Skip to main content
POST
Create Access Request

Authentication and permissions

Token requirements: User-based token (OAuth) or Organization-scoped API key or Workspace-scoped API key. Send a bearer access token for one of these identities. The permissions and resource restrictions below also apply.
Permissions joined by + are all required; or separates alternatives. Full-access keys still cannot call endpoints marked unsupported. Workspace keys must allow every workspace checked by the request. OAuth access depends on the user’s roles and resource access. API-key callers must supply target_user_id; otherwise the target defaults to a key ID instead of a user. The role must be requestable and satisfy the access policy.
  • Attach to an existing ticket: With ticket_id, the ticket must belong to the requested workspace and be visible to you.
  • Attach to your own ticket: With ticket_id, you must be the ticket’s requester and the request must be for yourself. Not available for system-created tickets or tickets restricted to their workspace.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
teamId
string
required

The ID of the workspace. Required.

roleId
string
required

The ID of the role (entitlement) to request access for. Required.

targetUserId
string | null

The ID of the user to request access for. Defaults to the authenticated user if omitted.

accessMinutes
integer<int32>

The duration of access in minutes. Must not exceed the role's max_access_minutes. Required unless the role has no maximum duration.

businessJustification
string | null

A business justification for the access request. Required if the role's access policy requires justification.

scheduledStartAt
string | null

An optional scheduled start time for provisioning (RFC3339 format). If omitted, access is provisioned immediately upon approval.

ticketId
string | null

The ID of an existing ticket on the same workspace to attach the access request to. If omitted, a new ticket is created for the access request.

Response

200 - application/json

Success

data
data · object

The created access request.