> ## Documentation Index
> Fetch the complete documentation index at: https://docs.octavehq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Grant Asset Access Request

> Grant a pending access request: mints a fresh single-recipient, never-expiring share link for the requester's email and marks the request granted. NO email is sent — forward the returned share.url to the requester yourself (it also stays readable via List Asset Shares, so a lost link is recoverable). An already-granted request fails with 409. To take access back later, revoke the granted share with Revoke Asset Share.



## OpenAPI

````yaml post /api/v2/asset/access-requests/grant
openapi: 3.0.0
info:
  version: 1.0.0
  title: Octave API
  description: API for Octave workspace management and AI-powered content generation
servers:
  - url: https://app.octavehq.com
security:
  - ApiKeyAuth: []
paths:
  /api/v2/asset/access-requests/grant:
    post:
      tags:
        - Asset
      summary: Grant Asset Access Request
      description: >-
        Grant a pending access request: mints a fresh single-recipient,
        never-expiring share link for the requester's email and marks the
        request granted. NO email is sent — forward the returned share.url to
        the requester yourself (it also stays readable via List Asset Shares, so
        a lost link is recoverable). An already-granted request fails with 409.
        To take access back later, revoke the granted share with Revoke Asset
        Share.
      operationId: grantAccessRequest
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                uuid:
                  type: string
                  description: >-
                    UUID of the asset the request targets — the artifact.uuid on
                    an asset_access_requests_list entry. e.g.
                    '4f1e2a90-8b3d-4c21-9e07-2a1b3c4d5e6f'
                requestId:
                  type: integer
                  description: >-
                    Numeric id of the access request, from
                    asset_access_requests_list. e.g. 5
              required:
                - uuid
                - requestId
      responses:
        '200':
          description: Asset access request granted successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  _metadata:
                    $ref: '#/components/schemas/Metadata'
                  data:
                    type: object
                    properties:
                      request:
                        type: object
                        properties:
                          id:
                            type: number
                            description: >-
                              Numeric id of the access request — pass it to
                              asset_access_request_grant /
                              asset_access_request_dismiss. e.g. 5
                          email:
                            type: string
                            description: >-
                              Requester's email, code-verified before the
                              request was created. e.g. 'sam@acme.com'
                          message:
                            type: string
                            nullable: true
                            description: >-
                              Optional note the requester attached; null when
                              none. e.g. 'Need this for our vendor review'
                          status:
                            type: string
                            enum:
                              - pending
                              - granted
                              - dismissed
                            description: >-
                              Request state. One of: pending (awaiting a
                              decision), granted (a share link was minted),
                              dismissed ('not now' — a re-request returns it to
                              pending). e.g. 'pending'
                          createdAt:
                            type: string
                            description: >-
                              ISO-8601 creation time. e.g.
                              '2026-07-10T09:00:00.000Z'
                          updatedAt:
                            type: string
                            description: >-
                              ISO-8601 time of the last state change. e.g.
                              '2026-07-11T14:30:00.000Z'
                        required:
                          - id
                          - email
                          - message
                          - status
                          - createdAt
                          - updatedAt
                        description: The request, now status 'granted'.
                      share:
                        type: object
                        properties:
                          uuid:
                            type: string
                            description: >-
                              Share link UUID — the id used by asset_share_*
                              tools. e.g. 'a1b2c3d4-5e6f-7081-92a3-b4c5d6e7f809'
                          url:
                            type: string
                            description: >-
                              The share URL embedding the link token. Always
                              present here, and re-readable later via
                              asset_shares_list. e.g.
                              'https://sites.octave.app/s/eyJ...'
                          access:
                            type: string
                            enum:
                              - allowlist
                              - anyone
                            description: >-
                              The link's gate. 'allowlist' (the default) makes a
                              viewer prove an allowlisted email — or a mailbox
                              at an allowlisted domain — with a one-time code,
                              and attributes the visit to them. 'anyone' means
                              holding the link IS the credential: no check, and
                              the visit is counted but attributed to nobody.
                              e.g. 'allowlist'
                          expiresAt:
                            type: string
                            nullable: true
                            description: >-
                              ISO-8601 expiry; null means it never expires. e.g.
                              '2026-08-06T00:00:00.000Z'
                          emails:
                            type: array
                            items:
                              type: string
                            description: >-
                              Allowlisted exact recipient emails. e.g.
                              ['sam@acme.com']
                          domains:
                            type: array
                            items:
                              type: string
                            description: >-
                              Allowlisted domains — any verified mailbox at
                              these gets access. e.g. ['acme.com']
                          createdAt:
                            type: string
                            description: >-
                              ISO-8601 creation time. e.g.
                              '2026-07-06T09:00:00.000Z'
                        required:
                          - uuid
                          - url
                          - access
                          - expiresAt
                          - emails
                          - domains
                          - createdAt
                        description: >-
                          The share link minted for the requester —
                          single-recipient, never-expiring. Its url stays
                          readable via asset_shares_list.
                    required:
                      - request
                      - share
                required:
                  - _metadata
                  - data
        '400':
          description: Invalid request
          content:
            application/json:
              schema:
                type: object
                properties:
                  _metadata:
                    $ref: '#/components/schemas/Metadata'
                required:
                  - _metadata
      deprecated: false
components:
  schemas:
    Metadata:
      type: object
      properties:
        usage:
          type: number
          default: 0
          example: 0
          description: API usage
        requestId:
          type: string
          example: requestId
          description: Request ID
        message:
          type: string
          example: message
          description: Message
        timestamp:
          type: string
          example: '2021-01-01T00:00:00.000Z'
          description: Timestamp
      required:
        - requestId
        - timestamp
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: api_key

````