---
title: "POST /v1/access_grants"
method: POST
path: "/v1/access_grants"
tags: ["Other"]
---

# POST /v1/access_grants

`POST /v1/access_grants`

## Request

- Base URL: `https://api.yardstick.team`
- URL: `https://api.yardstick.team/v1/access_grants`
- Auth: HTTP bearer

POST /v1/access_grants

**Required scopes:** `access_grants:write`

## Headers

- `Idempotency-Key` string
- `X-Request-Id` string

## Request body

- object
  - `subject_person_id` string, required
  - `scope` 'job' | 'department' | 'application' | 'report', required
  - `target_id` string, required
  - `artifact_classes` string[], required
  - `reason` string, required
  - `effective_at` string, date-time
  - `expires_at` string, date-time, nullable
  - `revocable` boolean

## Response `200`

Success

- object

## Other responses

- `400`: Invalid request
- `401`: Authentication failure
- `403`: Permission denied (scope or feature flag)
- `404`: Resource not found. The error uses the resource-specific code and param names the exact body field or path parameter that referenced it.
- `409`: Conflict (e.g. idempotency key reuse with different body)
- `429`: Rate limited
- `500`: Internal error

---

[API](https://skmtc.dev/yardstick/apis/yardstick-public-api.md) · [All operations](https://skmtc.dev/yardstick/apis/yardstick-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/yardstick/apis/yardstick-public-api/revisions/bef1d2eaaaa1?raw)