# File an access request

> Source: https://elaichi.ai/docs/api-reference/access-requests/access-request/createaccessrequest/

`POST /access-request`

Resource: **Access Request** · API: **Access requests**

## Request body

- **`tool`** _(string)_
  The tool name the caller was blocked from calling, or a connector slug when `resource_type` is `"connector"`.
- **`resource_type`** _(string)_
  Allowed: `tool`, `connector`
- **`connector_slug`** _(string)_
  Only on a `"tool"` request (400 on a connector request): the connector the tool lives on. Lets an approval lift the restriction on exactly that tool; without it approving records a decision only.
- **`reason`** _(string)_
  Allowed: `permission`, `restriction`
- **`permission`** _(string)_
  Required when `reason` is `"permission"`; forbidden (400) when `reason` is `"restriction"`.
- **`note`** _(string)_

## Response body

- **`id`** _(string)_
  Access request id (`areq_…`).
- **`requester_user_id`** _(string)_
  User id (`usr_…`) of whoever filed the request.
- **`tool`** _(string)_
  What was asked for: a tool name, or a connector slug when `resource_type` is `"connector"`.
- **`resource_type`** _(string)_
  Allowed: `tool`, `connector`
- **`connector_slug`** _(string,null)_
  On a `"tool"` request, the connector the tool lives on when the request named one — what makes approving it able to lift the restriction on that tool. Always null on a `"connector"` request.
- **`reason`** _(string)_
  What kind of refusal this request is asking to be reconsidered.
  Allowed: `permission`, `restriction`
- **`permission`** _(string,null)_
  Present only when `reason` is `"permission"` — never populated for a `"restriction"`-reason request, on either write or read. That is the disclosure rule: a restriction refusal never names the rule that blocked the caller, so this field must not become a second channel for the same fact.
- **`note`** _(string,null)_
  Optional free text from the requester, ≤ 2000 characters.
- **`status`** _(string)_
  Allowed: `pending`, `approved`, `denied`, `withdrawn`
- **`created_at`** _(string)_
- **`resolved_at`** _(string,null)_
- **`resolved_by_user_id`** _(string,null)_
  User id (`usr_…`) of the admin who resolved it.
- **`resolution_note`** _(string,null)_
- **`updated_at`** _(string)_
- **`can_withdraw`** _(boolean)_
  True when the caller is the requester and `status` is still `pending`.

## Code examples

### curl

```bash
curl -X POST 'https://api.elaichi.ai/access-request' \
  -H 'Authorization: Bearer $ELAICHI_API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tool":"your_tool","resource_type":"tool","connector_slug":"your_connector_slug","reason":"permission","permission":"your_permission","note":"your_note"}'
```

### JavaScript

```javascript
const body = {
  "tool": "your_tool",
  "resource_type": "tool",
  "connector_slug": "your_connector_slug",
  "reason": "permission",
  "permission": "your_permission",
  "note": "your_note"
};

const response = await fetch('https://api.elaichi.ai/access-request', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer ' + process.env.ELAICHI_API_TOKEN,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify(body),
});

const data = await response.json();
console.log(data);
```

### Python

```python
import os
import requests

url = "https://api.elaichi.ai/access-request"
headers = {
    "Authorization": f"Bearer {os.environ['ELAICHI_API_TOKEN']}",
    "Content-Type": "application/json",
}
payload = {
    "tool": "your_tool",
    "resource_type": "tool",
    "connector_slug": "your_connector_slug",
    "reason": "permission",
    "permission": "your_permission",
    "note": "your_note"
}

response = requests.post(url, headers=headers, json=payload)
print(response.json())
```