# Patch access profile "requestable" field

**URL:** <https://developer.sailpoint.com/discuss/t/patch-access-profile-requestable-field/1697>\
**Category:** SHF Discussion and Questions\
**Created:** [October 1, 2021, 8:38am UTC](https://developer.sailpoint.com/discuss/t/patch-access-profile-requestable-field/1697 "2021-10-01T08:38:14Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![M\_rtenH](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/m_rtenh/32/429_2.png) [@M\_rtenH](https://developer.sailpoint.com/discuss/u/M_rtenH)\
**Post date:** [October 1, 2021, 8:38am UTC](https://developer.sailpoint.com/discuss/t/patch-access-profile-requestable-field/1697/1 "2021-10-01T08:38:14Z")

</div>

Hi all,

I’m having trouble using the endpoint listed here: [patch-access-profile | SailPoint Developer Community](https://developer.sailpoint.com/idn/api/beta/patch-access-profile)

I’m attempting to patch the “requestable” field to value false in order to remove a specific access profile from the list of access a user can request. The access profile is only used in a role and provisioned automatically. I can’t remove it from the application itself because our custom connector for the source creates access profiles automatically for each entitlement with a 1to1 relationship.

Here’s the payload:

```auto
[
    {
        "op": "replace",
        "path": "/requestable",
        "value": false
    }
]

```

Here’s the first 5 lines of the response(status: 200 OK):

```auto
{
    "description": "Roles used by all -redacted- employees",
    "enabled": false,
    "requestable": false,
    "owner":

```

However, once I perform a GET api call for the same access profile, the response shows `"requestable": true`

Going through the GUI search, I can see the UPDATE event for the access profile from my user creds but the details show that nothing was actually updated.

Am I doing something wrong here or is this a bug? Looks like the PATCH call just returns the response but isn’t actually applied.

---

<div class="post-metadata">

**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\
**Post date:** [October 1, 2021, 4:04pm UTC](https://developer.sailpoint.com/discuss/t/patch-access-profile-requestable-field/1697/2 "2021-10-01T16:04:13Z")

</div>

Hi @M_rtenH,

I spoke with our product team, and they informed me that access profiles are always requestable, and therefore can’t be PATCHed via the API. The API should not have returned a 200 in this case, and the spec should clearly state that `requestable` can’t be modified. We are working to resolve this on our end.

I apologize for the confusion.

---

<div class="post-metadata">

**Author:** ![masd](https://avatars.discourse-cdn.com/v4/letter/m/f05b48/32.png) [@masd](https://developer.sailpoint.com/discuss/u/masd)\
**Post date:** [April 11, 2022, 7:24pm UTC](https://developer.sailpoint.com/discuss/t/patch-access-profile-requestable-field/1697/3 "2022-04-11T19:24:20Z")

</div>

@colin_mckibben - is this changing with the release of the new Request Center?  
The initial documentation that I received stated to use the beta Access Profile API to make it requestable (true/false). and i am running into the same issues as above. Change it to FALSE, yet it returns a 200, and go verify, and it is still TRUE.

---

<div class="post-metadata">

**Author:** ![RTASB](https://avatars.discourse-cdn.com/v4/letter/r/aca169/32.png) [@RTASB](https://developer.sailpoint.com/discuss/u/RTASB)\
**Post date:** [April 13, 2022, 3:29am UTC](https://developer.sailpoint.com/discuss/t/patch-access-profile-requestable-field/1697/4 "2022-04-13T03:29:28Z")

</div>

@colin_mckibben the API doco page still lists requestable as a patchable field:

 ![image](https://global.discourse-cdn.com/sailpoint/original/1X/24b1efd070096e615ff3e6a2c8f91d83a8dc2342.png)  
Can we please have this corrected as it is likely to catch people out as it has been above.

---

<div class="post-metadata">

**Author:** ![M\_rtenH](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/m_rtenh/32/429_2.png) [@M\_rtenH](https://developer.sailpoint.com/discuss/u/M_rtenH)\
**Post date:** [April 26, 2022, 9:06am UTC](https://developer.sailpoint.com/discuss/t/patch-access-profile-requestable-field/1697/5 "2022-04-26T09:06:11Z")

</div>

So weirdly enough I’ve now come across access profiles where requestable=false. I’ve spoken to my colleagues who’ve set these sources/access profiles up (via UI) and they’ve no idea how they ended up in this state  
 ![image](https://global.discourse-cdn.com/sailpoint/original/1X/ca927671b2e8ffd1f1ffef7c41853aa669a8b5f5.png)

---

<div class="post-metadata">

**Author:** ![M\_rtenH](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/m_rtenh/32/429_2.png) [@M\_rtenH](https://developer.sailpoint.com/discuss/u/M_rtenH)\
**Post date:** [April 26, 2022, 9:22am UTC](https://developer.sailpoint.com/discuss/t/patch-access-profile-requestable-field/1697/6 "2022-04-26T09:22:43Z")

</div>

Ok, figured out why the above was happening. They’d set up the approver as the same person as the access profile AND source owner so due to IDN not having any fallback options the access profiles couldn’t be requested.

---

<div class="post-metadata">

**Author:** ![RTASB](https://avatars.discourse-cdn.com/v4/letter/r/aca169/32.png) [@RTASB](https://developer.sailpoint.com/discuss/u/RTASB)\
**Post date:** [May 25, 2022, 2:44am UTC](https://developer.sailpoint.com/discuss/t/patch-access-profile-requestable-field/1697/7 "2022-05-25T02:44:49Z")

</div>

So you’re saying there’s a way to make these non request-able 😃

---

<div class="post-metadata">

**Author:** ![M\_rtenH](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/m_rtenh/32/429_2.png) [@M\_rtenH](https://developer.sailpoint.com/discuss/u/M_rtenH)\
**Post date:** [May 25, 2022, 7:30am UTC](https://developer.sailpoint.com/discuss/t/patch-access-profile-requestable-field/1697/8 "2022-05-25T07:30:14Z")

</div>

Hah! I guess that’s one way to look at it. Sadly it still stays visible for the end-user.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [July 19, 2023, 2:22pm UTC](https://developer.sailpoint.com/discuss/t/patch-access-profile-requestable-field/1697/9 "2023-07-19T14:22:07Z")

</div>


