---
title: "AARP: open an approval from a requestable denial"
method: POST
path: "/access/v1/access-request"
---

# AARP: open an approval from a requestable denial

`POST /access/v1/access-request`

## Request

- Base URL: `https://getsanction.com/api`
- URL: `https://getsanction.com/api/access/v1/access-request`
- Auth: API key in header `x-api-key`

AuthZEN Access Request and Approval Profile (draft 1). Submit the denied subject/action/resource with denial.binding_token (from the evaluation's context.access_request) to open a real Sanction escalation — it lands in the owner's approval inbox and notifies via email/Slack/webhooks. Returns the AARP task handle; poll its status_endpoint. Supports Idempotency-Key. Errors are RFC 9457 problem+json: 400 invalid_denial_binding (tampered token or mismatched tuple), 410 expired_denial.

## Request body

- AarpAccessRequest: AuthZEN Access Request and Approval Profile (draft) submission: the denied subject/action/resource plus the binding_token from the requestable denial's context.access_request. Opens a real Sanction escalation in the owner's approval inbox. Binding tokens are SINGLE-USE — the token's jti is consumed with the escalation it opens; replaying a used token under a new Idempotency-Key returns a problem+json refusal, while retrying under the SAME Idempotency-Key safely replays the existing task. AuthZEN endpoints are rate-limited per agent (429 + Retry-After).
  - `subject` AuthZenEntity, required: An AuthZEN subject or resource: a typed identifier with optional properties.
    - `type` string, required
    - `id` string, required
    - `properties` object
  - `action` AuthZenAction, required
    - `name` string, required
    - `properties` object
  - `resource` AuthZenEntity, required: An AuthZEN subject or resource: a typed identifier with optional properties.
    - `type` string, required
    - `id` string, required
    - `properties` object
  - `context` object
  - `denial` object, required
    - `binding_token` string, required: Signed token from the requestable denial — proves this submission is the denied evaluation.
    - `expires_at` string, date-time
    - `reason` string
  - `requested_access` object

## Response `200`

Idempotent replay (Idempotency-Key already seen) — the existing task with its CURRENT status

- AarpTaskResponse: The AARP task handle. status pending → poll status_endpoint; approved carries result.mode 'reevaluate' plus the approval object (approval.id is the one-use grant, approved_until its expiry) to present back to the evaluation endpoint as context.approval.
  - `task` object
    - `id` string
    - `status` 'pending' | 'approved' | 'denied' | 'expired'
    - `status_endpoint` string
    - `expires_at` string, date-time
    - `links` object
      - `review` string
  - `result` object
    - `mode` 'reevaluate'
    - `approval` object
      - `id` string: The one-use grant id — present as context.approval.id on re-evaluation.
      - `approved_at` string, date-time
      - `approved_until` string, date-time, nullable

## Other responses

- `201`: Escalation opened — task handle returned
- `400`: Malformed request (plain error JSON), or invalid denial binding — tampered token or mismatched tuple (problem+json)
- `401`: Invalid API key
- `403`: subject.id does not match the authenticated agent
- `410`: The denial has expired — re-evaluate for a fresh one (problem+json)

---

[API](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api.md) · [All operations](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/revisions/c645a9e4b72d?raw)