---
title: "Approve an access request"
method: POST
path: "/accessRequests.approve"
tags: ["AccessRequests"]
---

# Approve an access request

`POST /accessRequests.approve`

## Request

- Base URL: `https://app.getoutline.com/api`
- URL: `https://app.getoutline.com/api/accessRequests.approve`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Authorization code: `https://app.getoutline.com/oauth/authorize`
    - Token URL: `https://app.getoutline.com/oauth/token` scopes: `read`, `write`

Approve a pending access request, granting the requesting user a membership on the document with the specified permission.

## Request body

- object
  - `id` string, uuid, required: Unique identifier for the access request.
  - `permission` 'read' | 'read_write' | 'admin': The permission to grant the requesting user.

## Response `200`

OK

- object
  - `data` AccessRequest
    - `id` string, uuid: Unique identifier for the object.
    - `documentId` string, uuid: Identifier for the document this request is for.
    - `userId` string, uuid: Identifier for the user that made the request.
    - `user` User
      - `id` string, uuid: Unique identifier for the object.
      - `name` string: The name of this user, it is migrated from Slack or Google Workspace when the SSO connection is made but can be changed if necessary.
      - `avatarUrl` string, uri: The URL for the image associated with this user, it will be displayed in the application UI and email notifications.
      - `color` string: A color representing the user, used in the UI for avatars without an image.
      - `email` string, email: The email associated with this user, it is migrated from Slack or Google Workspace when the SSO connection is made but can be changed if necessary.
      - `role` 'admin' | 'member' | 'viewer' | 'guest'
      - `isSuspended` boolean: Whether this user has been suspended.
      - `lastActiveAt` string, date-time, nullable: The last time this user made an API request, this value is updated at most every 5 minutes.
      - `timezone` string, nullable: The timezone this user has registered.
      - `createdAt` string, date-time: The date and time that this user first signed in or was invited as a guest.
      - `updatedAt` string, date-time: The date and time that this user was last updated.
      - `deletedAt` string, date-time, nullable: The date and time that this user was deleted, if applicable.
      - `invitedBy` User (recursive)
    - `teamId` string, uuid: Identifier for the workspace the request belongs to.
    - `status` 'pending' | 'approved' | 'dismissed': The current status of the access request.
    - `responderId` string, uuid, nullable: Identifier for the user that responded to the request, if any.
    - `responder` User
      - `id` string, uuid: Unique identifier for the object.
      - `name` string: The name of this user, it is migrated from Slack or Google Workspace when the SSO connection is made but can be changed if necessary.
      - `avatarUrl` string, uri: The URL for the image associated with this user, it will be displayed in the application UI and email notifications.
      - `color` string: A color representing the user, used in the UI for avatars without an image.
      - `email` string, email: The email associated with this user, it is migrated from Slack or Google Workspace when the SSO connection is made but can be changed if necessary.
      - `role` 'admin' | 'member' | 'viewer' | 'guest'
      - `isSuspended` boolean: Whether this user has been suspended.
      - `lastActiveAt` string, date-time, nullable: The last time this user made an API request, this value is updated at most every 5 minutes.
      - `timezone` string, nullable: The timezone this user has registered.
      - `createdAt` string, date-time: The date and time that this user first signed in or was invited as a guest.
      - `updatedAt` string, date-time: The date and time that this user was last updated.
      - `deletedAt` string, date-time, nullable: The date and time that this user was deleted, if applicable.
      - `invitedBy` User (recursive)
    - `respondedAt` string, date-time, nullable: The date and time the request was responded to, if any.
    - `createdAt` string, date-time: The date and time that this object was created
    - `updatedAt` string, date-time: The date and time that this object was last changed
  - `policies` Policy[]
    - `id` string, uuid: Unique identifier for the object this policy references.
    - `abilities` object: The abilities that are allowed by this policy, if an array is returned then the individual ID's in the array represent the memberships that grant the ability.

## Other responses

- `400`: The request failed one or more validations.
- `401`: The API key is missing or otherwise invalid.
- `403`: The current API key is not authorized to perform this action.
- `404`: The specified resource was not found.
- `429`: The request was rate limited.

## Changes

- **2026-08-12** `9a99ee93e11d`: 2 info
  - added the optional property `data/responder/invitedBy` to the response with the `200` status
  - added the optional property `data/user/invitedBy` to the response with the `200` status
- **2026-05-30** `304cd065561b`: 2 breaking, 8 info
  - the response property `data/responder/lastActiveAt` became nullable for the status `200`
  - the response property `data/user/lastActiveAt` became nullable for the status `200`
  - added the optional property `data/responder/color` to the response with the `200` status
  - added the optional property `data/responder/deletedAt` to the response with the `200` status
  - …6 more
- **2026-05-10** `435376166250`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/defaulr/apis/outline-api/changes/accessRequests.approve/post.md)

---

[API](https://skmtc.dev/defaulr/apis/outline-api.md) - [All operations](https://skmtc.dev/defaulr/apis/outline-api/llms.txt) - [OpenAPI document](https://skmtc.dev/defaulr/apis/outline-api/revisions/5ddf01ffba84?raw)