Requests

When an employee’s AI client calls a tool their Group doesn’t grant, the call fails and a request lands in Requests with their reason. You approve or decline it here.

Review tool requests

Each request shows the employee, tools, reason, and time. Hover the name to see their Groups.

• Approve for 1 hour, 1 day, 1 week, or no limit. Timed approvals move to Expired when they lapse.
• Deny with an optional note.
• Revoke an approval still in force.

Filter by status or employee, search, or select multiple rows to act on them together. Every decision is recorded in the Audit trail.

To get requests in your own system, add an endpoint under Settings → Organization → Tool access requests → Request webhooks. It receives TOOL_ACCESS_REQUEST_CREATED when an employee submits a request and TOOL_ACCESS_REQUEST_REVIEWED when it’s approved or denied.

Review tool requests with the API

Use an organization API key with view_tool_access to read requests and manage_tool_access to decide them.

GET /api/v1/tool-access/requests lists requests, paginated. Filter with status (PENDING, APPROVED, EXPIRED, DENIED, REVOKED, or CANCELED), person_id, or search. APPROVED returns only approvals still in force.

curl "https://wf-api.merge.dev/api/v1/tool-access/requests?status=PENDING" \
  -H "Authorization: Bearer $MERGE_WORKFORCE_API_KEY"

POST to /api/v1/tool-access/requests/{request_id}/approve or /deny while pending, or /revoke once approved. Each takes an optional decision_note. /approve also takes an optional expires_at. Without it, the approval keeps the end date the employee requested, which was fixed when they filed. Send expires_at to start the duration at approval.

import os
from datetime import UTC, datetime, timedelta
import requests
request_id = "7c1e9b4a-2f3d-4e8a-9b6c-0d5f2a1e3c47"
response = requests.post(
    f"https://wf-api.merge.dev/api/v1/tool-access/requests/{request_id}/approve",
    headers={"Authorization": f"Bearer {os.environ['MERGE_WORKFORCE_API_KEY']}"},
    json={
        "expires_at": (datetime.now(UTC) + timedelta(days=1)).isoformat(),
        "decision_note": "Approved for the Q4 close.",
    },
    timeout=30,
)
response.raise_for_status()
print(response.json()["expires_at"])

Decisions made with an API key have reviewed_by_person_id set to null, and the Audit trail attributes them to the key. See the API reference.

Review skill submissions

The Skills tab lists pending submissions with author, description, and Connectors used.

• Approve publishes the skill to the organization or the Groups the author chose.
• Reject, with an optional reason, returns it to the author.

See Reviewing submissions for what to check.