handle_access_request

ResourceAccessApi.handle_access_request(role_id, request_id, handle_request, content_type=None, _request_timeout=None, _request_auth=None, _content_type=None, _headers=None, _host_index=0)

Approve or deny an access request

Handles a pending access request. The request body requires Action (approve or deny) and Comment. The caller must have the required role authorization and owner or editor access to the resource, with permission to grant the requested access type. The access request must exist and remain in requested status. For dataset approvals, domain access may also be required. Approving grants the requested resource access and records the approval, while denying updates the request status and notifies the requester.

Parameters:

  • role_id (str) – Amorphic role ID used for authorization. Must allow the resource-type list action for the request’s ResourceType. (required)

  • request_id (str) – UUID of the access request. Rejected with IPV-1002 if not found. (required)

  • handle_request (HandleRequest) – (required)

  • content_type (str) – Must be application/json.

  • _request_timeout (int, tuple(int, int), optional) – timeout setting for this request. If one number provided, it will be total request timeout. It can also be a pair (tuple) of (connection, read) timeouts.

  • _request_auth (dict, optional) – set to override the auth_settings for an a single request; this effectively ignores the authentication in the spec for a single request.

  • _content_type (str, Optional) – force content-type for the request.

  • _headers (dict, optional) – set to override the headers for a single request; this effectively ignores the headers in the spec for a single request.

  • _host_index (int, optional) – set to override the host_index for a single request; this effectively ignores the host_index in the spec for a single request.

Return type:

HandleAccessRequestResponse

Returns:

Returns the result object.

Request and Response Examples

HTTP: PUT /access-requests/{request_id}

Request

Approve pending request

{
  "Action": "approve",
  "Comment": "Approved for reporting use"
}

Deny pending request

{
  "Action": "deny",
  "Comment": "Insufficient business justification"
}

Success (HTTP 200)

Request approved or denied. Body is Message only (HandleAccessRequestResponse).

Approved

{
  "Message": "Successfully approved the request for Datasets."
}

Denied

{
  "Message": "Successfully denied the request for datasets."
}

Errors

Documented error codes: GE-1007, IPV-1002, AUTH-1010, GE-1086, AUTH-1003, GE-1034, GE-1085, EMF-1001.

HTTP 400

Validation or authorization failure. Body is {“Message”: “<CODE> - <text>”}. Common codes: GE-1007 (invalid Action), IPV-1002 (RequestId not found), AUTH-1010 (not owner/editor or cannot grant AccessType), GE-1086 (already handled or requester already has access), AUTH-1003 (dataset approve missing domain access), GE-1034 (resource id mismatch on approve check).

Action not approve or deny

{
  "Message": "GE-1007 - Invalid action reject, supported actions are ['approve','deny']"
}

RequestId not found

{
  "Message": "IPV-1002 - Invalid RequestId - a2f7d3b1-8e5c-4a6f-9d1e-2b3c4d5e6f7a, resource not found."
}

Caller cannot approve/deny

{
  "Message": "AUTH-1010 - User user1 is not authorized to perform this operation"
}

Request already handled

{
  "Message": "GE-1086 - The request has already been handled."
}

HTTP 500

Backend failure. Body is {“Message”: “<CODE> - <text>”} (typically GE-1085 via EMF-1001), including grant-permission Lambda failures or unbound response if DynamoDB write fails. Missing Comment/Action in body raises KeyError and returns 500.

Unexpected failure

{
  "Message": "GE-1085 - <exception text>"
}