Use this endpoint with Export data security setup to copy session properties, policies and assigned values from one project to another, such as from QA to production.

Basic Usage

Send the exported file as snapshot. By default the request is a dry run and only returns what would change.

Request

{
  "mode": "merge",
  "snapshot": {
    "sessionProperties": [
      { "name": "region", "type": "STRING", "description": "Sales region" }
    ],
    "policies": [
      {
        "name": "emea_accounts_only",
        "type": "RLS",
        "models": ["orders", "accounts"],
        "condition": "@region = 'EMEA'",
        "sessionProperties": [{ "name": "region", "isRequired": true }]
      }
    ],
    "memberValues": [
      { "email": "[email protected]", "properties": { "region": "EMEA" } }
    ]
  }
}

Response

{
  "dryRun": true,
  "mode": "merge",
  "noop": false,
  "plan": {
    "sessionProperties": { "create": ["region"], "update": [], "delete": [] },
    "policies": { "create": ["emea_accounts_only"], "update": [], "delete": [] },
    "memberValues": { "update": ["[email protected]"], "skipped": [] },
    "groupValues": { "update": [], "skipped": [] },
    "warnings": [],
    "summary": {
      "sessionProperties": { "create": 1, "update": 0, "delete": 0 },
      "policies": { "create": 1, "update": 0, "delete": 0 },
      "memberValues": { "update": 1, "skipped": 0 },
      "groupValues": { "update": 0, "skipped": 0 }
    }
  }
}

When the plan looks right, send the same request with "dryRun": false to apply it.

Each policy in the file must be complete, as on create: models and condition for RLS, columns for CLS. An incomplete policy returns 400 INVALID_POLICY.

Merge and Overwrite

mode decides what happens to items that are in the project but not in the file.

• merge: keeps them. The import only creates and updates.
• overwrite: deletes session properties and policies that are not in the file

In both modes, assigned values are only added or changed. Values for members and groups that are not in the file stay as they are.

Member and group values are compared after trimming surrounding spaces, and a blank value counts as no value. " EMEA " in the file matches a stored "EMEA" and is not reported as a change.

Members Who Are Not in the Project

Members and groups often differ between projects. By default, an email or group that is not in the target project fails the import. Set "skipUnknownMembers": true to skip them instead. They are listed under skipped in the plan.

Renames and Type Changes

Items are matched by name, so renaming an item in the file creates a new one. In overwrite mode the old one is also deleted.

Session property names are case-insensitive. If the file has region and the project has Region, the import returns 409 DUPLICATED_SESSION_PROPERTY_NAME. Use the project's spelling in the file.

A session property cannot change its type through an import. Delete it first. A policy can change its type only in overwrite mode.