Approve a Trust Center access request

POST

/trust-center/access-requests/{id}/approve

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
    Method = HttpMethod.Post,
    RequestUri = new Uri("https://api.vendorica.com/v1/trust-center/access-requests/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/approve"),
    Headers =
    {
        { "Authorization", "Bearer <token>" },
    },
    Content = new StringContent("{ \"ttlDays\": 1, \"reference\": \"example\", \"scope\": \"all\", \"resourceIds\": [ \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\" ] }")
    {
        Headers =
        {
            ContentType = new MediaTypeHeaderValue("application/json")
        }
    }
};
using (var response = await client.SendAsync(request))
{
    response.EnsureSuccessStatusCode();
    var body = await response.Content.ReadAsStringAsync();
    Console.WriteLine(body);
}

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "https://api.vendorica.com/v1/trust-center/access-requests/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/approve"

  payload := strings.NewReader("{ \"ttlDays\": 1, \"reference\": \"example\", \"scope\": \"all\", \"resourceIds\": [ \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\" ] }")

  req, _ := http.NewRequest("POST", url, payload)

  req.Header.Add("Authorization", "Bearer <token>")
  req.Header.Add("Content-Type", "application/json")

  res, _ := http.DefaultClient.Do(req)

  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))

}

OkHttpClient client = new OkHttpClient();

MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{ \"ttlDays\": 1, \"reference\": \"example\", \"scope\": \"all\", \"resourceIds\": [ \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\" ] }");
Request request = new Request.Builder()
  .url("https://api.vendorica.com/v1/trust-center/access-requests/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/approve")
  .post(body)
  .addHeader("Authorization", "Bearer <token>")
  .addHeader("Content-Type", "application/json")
  .build();

Response response = client.newCall(request).execute();

const url = 'https://api.vendorica.com/v1/trust-center/access-requests/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/approve';
const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"ttlDays":1,"reference":"example","scope":"all","resourceIds":["2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"]}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

use serde_json::json;
use reqwest;

#[tokio::main]
pub async fn main() {
    let url = "https://api.vendorica.com/v1/trust-center/access-requests/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/approve";

    let payload = json!({
        "ttlDays": 1,
        "reference": "example",
        "scope": "all",
        "resourceIds": ("2489E9AD-2EE2-8E00-8EC9-32D5F69181C0")
    });

    let mut headers = reqwest::header::HeaderMap::new();
    headers.insert("Authorization", "Bearer <token>".parse().unwrap());
    headers.insert("Content-Type", "application/json".parse().unwrap());

    let client = reqwest::Client::new();
    let response = client.post(url)
        .headers(headers)
        .json(&payload)
        .send()
        .await;

    let results = response.unwrap()
        .json::<serde_json::Value>()
        .await
        .unwrap();

    dbg!(results);
}

curl --request POST \
  --url https://api.vendorica.com/v1/trust-center/access-requests/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/approve \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "ttlDays": 1, "reference": "example", "scope": "all", "resourceIds": [ "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" ] }'

Approves a PENDING request and mints the visitor’s credential. The access link is always emailed to the requester, and the raw token is never returned to you — your key is a long-lived credential living in another system, and a working link to the gated documents does not belong in that system’s history. emailSent reports whether the mail reached the provider; if it did not, the visitor can have the link re-sent from the Trust Center’s own page. Which documents: omit scope (or send "all") for every gated document that is not restricted — what an approval in the app grants by default; "all_gated_plus_selected" adds the restricted documents named in resourceIds; "selected" grants only those. Ids come from GET /v1/trust-center/resources (isRestricted marks the ones a standard approval leaves out), and an unpublished or unknown id refuses the whole approval rather than granting less than you asked. ttlDays (1–365) defaults to the organization’s configured access window. reference (optional, up to 500 characters) is your own reference — a ticket key or URL — shown beside the decision in the app and recorded in the audit trail. The decision is attributed to this API key, on the request (decidedVia: "api", decidedByApiClientId) and in the audit trail, never to a person. The body is strict: an unrecognised field — including sendEmail, which the app offers and this API does not — is a 422 naming it.

Authorizations

bearerAuth
trust-center-access:write

Parameters

Path Parameters

required

string format: uuid

Request Body^required

application/json

object

ttlDays

integer

>= 1 <= 365

reference

string

>= 1 characters <= 500 characters

scope

string

Allowed values: all selected all_gated_plus_selected

resourceIds

Array<string>

<= 200 items

Responses

200

Success

application/json

object

success

required

boolean

data

required

object

request

required

object

required

string format: uuid

organizationId

required

string format: uuid

visitorEmail

required

string

visitorName

required

string | null

companyName

required

string | null

reason

required

string | null

rejectionReason

required

string | null

status

required

string

decidedByUserId

required

string | null format: uuid

decidedByApiClientId

required

string | null format: uuid

decidedAt

required

string | null format: date-time

decidedVia

required

string | null

Allowed values: app api access_rule

decisionReference

required

string | null

autoRuleId

required

string | null format: uuid

visitorTokenId

required

string | null format: uuid

requestCountryCode

required

string | null

requestCity

required

string | null

requestedResourceIds

required

Array<string>

createdAt

required

string format: date-time

key

additional properties

visitorToken

required

object

required

string format: uuid

organizationId

required

string format: uuid

origin

required

string

visitorEmail

required

string

visitorName

required

string | null

companyName

required

string | null

tokenSuffix

required

string | null

status

required

string

Allowed values: active expired revoked

expiresAt

required

string | null format: date-time

revokedAt

required

string | null format: date-time

lastUsedAt

required

string | null format: date-time

createdAt

required

string format: date-time

updatedAt

required

string format: date-time

emailSent

required

boolean

timestamp

required

string format: date-time

requestId

string

message

string

Example

{
  "success": true,
  "data": {
    "request": {
      "id": "2bffa314-596d-4ba2-88be-5e735aaeb555",
      "organizationId": "a5e4e7e9-1259-46f1-843f-1ef6115db6f6",
      "visitorEmail": "string",
      "visitorName": "string",
      "companyName": "string",
      "reason": "string",
      "rejectionReason": "string",
      "status": "string",
      "decidedByUserId": "59fd2a7e-2589-4134-8f0d-8995034f8f43",
      "decidedByApiClientId": "03921668-08f9-48de-8d6d-b3e7d6b22e59",
      "decidedAt": "2026-08-19T09:41:12.004Z",
      "decidedVia": "app",
      "decisionReference": "string",
      "autoRuleId": "07135187-a869-445f-89cf-ccd4921f6b70",
      "visitorTokenId": "f59342f9-91d2-4121-8048-1886037e94a6",
      "requestCountryCode": "string",
      "requestCity": "string",
      "requestedResourceIds": [
        "a53409fd-0feb-4c6d-8e19-a12ab058bb6a"
      ],
      "createdAt": "2026-08-19T09:41:12.004Z"
    },
    "visitorToken": {
      "id": "972c5d18-14d6-4fee-8ac4-92171671f3e9",
      "organizationId": "6174d27d-e9e7-4ded-8538-ddaa4684f8ea",
      "origin": "string",
      "visitorEmail": "string",
      "visitorName": "string",
      "companyName": "string",
      "tokenSuffix": "string",
      "status": "active",
      "expiresAt": "2026-08-19T09:41:12.004Z",
      "revokedAt": "2026-08-19T09:41:12.004Z",
      "lastUsedAt": "2026-08-19T09:41:12.004Z",
      "createdAt": "2026-08-19T09:41:12.004Z",
      "updatedAt": "2026-08-19T09:41:12.004Z"
    },
    "emailSent": true
  },
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H",
  "message": "string"
}

400

Validation error

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Bad request",
  "code": "BAD_REQUEST",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

401

Unauthorized

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Unauthorized",
  "code": "UNAUTHORIZED",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

403

Forbidden — missing scope

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Forbidden",
  "code": "FORBIDDEN",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

404

Not found

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Resource not found",
  "code": "NOT_FOUND",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

409

The request is no longer pending — a person, a rule or an earlier call decided it first (ACCESS_REQUEST_ALREADY_DECIDED). Nothing was changed and no credential was minted. GET the request to see what it now says; this is the answer a RETRY of a decision that already landed receives.

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false
}

422

Unrecognised or invalid field — the response names it

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Validation failed",
  "code": "VALIDATION_ERROR",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

429

Rate limit exceeded

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Too many requests",
  "code": "TOO_MANY_REQUESTS",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

Approve a Trust Center access request

Authorizations

Parameters

Path Parameters

Request Bodyrequired

Responses

200

Example

400

Example

401

Example

403

Example

404

Example

409

Example

422

Example

429

Example

Request Body^required