Grant or deny a pending resource request

POST

/admin/requests/{id}/decide

• Local development behind nginx (port 8088 by default)

Atomic CAS — only pending requests transition. Re-deciding an already-decided request returns 409.

On grant, a user_capability_grants row is inserted in the same tx as the resource_request CAS. expires_at on the grant is the same value the operator supplied here; the CapabilitySweeper reaps both together when it fires.

Requires share.grant capability OR system.admin.

Authorizations

• cookieAuth
• bearerAuth

Parameters

Path Parameters

id

required

string format: uuid

Request Body ^required

object

decision

required

string

Allowed values: granted denied

reason

Operator-supplied decision reason.

string

<= 1000 characters

expires_at

On grant: optional auto-expiry. Past values rejected. Omit / null for a permanent grant. Ignored on deny.

string format: date-time

nullable

Responses

200

Decided.

A resource_request row. The state machine is pending → granted / denied (admin decision); granted → expired (CapabilitySweeper cascade). Terminal states admit no further transitions.

object

id

required

string format: uuid

requester_user_ref

required

integer format: int64

target_asset_id

required

string format: uuid

requested_capability

required

string

reason

string

state

required

string

Allowed values: pending granted denied expired

decided_at

string format: date-time

nullable

decided_by_user_ref

integer format: int64

nullable

decision_reason

string

expires_at

On granted requests, the linked grant’s auto-expiry. Null means permanent.

string format: date-time

nullable

requested_at

required

string format: date-time

400

Malformed request

object

error

required

Human-readable error summary

string

Example

the request could not be completed

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}

403

Authenticated but missing required capabilities

object

error

required

Human-readable error summary

string

Example

the request could not be completed

404

Resource not found

object

error

required

Human-readable error summary

string

Example

the request could not be completed

409

Already decided.

object

error

required

Human-readable error summary

string

Example

the request could not be completed