Approve or deny one pending member access request. The API key's creator must be allowed to change member roles in the workspace.

Approving promotes the requester from viewer to member when a seat is available and the workspace's membership policy allows it. A requester who is already a member or admin is fulfilled without using another seat. If the seat cannot be granted, for example because no seat is available or the workspace's roles are managed by an identity provider, the request becomes fulfillment_failed and no role changes.

Send If-Match with the list item's reviewEtag or the detail response's complete strong ETag, unchanged. The tag matches as long as no new event has been recorded on the request since that read; changes to the requester's profile details alone do not make it stale. A missing header returns 428 (precondition_required); a malformed or weak value returns 400 (invalid_request); a stale version returns 412 (precondition_failed); and a current tag on a request that is no longer pending returns 409 (request_already_resolved).

A successful review returns 200 with the updated request, its public history, a new ETag, and Cache-Control: no-store, no-transform. requester is included only when the key also has read:*, and remains null when requester details are unavailable. The ETag can differ from a subsequent detail GET's ETag at the same request version.

A read made immediately after a review can briefly return the request's previous state. If the response is lost, wait briefly and read the request again. If it is resolved, do not retry; if it is still pending, retry only with the latest read's ETag.

{
  "data": {
    "createdAt": "2026-08-04T10:00:00Z",
    "updatedAt": "2026-08-04T10:05:00Z",
    "events": [
      {
        "occurredAt": "2026-08-04T10:00:00Z"
      }
    ]
  }
}