Skip to content
JITSudo Docs

Submit access request

POST
/v1/requests
 
curl --request POST \
  --url https://example.com/v1/requests \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <X-API-Key>' \
  --header 'X-Tenant-ID: 2489E9AD-2EE2-8E00-8EC9-32D5F69181C0' \
  --data '{ "resource": { "type": "aws_account", "id": "example" }, "action": "example", "reason": "example", "duration_seconds": 1, "break_glass": false, "metadata": {} }'

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Header Parameters

Section titled “Header Parameters ”
X-Tenant-ID
required
string format: uuid

Tenant identifier. Must match the tenant associated with the credential. Returns 403 tenant_mismatch if the credential and header belong to different tenants.

Request Body required

Section titled “Request Body required ”
Media type application/json
object
resource
required
object
type
required
string
Allowed values: aws_account aws_permission_set aws_s3_bucket aws_rds_instance aws_ec2_instance aws_organizational_unit
id
required

Resource identifier. Format depends on type: aws_account: 12-digit AWS account ID aws_permission_set: permission set ARN aws_s3_bucket: bucket name aws_rds_instance: DB instance ARN aws_ec2_instance: instance ID (i-xxxx) aws_organizational_unit: OU ID (ou-xxxx-xxxxxxxx)

string
action
required
string
reason
string
duration_seconds

Requested duration in seconds. Null or omitted means use system default.

integer
nullable
break_glass

Emergency bypass flag. Skips policy evaluation and creates an approved request immediately.

boolean
metadata
object
key
additional properties
any

Responses

Section titled “ Responses ”

201

Section titled “201 ”

Created

Media type application/json
object
id
required
string format: uuid
requester_id
required

Identity of the user requesting access (subject claim from JWT).

string
resource
required
object
type
required
string
Allowed values: aws_account aws_permission_set aws_s3_bucket aws_rds_instance aws_ec2_instance aws_organizational_unit
id
required

Resource identifier. Format depends on type: aws_account: 12-digit AWS account ID aws_permission_set: permission set ARN aws_s3_bucket: bucket name aws_rds_instance: DB instance ARN aws_ec2_instance: instance ID (i-xxxx) aws_organizational_unit: OU ID (ou-xxxx-xxxxxxxx)

string
action
required
string
reason

User-provided justification for the request.

string
nullable
status
required
string
Allowed values: pending approved denied expired cancelled
decision_reasoning

Approver or system-provided explanation of the decision.

string
nullable
decided_by

Identity of the user who approved or denied the request.

string
nullable
approval_mode

How the request was approved. Null for requests created before this field existed.

string
nullable
Allowed values: require auto break_glass
break_glass

Whether this was an emergency break-glass request.

boolean
duration_seconds

Requested duration in seconds.

integer
nullable
metadata
required
object
key
additional properties
any
created_at
required
string format: date-time
updated_at
required
string format: date-time
Example 
{
  "resource": {
    "type": "aws_account"
  },
  "status": "pending",
  "approval_mode": "require"
}

400

Section titled “400 ”

Invalid input

Media type application/json
object
code
required

Machine-readable error code (e.g. “not_found”, “tenant_mismatch”).

string
message
required

Human-readable description of the error.

string
details

Optional additional context about the error.

object
key
additional properties
any
notices

Policy notices from determining Cedar rules, if applicable.

Array<string>
Example generated
{
  "code": "example",
  "message": "example",
  "details": {},
  "notices": [
    "example"
  ]
}

401

Section titled “401 ”

Unauthenticated

Media type application/json
object
code
required

Machine-readable error code (e.g. “not_found”, “tenant_mismatch”).

string
message
required

Human-readable description of the error.

string
details

Optional additional context about the error.

object
key
additional properties
any
notices

Policy notices from determining Cedar rules, if applicable.

Array<string>
Example generated
{
  "code": "example",
  "message": "example",
  "details": {},
  "notices": [
    "example"
  ]
}

403

Section titled “403 ”

Forbidden

Media type application/json
object
code
required

Machine-readable error code (e.g. “not_found”, “tenant_mismatch”).

string
message
required

Human-readable description of the error.

string
details

Optional additional context about the error.

object
key
additional properties
any
notices

Policy notices from determining Cedar rules, if applicable.

Array<string>
Example generated
{
  "code": "example",
  "message": "example",
  "details": {},
  "notices": [
    "example"
  ]
}