Submit a resource request for an asset

POST

/assets/{id}/request-access

• Local development behind nginx (port 8088 by default)

Creates a pending resource_request for the calling user against the target asset. Any authenticated user may submit a request; the approver decides via /admin/requests.

When the approver grants the request, a row lands in user_capability_grants with request_ref populated — the CapabilitySweeper reaps both the grant and the linked request together at expires_at.

Authorizations

• cookieAuth
• bearerAuth

Parameters

Path Parameters

id

required

string format: uuid

Request Body ^required

object

capability

required

Capability code being requested.

string

reason

Optional free-text justification.

string

<= 1000 characters

Responses

201

Request created.

A resource_request row. The state machine is pending → granted / denied (admin decision); granted → expired (CapabilitySweeper cascade). Terminal states admit no further transitions.

object

id

required

string format: uuid

requester_user_ref

required

integer format: int64

target_asset_id

required

string format: uuid

requested_capability

required

string

reason

string

state

required

string

Allowed values: pending granted denied expired

decided_at

string format: date-time

nullable

decided_by_user_ref

integer format: int64

nullable

decision_reason

string

expires_at

On granted requests, the linked grant’s auto-expiry. Null means permanent.

string format: date-time

nullable

requested_at

required

string format: date-time

400

Malformed request

object

error

required

Human-readable error summary

string

Example

the request could not be completed

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}