---
title: "Upsert an application's resources and permissions"
method: PUT
path: "/api/v1/applications/{application_id}/structure"
tags: ["applications"]
---

# Upsert an application's resources and permissions

`PUT /api/v1/applications/{application_id}/structure`

Replaces the application's access structure by upserting its resources and their permissions in a single call.

## Path parameters

- `application_id` string, required

## Headers

- `Idempotency-Key` string

## Request body

- UpdateStructure — Upsert resources and permissions for an application. This is a partial upsert, not a full overwrite: omitted items are left untouched. To remove an item, send it with its `id` and `delete: true` (this applies to both resources and their nested permissions).
  - `lock_version` integer — Optimistic lock version. Optional; if stale, returns 409.
  - `resources` ResourceInput[] — Resources to upsert.
    - `delete` boolean — Set to true to soft-delete this resource. Requires `id`.
    - `description` string, nullable
    - `id` string, uuid — Resource ID. Omit to let the server generate one. Provide a client-generated UUID to forward-reference this resource as a `parent_resource_id` of another item in the same payload.
    - `order` integer, nullable
    - `parent_resource_id` string, uuid, nullable — Optional parent resource ID for nested groups.
    - `permissions` PermissionInput[] — Permissions nested under this resource.
      - `delete` boolean — Set to true to soft-delete this permission. Requires `id`.
      - `description` string, nullable
      - `elevated` boolean
      - `id` string, uuid — Permission ID. Omit (or supply a fresh UUID) to create.
      - `requestable` boolean
      - `title` string, required
    - `requestable` boolean
    - `title` string, required

## Response `200`

Application

- Application — An application in the organization
  - `admin_user_ids` string[] — User IDs of the application's admins
  - `auth_method` 'google' | 'microsoft' | 'okta' | 'sso_provider' | 'credentials' | 'other', nullable — Authentication method used to sign in
  - `data_location` string, nullable — Where the vendor stores data
  - `description` string, nullable — Description
  - `id` string, uuid, required — Application ID
  - `inserted_at` string, date-time — Creation timestamp
  - `last_vendor_review_at` string, date, nullable — Date of the last vendor security review
  - `mfa_activated` boolean, nullable — Whether MFA is activated for this application
  - `notes` string, nullable — Internal notes
  - `owner_user_id` string, uuid, nullable — Owner user ID
  - `permanent_access_allowed` boolean — Whether the application allows permanent (non-expiring) access
  - `processed_data_types` string[] — Types of data this application processes
  - `provisioning_type` 'application_admin' | 'automatic' — Provisioning type
  - `risk_level` 'low' | 'medium' | 'high', nullable — Risk level assessment
  - `status` 'ignored' | 'discovered' | 'approved' | 'requestable', required — Application status
  - `tags` object[] — Tags assigned to this application
    - `id` string, uuid
    - `title` string
  - `time_based_access_durations` string[] — Configured time-based access durations as ISO 8601 durations (e.g. "PT1H", "P7D"); empty when the app offers only permanent access
  - `title` string, required — Application title
  - `updated_at` string, date-time — Last update timestamp
  - `url` string, nullable — Application URL
  - `user_count` integer, nullable — Number of users with access
  - `user_setup_url` string, nullable — URL where existing users are shown and new users are invited
  - `vendor_certificates` string[] — Security/compliance certifications held by the vendor

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not found
- `409` — Stale entry
- `422` — Validation error

---

[API](https://skmtc.net/accessowl/apis/accessowl-api.md) · [All operations](https://skmtc.net/accessowl/apis/accessowl-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/accessowl/accessowl-api/versions/f01f507d4b4e/schema)