---
title: "POST /requests/grant-requests/agent/"
method: POST
path: "/requests/grant-requests/agent/"
tags: ["requests"]
---

# POST /requests/grant-requests/agent/

`POST /requests/grant-requests/agent/`

Delegate access an agent's owner already holds to the agent, time-boxed. Unlike
`create` this persists the request directly instead of returning a flow link -- an agent
authenticates with an API token and has no browser to run a flow in, so no justification
is ever collected. That is why the agent may only ask for what its owner already has:
the owner's approval is then the whole decision, and no reviewer is asked to judge a
request with nothing in it. The returned `fulfill_url` is what the agent hands to its
owner so they can act on it.

## Request body

- AgentGrantRequestCreateRequest — Body for an agent requesting access for itself. Deliberately narrower than `GrantRequestCreateSerializer`: an agent may not pick its own expiry, which is derived from the granting rules and capped by the agent's own lifetime.
  - `pbms` string[], required

## Response `201`

- AgentGrantRequestCreated — Response to an agent's access request: the request it created, plus the URL to hand to the human it acts for. An agent has no browser, so it cannot run the approval itself -- `fulfill_url` is what its owner opens to approve or deny.
  - `grant_request` GrantRequest, required — Mixin to validate that a valid enterprise license exists before allowing to save the object
    - `created` string, date-time, required
    - `created_by` PartialUser, required — Partial User Serializer, does not include child relations.
      - `pk` integer, required
      - `username` string, required — Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.
      - `name` string, required — User's display name.
      - `is_active` boolean — Designates whether this user should be treated as active. Unselect this instead of deleting accounts.
      - `last_login` string, date-time, nullable
      - `email` string, email
      - `attributes` object
      - `uid` string, required
    - `requester_data` object
    - `fulfiller_data` object
    - `revoked_by` PartialUser, required — Partial User Serializer, does not include child relations.
      - `pk` integer, required
      - `username` string, required — Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.
      - `name` string, required — User's display name.
      - `is_active` boolean — Designates whether this user should be treated as active. Unselect this instead of deleting accounts.
      - `last_login` string, date-time, nullable
      - `email` string, email
      - `attributes` object
      - `uid` string, required
    - `agent_owner` PartialUser, required — Partial User Serializer, does not include child relations.
      - `pk` integer, required
      - `username` string, required — Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.
      - `name` string, required — User's display name.
      - `is_active` boolean — Designates whether this user should be treated as active. Unselect this instead of deleting accounts.
      - `last_login` string, date-time, nullable
      - `email` string, email
      - `attributes` object
      - `uid` string, required
    - `is_active` boolean, required
    - `expires` string, date-time, nullable
    - `status` 'created' | 'approved' | 'denied' | 'revoked', required
    - `targets` string[], required
    - `target_objs` RequestableTarget[], required
      - `verbose_name` string, required — Return object's verbose_name
      - `verbose_name_plural` string, required — Return object's plural verbose_name
      - `meta_model_name` string, required — Return internal model name
      - `pbm_uuid` string, required
      - `label` string, required
      - `parent` Application, required — Application Serializer
        - `pk` string, uuid, required
        - `pbm_uuid` string, uuid, required
        - `name` string, required — Application's display Name.
        - `slug` string, required — Internal application name, used in URLs.
        - `provider` integer, nullable
        - `provider_obj` Provider, required — Provider Serializer
          - `pk` integer, required
          - `name` string, required
          - `authentication_flow` string, uuid, nullable — Flow used for authentication when the associated application is accessed by an un-authenticated user.
          - `authorization_flow` string, uuid, nullable — Flow used when authorizing this provider.
          - `invalidation_flow` string, uuid, nullable — Flow used ending the session from a provider.
          - `property_mappings` string[]
          - `component` string, required — Get object component so that we know how to edit the object
          - `assigned_application_slug` string, nullable, required — Internal application name, used in URLs.
          - `assigned_application_name` string, nullable, required — Application's display Name.
          - `assigned_backchannel_application_slug` string, nullable, required — Internal application name, used in URLs.
          - `assigned_backchannel_application_name` string, nullable, required — Application's display Name.
          - `verbose_name` string, required — Return object's verbose_name
          - `verbose_name_plural` string, required — Return object's plural verbose_name
          - `meta_model_name` string, required — Return internal model name
        - `backchannel_providers` integer[]
        - `backchannel_providers_obj` Provider[], required
          - `pk` integer, required
          - `name` string, required
          - `authentication_flow` string, uuid, nullable — Flow used for authentication when the associated application is accessed by an un-authenticated user.
          - `authorization_flow` string, uuid, nullable — Flow used when authorizing this provider.
          - `invalidation_flow` string, uuid, nullable — Flow used ending the session from a provider.
          - `property_mappings` string[]
          - `component` string, required — Get object component so that we know how to edit the object
          - `assigned_application_slug` string, nullable, required — Internal application name, used in URLs.
          - `assigned_application_name` string, nullable, required — Application's display Name.
          - `assigned_backchannel_application_slug` string, nullable, required — Internal application name, used in URLs.
          - `assigned_backchannel_application_name` string, nullable, required — Application's display Name.
          - `verbose_name` string, required — Return object's verbose_name
          - `verbose_name_plural` string, required — Return object's plural verbose_name
          - `meta_model_name` string, required — Return internal model name
        - `launch_url` string, nullable, required — Allow formatting of launch URL
        - `open_in_new_tab` boolean — Open launch URL in a new browser tab or window.
        - `meta_launch_url` string, uri
        - `meta_icon` string
        - `meta_icon_url` string, nullable, required — Get the URL to the App Icon image
        - `meta_icon_themed_urls` ThemedUrls, required — Themed URLs - maps theme names to URLs for light and dark themes
          - `light` string, nullable
          - `dark` string, nullable
        - `meta_description` string
        - `meta_publisher` string
        - `policy_engine_mode` 'all' | 'any'
        - `group` string
        - `meta_hide` boolean — Hide this application from the user's My applications page.
    - `uuid` string, uuid
  - `fulfill_url` string, required

## Other responses

- `400`
- `403`

---

[API](https://skmtc.dev/goauthentik/apis/authentik.md) · [All operations](https://skmtc.dev/goauthentik/apis/authentik/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/goauthentik/authentik/revisions/4e42e86021d7/schema)