---
title: "Decide access mode preview items"
method: POST
path: "/access-mode/decisions"
tags: ["Roles and members"]
---

# Decide access mode preview items

`POST /access-mode/decisions`

## Request

- Base URL: `https://api.primitive.dev/v1`
- URL: `https://api.primitive.dev/v1/access-mode/decisions`
- Auth: HTTP bearer

Decide items the switch to delegated mode would change. Keep exempts an item; revoke revokes, deletes or stops it; narrow holds an item listed for a person (suspended or flagged) to be decided on the waiting list, where a key or Function can be narrowed; on an unattributed object, which no reduction holds, narrow leaves it as keep does, and the preview does not offer it. A mailbox loss or a connected app is only acknowledged (keep); a controlled key or Function and a self-given access entry take keep or revoke; another decision is refused with 400. Revoking a filter needs confirm: true. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `access_mode.write` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs access_mode:manage (owners). API keys are refused.

## Headers

- `Idempotency-Key` string

## Request body

- DecideAccessModeRequest
  - `decisions` object[], required
    - `kind` 'mailbox_loss' | 'rule2_function' | 'rule2_key' | 'rule2_oauth_grant' | 'api_key' | 'function' | 'github_binding' | 'endpoint' | 'recipient_route' | 'filter_rule' | 'pull_subscription' | 'wake_schedule' | 'function_trigger' | 'mailbox_self_grant', required
    - `id` string, required
    - `decision` 'keep' | 'narrow' | 'revoke', required
    - `note` string
    - `confirm` boolean

## Response `200`

Decide access mode preview items

- object
  - `success` true, required
  - `data` DecideAccessModeResult, required
    - `recorded` number, required

## Other responses

- `400`: Invalid request parameters
- `401`: Invalid or missing API key
- `403`: Authenticated caller lacks permission for the operation
- `404`: feature_disabled: the feature is not enabled for the organization; or not_found: the item the path names does not exist.
- `409`: conflict: the item changed while you edited it, or a member was removed and added back. Look again, then retry.
- `429`: Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.

---

[API](https://skmtc.dev/primitive/apis/primitive-api.md) - [All operations](https://skmtc.dev/primitive/apis/primitive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/primitive/apis/primitive-api/revisions/bce409c97acb?raw)