — Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields. Any non-empty field criteria evaluating to false will result in the Condition to be satisfied. Defaults to false.
        - `regions` string[] — The request must originate from one of the provided countries/regions. Must be valid ISO 3166-1 alpha-2 codes.
        - `members` string[] — The request must be made by one of the provided user or service accounts. Groups are not supported. Syntax: `user:{emailid}` `serviceAccount:{emailid}` If not specified, a request may come from any user.
        - `vpcNetworkSources` VpcNetworkSource[] — The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with `ip_subnetworks`.
          - `vpcSubnetwork` VpcSubNetwork — Sub-segment ranges inside of a VPC Network.
            - `vpcIpSubnetworks` string[] — CIDR block IP subnetwork specification. The IP address must be an IPv4 address and can be a public or private IP address. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. If empty, all IP addresses are allowed.
            - `network` string — Required. Network name. If the network is not part of the organization, the `compute.network.get` permission must be granted to the caller. Format: `//compute.googleapis.com/projects/{PROJECT_ID}/global/networks/{NETWORK_NAME}` Example: `//compute.googleapis.com/projects/my-project/global/networks/network-1`
    - `description` string — Description of the `AccessLevel` and its use. Does not affect behavior.
  - `etag` string — Optional. The etag for the version of the Access Policy that this replace operation is to be performed on. If, at the time of replace, the etag for the Access Policy stored in Access Context Manager is different from the specified etag, then the replace operation will not be performed and the call will fail. This field is not required. If etag is not provided, the operation will be performed as if a valid etag is provided.

## Response `200`

Successful response

---

[API](https://skmtc.dev/google/apis/accesscontextmanager.md) · [All operations](https://skmtc.dev/google/apis/accesscontextmanager/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/google/accesscontextmanager/revisions/af581187d9ba/schema)