Home/Integration & Developer/Access requests

Trusted Records · Integration & Developer

Access requests

Request expiring, purpose-bound access; grants follow authorized approval.

Service Playground — task-based experience OpenAPI and Swagger Reference

Request schema from OpenAPI

Field	Type	Required	Constraints	Technical definition
`recordId`	string	Yes	`{"minLength": 1, "maxLength": 128}`	Registered record identifier; token scope alone does not confer object access.
`purpose`	string	Yes	`{"minLength": 1}`	Purpose of access to evaluate against object-level authority.
`expiresAt`	string	Yes	`{"minLength": 1, "format": "date-time"}`	UTC expiry of the proposed access request, not an issued grant.

Read the operation and next actions

Swagger · access

Errors and next actions

A consistent error envelope guides recovery without disclosing sensitive data.

Read details

Reliability, concurrency and recovery

Retry design follows the side effect rather than repeating every request blindly.

Read details

API Explorer — local simulator

Explore requests/responses and failure scenarios using synthetic data; no backend connection.

Read details

Input, scopes and processing

POST /v1/access-requests · scope access:request. Tenant/project and correlation contexts are required. POST/PATCH use Idempotency-Key; examples/schemas below are proposed contracts.

States and outputs

REQUESTED → APPROVED / DENIED → ACTIVE → EXPIRED / REVOKED.

Exceptions and controls

Invalid purpose/expiry returns 422; inappropriate request authority returns 403; hold/access policy may block.

HTTP example — proposed contract

Request

POST https://records.example.invalid/v1/access-requests HTTP/1.1
Authorization: Bearer <example-token>
X-Tenant-Id: synthetic-tenant-001
X-Project-Id: synthetic-project-001
X-Correlation-Id: synthetic-correlation-001
Idempotency-Key: synthetic-key-001
Content-Type: application/json

{
  "recordId": "synthetic-record-001",
  "purpose": "synthetic audit",
  "expiresAt": "2026-10-08T00:00:00Z"
}

Response · 202

{
  "requestId": "synthetic-access-001",
  "status": "APPROVAL_PENDING"
}

Required fields and shared controls

Item	Proposed rule
scope	access:request
required	recordId, purpose, expiresAt
tenant / project	Token and context must match; headers alone are insufficient.
idempotency	POST/PATCH: same key/body returns original result; changed body returns 409; confirm retention window.
error	code, message, requestId, correlationId, retryable, details; no sensitive data.

Continue the workflow

Two journeys, one records lifecycle

Connect paper and born-digital records through persistent identifiers, policies and evidence.

Read details

Integration quickstart

Exercise ingest → job tracking → registration → verification with synthetic data.

Read details

Integrity, provenance and evidence

Each evidence type answers a different question; hashes, timestamps and approvals are not interchangeable.

Read details

Start with a verifiable scope.

Agree record classes, quality criteria, permissions and evidence before scaling.

Plan assessment