1. Docs
  2. API Reference
  3. Replace an Environment's configuration from a JSON payload (destructive)

Replace an Environment's configuration from a JSON payload (destructive)

POST/portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/import

Replaces the target Environment's configuration (resolved by :envSlug) with the supplied export document. This is destructive: existing roles, permissions, nodes, OAuth clients, webhook subscriptions, and pending invites in the target are wiped before the payload is applied within a single transaction; identities, memberships, and assignments survive except where cascading role/node deletes remove dangling rows. The payload must declare a supported format_version (400 otherwise) and contain exactly one root node, with duplicate keys, cyclic parents, orphaned nodes, and unknown permission references each rejected as 400. Every imported role lands as a custom role whatever the payload's is_system_role says, as a permission lands as custom unless its key is reserved. Returns 200 with one-time OAuth client and webhook signing-secret rotation receipts and emits an environment.imported audit event; 404 when the slug does not exist.

Authentication

Bearer TokenAuthorization

JWT access token. Never send alongside X-API-Key: a request carrying both is refused.

Requires capability applications.manageDeveloper Console

Create, edit, and delete Applications and Environments. Granted through an administrator role in the Admin Workspace; a valid token without it is refused with 403.

Path Parameters

accountSlugstring Required

The Account's slug. An unknown one answers 404.

appSlugstring Required

The Application's slug within the Account.

envSlugstring Required

Request body

application/json

format_versionnumber Required
source_envobject Required
access_modelenum Required

one of "flat" · "hierarchy"

organizations_enabledboolean Required
hierarchy_schemaobject Required
permissionsany[] Required
rolesany[] Required
nodesany[] Required
oauth_clientsany[] Required
webhooksany[] Required
metadataobject Optional

Responses

application/json

  • dataEnvironmentCloneResponseDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

Errors

When the request can't be completed, the response body includes a stable error code you can branch on, and a correlation_id (also sent as the X-Correlation-Id header). Quote the correlation id when you contact support: it identifies the exact request in Canopy's logs.

403account.capability_requiredForbidden
When it happens

The signed-in user's administrator roles do not grant the capability this endpoint requires.

Remediation

Ask an account administrator to grant a role carrying the capability named in the Authentication section, then retry.

Returned object

EnvironmentCloneResponseDtoView all properties on this resource
Request
curl -X POST "https://auth.canopy-io.com/portal/v1/accounts/value/applications/value/environments/value/import" \
  -H "Authorization: Bearer $CANOPY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "format_version": 1,
    "source_env": {},
    "access_model": "flat",
    "organizations_enabled": false,
    "hierarchy_schema": {},
    "permissions": [
      null
    ],
    "roles": [
      null
    ],
    "nodes": [
      null
    ],
    "oauth_clients": [
      null
    ],
    "webhooks": [
      null
    ],
    "metadata": {}
  }'
Response
{
  "data": {
    "environment": {
      "id": "string",
      "application_id": "string",
      "name": "string",
      "slug": "string",
      "is_production": false,
      "settings": {},
      "version": 0,
      "created_at": "2026-04-20T12:00:00.000Z",
      "updated_at": "2026-04-20T12:00:00.000Z"
    },
    "oauth_client_rotations": [
      {
        "source_client_id": "string",
        "client_id": "string",
        "client_secret": "string"
      }
    ],
    "webhook_subscription_rotations": [
      {
        "id": "string",
        "url": "string",
        "secret": "string"
      }
    ]
  }
}
 Related endpoints
GETList Environments in an Application
POSTCreate a new Environment in an Application
GETGet a single Environment by slug
PATCHRename or re-slug an Environment
DELETEDelete an Environment
GETGet an Environment's sign-in settings
PATCHChange an Environment's sign-in settings
GETGet an Environment's branding
PATCHChange an Environment's branding
GETExport an Environment's configuration as JSON
GETGet the Environment's access model
PUTSwitch the Environment's access model
PUTSwitch the Environment's organizations container on or off
GETGet hierarchy schema for the active Environment
PATCHUpdate hierarchy schema for the active Environment
GETList hierarchy node types with existing nodes
POSTRevert this Environment from hierarchy to flat
 Was this page helpful?

Tell us how we can improve this guide.

Canopy