Review tool access request

curl -X PATCH https://ah-api.merge.dev/api/v1/tool-access-requests/request_id/ \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{
  "status": "approved",
  "expires_in_seconds": 604800,
  "decision_note": "Approved for the incident."
}'

{
  "id": "0c5e8f7a-3b2d-4f61-8e9a-7d4c1b2a3f50",
  "registered_user": {
    "id": "9a7b6c5d-4e3f-4a2b-8c1d-0e9f8a7b6c5d",
    "origin_id": "00u1abcd2EFGH3ijk4l5",
    "name": "Jane Doe"
  },
  "tool_pack": {
    "id": "1d8b6f4a-1b3e-4f9b-9d3a-3a8e8b9c0d1f",
    "name": "Engineering"
  },
  "reason": "Triage bug ticket 123",
  "reviewed_by": null,
  "created_at": "2026-10-30T19:58:12Z",
  "modified_at": "2026-10-30T20:02:00Z",
  "status": "approved",
  "requested_tool_slugs": [
    "jira__create_issue"
  ],
  "requested_expires_at": "2026-11-06T00:00:00Z",
  "approved_tool_slugs": [
    "jira__create_issue"
  ],
  "approved_expires_at": "2026-11-06T00:00:00Z",
  "decision_note": "Approved for the incident.",
  "approved_at": "2026-10-30T20:02:00Z",
  "denied_at": null,
  "revoked_at": null,
  "canceled_at": null
}

Approve or deny a pending request, or revoke an approved one, by setting its status.

Authentication

AuthorizationBearer

Token-based authentication with required prefix “Bearer”

Path parameters

request_idstringRequiredformat: "uuid"

Request

This endpoint expects an object.

statusenumRequired

approved or denied decides a pending request; revoked removes the access an approved request granted. Expiry fields are only accepted with approved.

Allowed values:

expires_atdatetime or nullOptional

When the granted access ends.

expires_in_secondsintegerOptional>=1

Seconds from now until the granted access ends.

permanentbooleanOptional

Grant access with no expiry. With no expiry field set, the expiry the requester asked for is used.

decision_notestringOptionalDefaults to

Response

idstringRead-onlyformat: "uuid"

registered_userobject

The employee who filed the request.

tool_packobject or null

The tool pack the request was filed from.

reasonstring

reviewed_byobject or null

The dashboard user who decided the request.

created_atdatetimeRead-only

modified_atdatetimeRead-only

statusenumOptional

Allowed values:

requested_tool_slugslist of stringsOptional

requested_expires_atdatetime or nullOptional

Requested expiration. Null means permanent access was requested.

approved_tool_slugslist of stringsOptional

approved_expires_atdatetime or nullOptional

Approved expiration. Null means permanent access.

decision_notestringOptional

approved_atdatetime or nullOptional

denied_atdatetime or nullOptional

revoked_atdatetime or nullOptional

canceled_atdatetime or nullOptional