Skip to main content
POST
Ask for access to RESTRICTED data

Authorizations

Authorization
string
header
required

Personal access token of a ROOTKey user, sent as Authorization: Bearer rk_pat_.... A token acts as the user who created it, in the organization named by the X-RootKey-Organization header, and never with more access than that user has in the ROOTKey app: the organization's agent policy, the user's own role and teams, and the token's scopes (rootkey.read, rootkey.write, rootkey.delete) all apply. A missing, malformed, unknown, revoked or expired token gets the same 401. Send either an x-api-key or a bearer token, never both: a request with both gets conflicting_credentials. See Authentication.

Headers

X-RootKey-Organization
string

The organization a personal access token acts in: the id of one of the organizations that GET /organizations lists. Required with a personal access token on every endpoint that works inside an organization; without it the request gets organization_header_required. Ignored with an API key, which belongs to exactly one organization.

x-test-mode
enum<string>
default:false

Whether a personal access token works on live data (false, the default) or on test data (true). Only this header decides, never a query string or a body field. An API key is itself a test or a live key and works on that data.

Available options:
true,
false

Body

application/json
vaultAddress
string
required

The RESTRICTED vault or table, from GET /vaults or GET /tables.

Response

This connection already has a live request for that vault or table: the same one, nothing new.

id
string
required

The request. GET /agent-step-ups/{stepUpId} reports its state.

url
string<uri>
required

The page in ROOTKey where the person approves or denies it. Give it to the person; it names nothing else.

expiresAt
string<date-time>
required

Until when the person can approve it; for an approval that is running, when it ends.