# Add/Remove operations on Beta Patch Roles/Access Profiles endpoints **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** apis, sailpoint-identity-security\ **Created:** [December 29, 2022, 8:53am UTC](https://developer.sailpoint.com/discuss/t/add-remove-operations-on-beta-patch-roles-access-profiles-endpoints/7304 "2022-12-29T08:53:57Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Prooxie](https://avatars.discourse-cdn.com/v4/letter/p/90ced4/32.png) [@Prooxie](https://developer.sailpoint.com/discuss/u/Prooxie)\ **Post date:** [December 29, 2022, 8:53am UTC](https://developer.sailpoint.com/discuss/t/add-remove-operations-on-beta-patch-roles-access-profiles-endpoints/7304/1 "2022-12-29T08:53:57Z")
Hi all, I’ve been trying to make use of the Beta Patch endpoints for updating Role / Access Profile properties, specifically in order to update the underlying access items (access profiles for roles and entitlements for access profiles) using the add/remove operations. However, even though the calls seem to go through correctly, the result of the operation always reflects a replace, rather than an add. For example - trying to add an access profile to a role that already has 1 other access profile attached to it results in the original access profile being replaced with the new one. Am I missing something here or are these endpoints not working correctly? Thanks in advance. API endpoints in question: > **[patch-access-profile | SailPoint Developer Community](https://developer.sailpoint.com/idn/api/beta/patch-access-profile)** > > Patch a specified Access Profile > **[patch-role | SailPoint Developer Community](https://developer.sailpoint.com/idn/api/beta/patch-role)** > > Patch a specified Role Payload example: ```auto [ { "path": "/entitlements", "value": [ { "type": "ENTITLEMENT", "id": "2c91808478180476017825f6d4423f8b", "name": "Entitlement name" } ], "op": "add" } ] ``` ---
**Author:** ![bostelmann](https://avatars.discourse-cdn.com/v4/letter/b/aca169/32.png) [@bostelmann](https://developer.sailpoint.com/discuss/u/bostelmann)\ **Post date:** [December 30, 2022, 6:28pm UTC](https://developer.sailpoint.com/discuss/t/add-remove-operations-on-beta-patch-roles-access-profiles-endpoints/7304/2 "2022-12-30T18:28:20Z")
Hello @Prooxie, I just got the same results myself using the sample payload defined in the documentation for [Access Profiles](https://developer.sailpoint.com/idn/api/beta/patch-access-profile) specifically to add an entitlement. ```auto [ { "op": "add", "path": "/entitlements", "value": [ { "id": "2c9180857725c14301772a93bb77242d", "type": "ENTITLEMENT", "name": "AD User Group" } ] } ] ``` I suspect this is a defect. ☹ ---
**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\ **Post date:** [January 4, 2023, 1:55pm UTC](https://developer.sailpoint.com/discuss/t/add-remove-operations-on-beta-patch-roles-access-profiles-endpoints/7304/4 "2023-01-04T13:55:08Z")
The PATCH operation can be tricky when trying to modify arrays of data. The RFC docs for the [add operation](https://www.rfc-editor.org/rfc/rfc6902#appendix-A.2) are a little sparse. Based on the payload example you provided, you are correct that the outcome of the operation is essentially a replace. This is because you are adding a brand new array to the `/entitlements` array, which will overwrite the existing array. If your intention is to add an entitlement to the existing array, then try the following payload. ```json [ { "path": "/entitlements/0", "value": { "type": "ENTITLEMENT", "id": "2c91808478180476017825f6d4423f8b", "name": "Entitlement name" }, "op": "add" } ] ``` There are two differences in this payload. 1. I specified where the new entitlement should be inserted into the existing array, in this case at index 0 (i.e. the beginning of the array). Not all collections honor a specific ordering of array elements, so it may not matter where you place it. 2. I changed the `value` from a list of entitlement objects to just a single entitlement object. ---
**Author:** ![Prooxie](https://avatars.discourse-cdn.com/v4/letter/p/90ced4/32.png) [@Prooxie](https://developer.sailpoint.com/discuss/u/Prooxie)\ **Post date:** [January 16, 2023, 5:55pm UTC](https://developer.sailpoint.com/discuss/t/add-remove-operations-on-beta-patch-roles-access-profiles-endpoints/7304/5 "2023-01-16T17:55:26Z")
Hi @colin_mckibben , thank you very much for your detailed reply. Indeed, you were right and I have since successfully managed to make the add work correctly based on your recommendation. That being said, I am now struggling with the other side of the same coin - removal of an access profile / entitlement. More specifically, I haven’t found a reliable solution for identifying the position of a specific access profile or entitlement within the nested array. I am retrieving a single object (in this example a role) using the Beta GET endpoint ([get-role | SailPoint Developer Community](https://developer.sailpoint.com/idn/api/beta/get-role)) and looking at the array stored within the accessProfiles property. However, it seems that the order of this array is completely arbitrary, as adding/removing an access profile completely re-shuffles the array. Furthermore, even if I do try and follow that order and use the position within the array as the path for the PATCH call ([patch-role | SailPoint Developer Community](https://developer.sailpoint.com/idn/api/beta/patch-role)), I somehow end up removing a different access profile than expected. Example payload (should be following the spec): ```auto [ { "path": "/accessProfiles/3", "op": "remove" } ] ``` This ends up removing a different access profile than the one returned on the 4th position of the nested array retrieved by the GET request. ---
**Author:** ![LukeHagar](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/lukehagar/32/1605_2.png) [@LukeHagar](https://developer.sailpoint.com/discuss/u/LukeHagar)\ **Post date:** [January 17, 2023, 3:24pm UTC](https://developer.sailpoint.com/discuss/t/add-remove-operations-on-beta-patch-roles-access-profiles-endpoints/7304/6 "2023-01-17T15:24:28Z")
Hey @Prooxie, This is definitely an issue, and would impact any patch calls being used to update the entities. I was able to replicate this issue on both role, and access profile api calls in my tenant. I am having the defects looked into internally, and I will update this comment when I have more information. Thank you so much for posting! ---
**Author:** ![Kurt\_Ramsey](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kurt_ramsey/32/517_2.png) [@Kurt\_Ramsey](https://developer.sailpoint.com/discuss/u/Kurt_Ramsey)\ **Post date:** [April 11, 2023, 7:59pm UTC](https://developer.sailpoint.com/discuss/t/add-remove-operations-on-beta-patch-roles-access-profiles-endpoints/7304/7 "2023-04-11T19:59:17Z")
Is this still true? I am attempting to use /v3/roles to remove specific Access Profiles from a large number of Roles. Every operation I have attempted so far either removes all Access Profiles or gets a 400 response in return. Is the removal of a single access profile from a Role not currently supported? ---
**Author:** ![LukeHagar](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/lukehagar/32/1605_2.png) [@LukeHagar](https://developer.sailpoint.com/discuss/u/LukeHagar)\ **Post date:** [April 12, 2023, 1:03pm UTC](https://developer.sailpoint.com/discuss/t/add-remove-operations-on-beta-patch-roles-access-profiles-endpoints/7304/8 "2023-04-12T13:03:51Z")
Hey @Prooxie, @Kurt_Ramsey, I wanted to follow up here and just let you know that internal case is still ongoing, I do not have any substantial updates yet that I can share regarding the status of the case, but it is still open. I hope you are all having a good week. ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [July 19, 2023, 2:24pm UTC](https://developer.sailpoint.com/discuss/t/add-remove-operations-on-beta-patch-roles-access-profiles-endpoints/7304/9 "2023-07-19T14:24:02Z")