Access Request API with an API key
Create and review access requests from your backend with your environment API key, without embedding an element or signing a user in to one. This page is for backend developers who already know the access request flow and need the API key variant of its endpoints.
The request bodies, response objects, status values, and reviewer rules are the same as in the element-session variant. The Access Request API page owns those details. This page lists only what differs.
How the API key variant differs
| Access Request API | Access Request API with an API key (this page) | |
|---|---|---|
| Authentication | Session cookie of a user signed in to the element with loginAs | Authorization: Bearer <API_KEY> header with your environment API key |
| Acting user and tenant | The signed-in user and the tenant of the session | The {user_id} and {tenant_id} path parameters |
| Base path | /v2/elements/{proj_id}/{env_id}/config/{elements_config_id}/access_requests | /v2/facts/{proj_id}/{env_id}/access_requests/{elements_config_id}/user/{user_id}/tenant/{tenant_id} |
| List filters | status, tenant, role, resource, resource_instance_id, page, per_page | status, role, resource, resource_instance_id, page, per_page (the tenant comes from the path) |
The {user_id} and {tenant_id} path parameters accept the ID or the key of the user and tenant. The API applies the same rules as for a signed-in user: the user must be a member of the tenant, and a user who is not a reviewer sees only their own requests.
Prerequisites
- An environment API key. See Get your API key.
- The ID or key of your project and environment. See Get the project and environment IDs.
- The ID or key of the element configuration, used as
elements_config_id. See List the elements in an environment.
Access request endpoints with an API key
In the following table, {base} stands for https://api.permit.io/v2/facts/{proj_id}/{env_id}/access_requests/{elements_config_id}/user/{user_id}/tenant/{tenant_id}. Each row links to the matching operation on the owner page, which shows the request body and response.
| Method | Path | Operation |
|---|---|---|
POST | {base} | Create an access request as {user_id} |
GET | {base} | List access requests visible to {user_id} |
GET | {base}/{access_request_id} | Get an access request |
PATCH | {base}/{access_request_id}/reviewer | Update the reviewer comment or role |
PUT | {base}/{access_request_id}/approve | Approve an access request |
PUT | {base}/{access_request_id}/deny | Deny an access request |
PUT | {base}/{access_request_id}/cancel | Cancel an access request |
For review actions, set {user_id} to the reviewer. For create and cancel, set {user_id} to the requesting user.
Related pages
- Access Request API, for request bodies, responses, and the element-session variant
- Access Request element
- Access Requests API reference