---
title: "Set Trust Center access"
method: POST
path: "/trust_exchange/trust_center/access/set"
tags: ["trust_exchange"]
---

# Set Trust Center access

`POST /trust_exchange/trust_center/access/set`

## Request

- Base URL: `https://cyber-risk.upguard.com/api/public`
- URL: `https://cyber-risk.upguard.com/api/public/trust_exchange/trust_center/access/set`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/docs/trust_exchange/trust_center/access/set/post.ts> (a function with typed inputs; its response is checked against the schema)

Sets which resources a user or organization, identified by email address, can access across
your Trust Centers. The resources resolved from the request are granted, and any currently-accessible
resources not among them are revoked, so their access ends up matching the request. Access is
reconciled for one scope only: if the user has both organization-level and personal access, this
updates the organization-level access.

Use `mode` to choose the set:

`all`: every resource published to any of your Trust Centers.

`trust_centers`: every resource on the Trust Centers named by `trust_center_uuids`.

`specific`: exactly the documents and questionnaires listed. Empty lists revoke all of the
user's or organization's current access, and a document or questionnaire that isn't published on
any of your Trust Centers is rejected rather than silently ignored.

The `all` and `trust_centers` modes resolve resources at the time of the call. Resources added to
a Trust Center later aren't granted automatically; call this endpoint again to include them. For
those modes, `duration_days` or `custom_end_date` sets the expiry on every granted resource.

If the email does not yet belong to a user, they are invited with the requested access applied
when they accept. If the email has access through multiple organizations, provide `org_name`
and/or `org_primary_hostname` to disambiguate. Those filters can also name an organization the
user belongs to but doesn't yet have access through, in which case access is created there.

Required API key permissions: `TrustExchange` and `ReadWrite` (select when creating API key in Account Settings)

## Query parameters

- `email` string, required
- `org_name` string
- `org_primary_hostname` string

## Request body

- SetTrustCenterAccessBody: `mode` selects how you express the desired set; leave the fields belonging to the other modes empty.
  - `custom_end_date` string, date-time: For modes `all` and `trust_centers`: grant access until this time. Mutually exclusive with duration_days.
  - `documents` TrustCenterDocumentAccess[]: For mode `specific`: the documents to grant, each with an optional expiry.
    - `custom_end_date` string, date-time: Grant access until this time. Mutually exclusive with duration_days.
    - `duration_days` integer: Grant access for this many days. Mutually exclusive with custom_end_date.
    - `uuid` string, required: UUID of the document to grant access to. Must be a lowercase v4 UUID.
  - `duration_days` integer: For modes `all` and `trust_centers`: grant access for this many days. Mutually exclusive with custom_end_date.
  - `mode` 'all' | 'trust_centers' | 'specific', required: How the desired access is expressed: `all` (every resource on all your Trust Centers), `trust_centers` (every resource on the named Trust Centers), or `specific` (the exact documents and questionnaires listed).
  - `questionnaires` TrustCenterQuestionnaireAccess[]: For mode `specific`: the questionnaires to grant, each with an optional expiry.
    - `custom_end_date` string, date-time: Grant access until this time. Mutually exclusive with duration_days.
    - `duration_days` integer: Grant access for this many days. Mutually exclusive with custom_end_date.
    - `id` integer, required: ID of the questionnaire to grant access to.
  - `trust_center_uuids` string[]: For mode `trust_centers`: the Trust Centers (by UUID) whose resources should be granted. Each must be a lowercase v4 UUID.

## Response `204`

No Content

## Other responses

- `403`: Account does not have access to requested entities
- `422`: An invalid parameter was supplied or a mandatory parameter was missing
- `429`: Too many requests have been made to this endpoint.
- `500`: An internal system error occurred

## Changes

- **2026-11-07** `d044bf6dc61e`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/changes/trust_exchange/trust_center/access/set/post.md)

---

[API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)