File an access request

Copy page

POST /access-request

Any authenticated member — no permission required. Requiring a permission to ask for a permission would be a deadlock: the member who most needs this route holds the fewest permissions. Membership (`orgContext()`) is the only gate, and there is no `requester_user_id` in the body — a request is always filed as the caller. `permission` is required and must be a known permission name when `reason` is `"permission"`, and forbidden (a `400`) when `reason` is `"restriction"` — the same disclosure rule a restriction refusal already enforces on the refusal itself: this resource must not become a second way to learn which rule blocked someone. `reason` is never `"scope"` — a scope refusal has no admin-side fix and never sets `can_request_access`. **Filing never grants anything.** It creates a record for an admin to decide; approving a `restriction`-reason request is what can lift the restriction (see `resolveAccessRequest`). **De-duplicated.** A second request for the same `tool` while an earlier one from the same requester is still `pending` does not create a new row — it returns the existing one (updating `note` when a different one was sent) with `200`. A genuinely new row is `201`. **A tool request that could never be granted is refused.** A `restriction`-reason `"tool"` request naming a `connector_slug` whose WHOLE connector is restricted for the caller is `409 tool_request_connector_blocked`: approving it would lift nothing (one tool cannot be carved out of a connector restricted whole, and an approval never opens the whole connector for a one-tool ask). The message names the connector and says to ask for it instead; `error.details` carries `connector_slug`, `connector_label` and `pending_request` (the caller’s own open connector request, or null). Every tool row that can draw an ask carries `restricted_scope` (`"connector" | "tool" | null`), so a client files the connector request up front.

Request Body

Response Body

curl -X POST 'https://api.elaichi.ai/access-request' \
  -H 'Authorization: Bearer $ELAICHI_API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tool":"your_tool","resource_type":"tool","connector_slug":"your_connector_slug","reason":"permission","permission":"your_permission","note":"your_note"}'

const body = {
  "tool": "your_tool",
  "resource_type": "tool",
  "connector_slug": "your_connector_slug",
  "reason": "permission",
  "permission": "your_permission",
  "note": "your_note"
};

const response = await fetch('https://api.elaichi.ai/access-request', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer ' + process.env.ELAICHI_API_TOKEN,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify(body),
});

const data = await response.json();
console.log(data);

import os
import requests

url = "https://api.elaichi.ai/access-request"
headers = {
    "Authorization": f"Bearer {os.environ['ELAICHI_API_TOKEN']}",
    "Content-Type": "application/json",
}
payload = {
    "tool": "your_tool",
    "resource_type": "tool",
    "connector_slug": "your_connector_slug",
    "reason": "permission",
    "permission": "your_permission",
    "note": "your_note"
}

response = requests.post(url, headers=headers, json=payload)
print(response.json())