# Update a workflow access policy

`PATCH /apis/dapr.diagrid.io/v1beta1/projects/{ProjectId}/workflowaccesspolicies/{ProjectSubresourceId}`

Partially update an existing workflow access policy.

## Request

### Path parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `ProjectId` | string | Yes | Unique identifier of the project. |
| `ProjectSubresourceId` | string | Yes | Unique identifier of the project subresource. |

### Request body

The workflow access policy fields to update.

`application/json`

- `apiVersion` (string)
- `kind` (string)
- `metadata` (object)
  - `name` (string)
  - `uid` (string)
  - `resourceVersion` (integer)
  - `createdAt` (string)
  - `updatedAt` (string)
  - `deletedAt` (string)
  - `labels` (object<string, string>)
  - `annotations` (object)
- `spec` (object) — WorkflowAccessPolicySpec mirrors the upstream Dapr WorkflowAccessPolicy CRD spec (as of Dapr 1.18). Rules act as an allow-list: presence of a matching rule grants access; if no rule matches, the call is denied.
  - `rules` (object[])
    - `callers` (object[]) — Required. Min items: 1.
      - `appID` (string) — Required.
    - `workflows` (object[])
      - `name` (string) — Required.
      - `operations` (string[]) — Required. Min items: 1.
    - `activities` (object[])
      - `name` (string) — Required.
- `scopes` (string[])
- `status` (object)
  - `status` (string) — Status is the current processing status of the resource.
  - `updatedAt` (string) — UpdatedAt is the time of the last status update.
  - `messages` (object[]) — Messages contains any status messages, such as error details.
    - `message` (string)
  - `instances` (object[]) — Instances includes the status for each instance of the resource.
    - `cluster` (string) — Cluster is the name of the cluster hosting this instance.
    - `region` (string) — Region is the region where the instance is located (e.g. "us-east-1").
    - `placementId` (string) — PlacementID is the project placement this instance belongs to (e.g. "1").
    - `status` (string) — Status is the current processing status of the resource.
    - `updatedAt` (string) — UpdatedAt is the time of the last status update.
    - `messages` (object[]) — Messages contains any status messages, such as error details.
      - `message` (string)

Example:

```json
{
  "apiVersion": "dapr.io/v1alpha1",
  "kind": "WorkflowAccessPolicy",
  "metadata": {
    "name": "order-workflows"
  },
  "spec": {
    "rules": [
      {
        "callers": [
          {
            "appID": "order-api"
          }
        ],
        "workflows": [
          {
            "name": "order-*",
            "operations": [
              "schedule",
              "get"
            ]
          }
        ]
      }
    ]
  }
}
```

`application/vnd.api+json`

- `data` (object)
  - `apiVersion` (string)
  - `kind` (string)
  - `metadata` (object)
    - `name` (string)
    - `uid` (string)
    - `resourceVersion` (integer)
    - `createdAt` (string)
    - `updatedAt` (string)
    - `deletedAt` (string)
    - `labels` (object<string, string>)
    - `annotations` (object)
  - `spec` (object) — WorkflowAccessPolicySpec mirrors the upstream Dapr WorkflowAccessPolicy CRD spec (as of Dapr 1.18). Rules act as an allow-list: presence of a matching rule grants access; if no rule matches, the call is denied.
    - `rules` (object[])
      - `callers` (object[]) — Required. Min items: 1.
        - `appID` (string) — Required.
      - `workflows` (object[])
        - `name` (string) — Required.
        - `operations` (string[]) — Required. Min items: 1.
      - `activities` (object[])
        - `name` (string) — Required.
  - `scopes` (string[])
  - `status` (object)
    - `status` (string) — Status is the current processing status of the resource.
    - `updatedAt` (string) — UpdatedAt is the time of the last status update.
    - `messages` (object[]) — Messages contains any status messages, such as error details.
      - `message` (string)
    - `instances` (object[]) — Instances includes the status for each instance of the resource.
      - `cluster` (string) — Cluster is the name of the cluster hosting this instance.
      - `region` (string) — Region is the region where the instance is located (e.g. "us-east-1").
      - `placementId` (string) — PlacementID is the project placement this instance belongs to (e.g. "1").
      - `status` (string) — Status is the current processing status of the resource.
      - `updatedAt` (string) — UpdatedAt is the time of the last status update.
      - `messages` (object[]) — Messages contains any status messages, such as error details.
        - `message` (string)

## Responses

### 202 — Accepted for asynchronous processing.

### 403 — You are not authorized to perform this action.

`application/json`

In the case of an error, a standard format error response body will be returned and the HTTP status code will be set to an error status. The response contains an object with a single error object.

- `code` (string) — Required. This is the same as the HTTP status of the response.
- `message` (string) — Required. A short description of the error.
- `status` (object) — Required. A status code that indicates the error type.
- `details` (object) — Additional details about the errors.
  - `@type` (string) — The type of error.
  - `reason` (string) — A reason for the error.
  - `domain` (string) — The domain in which the error occurred.
  - `metadata` (object) — Additional metadata about the error.

`application/vnd.api+json`

JSONAPI.org specification error response wrapper for UI.

- `error` (object) — In the case of an error, a standard format error response body will be returned and the HTTP status code will be set to an error status. The response contains an object with a single error object.
  - `code` (string) — Required. This is the same as the HTTP status of the response.
  - `message` (string) — Required. A short description of the error.
  - `status` (object) — Required. A status code that indicates the error type.
  - `details` (object) — Additional details about the errors.
    - `@type` (string) — The type of error.
    - `reason` (string) — A reason for the error.
    - `domain` (string) — The domain in which the error occurred.
    - `metadata` (object) — Additional metadata about the error.
- `meta` (object<string, object>) — Link members related to the primary data.
  - One of:
    - **string (uri-reference)** — A string containing the link's URL.
    - **object**
      - `href` (string (uri-reference)) — Required. A string containing the link's URL.
      - `meta` (object) — Non-standard meta-information that can not be represented as an attribute or relationship.
- `links` (object) — Non-standard meta-information that can not be represented as an attribute or relationship.

### 404 — The workflow access policy was not found.

`application/json`

In the case of an error, a standard format error response body will be returned and the HTTP status code will be set to an error status. The response contains an object with a single error object.

- `code` (string) — Required. This is the same as the HTTP status of the response.
- `message` (string) — Required. A short description of the error.
- `status` (object) — Required. A status code that indicates the error type.
- `details` (object) — Additional details about the errors.
  - `@type` (string) — The type of error.
  - `reason` (string) — A reason for the error.
  - `domain` (string) — The domain in which the error occurred.
  - `metadata` (object) — Additional metadata about the error.

`application/vnd.api+json`

JSONAPI.org specification error response wrapper for UI.

- `error` (object) — In the case of an error, a standard format error response body will be returned and the HTTP status code will be set to an error status. The response contains an object with a single error object.
  - `code` (string) — Required. This is the same as the HTTP status of the response.
  - `message` (string) — Required. A short description of the error.
  - `status` (object) — Required. A status code that indicates the error type.
  - `details` (object) — Additional details about the errors.
    - `@type` (string) — The type of error.
    - `reason` (string) — A reason for the error.
    - `domain` (string) — The domain in which the error occurred.
    - `metadata` (object) — Additional metadata about the error.
- `meta` (object<string, object>) — Link members related to the primary data.
  - One of:
    - **string (uri-reference)** — A string containing the link's URL.
    - **object**
      - `href` (string (uri-reference)) — Required. A string containing the link's URL.
      - `meta` (object) — Non-standard meta-information that can not be represented as an attribute or relationship.
- `links` (object) — Non-standard meta-information that can not be represented as an attribute or relationship.

### default — Unexpected error.

`application/json`

In the case of an error, a standard format error response body will be returned and the HTTP status code will be set to an error status. The response contains an object with a single error object.

- `code` (string) — Required. This is the same as the HTTP status of the response.
- `message` (string) — Required. A short description of the error.
- `status` (object) — Required. A status code that indicates the error type.
- `details` (object) — Additional details about the errors.
  - `@type` (string) — The type of error.
  - `reason` (string) — A reason for the error.
  - `domain` (string) — The domain in which the error occurred.
  - `metadata` (object) — Additional metadata about the error.

`application/vnd.api+json`

JSONAPI.org specification error response wrapper for UI.

- `error` (object) — In the case of an error, a standard format error response body will be returned and the HTTP status code will be set to an error status. The response contains an object with a single error object.
  - `code` (string) — Required. This is the same as the HTTP status of the response.
  - `message` (string) — Required. A short description of the error.
  - `status` (object) — Required. A status code that indicates the error type.
  - `details` (object) — Additional details about the errors.
    - `@type` (string) — The type of error.
    - `reason` (string) — A reason for the error.
    - `domain` (string) — The domain in which the error occurred.
    - `metadata` (object) — Additional metadata about the error.
- `meta` (object<string, object>) — Link members related to the primary data.
  - One of:
    - **string (uri-reference)** — A string containing the link's URL.
    - **object**
      - `href` (string (uri-reference)) — Required. A string containing the link's URL.
      - `meta` (object) — Non-standard meta-information that can not be represented as an attribute or relationship.
- `links` (object) — Non-standard meta-information that can not be represented as an attribute or relationship.