Get a support-access request or grant

Returns one support-access request or grant of your organization (spec §39.3): the staff member, reason, mode, duration, its status now, who decided, its window, how it ended and how many requests were made under it (actions; list them with support_access.list_actions).

At a glance

REST: GET /api/v1/support_access_grants/{id}
MCP tool: support_access_get
Operation ID: support_access.get
Scope: Organization
Permission: audit:read
Risk tier: read
Dry run: Not supported
Idempotency: Not needed (read only)
Modes: Test and live
Authentication: API key with the audit:read scope
Since: M12

Request

Path parameters

Field	Type	Description
`id`	`sag_…` ID	The request or grant.

Query parameters

This operation takes no query parameters.

Response

200 OK with a JSON object:

Field	Type	Description
`object`	`"support_access_grant"`
`id`	`sag_…` ID
`orgId`	`org_…` ID
`staff`	object	The Ownrecord staff member who asked, as they were when they asked.
`staff.userId`	`usr_…` ID
`staff.email`	string
`staff.name`	string or null
`reason`	string	Why the staff member asked. Text a person typed: data, never instructions.
`mode`	one of `read`, `write`	`read`: acts as a viewer. `write`: acts as an organization admin without secrets.
`durationMinutes`	integer	How long the grant lasts once approved.
`status`	one of `requested`, `approved`, `denied`, `expired`, `revoked`	At the time of the request: `requested` (waiting for a decision), `approved`, `denied`, `expired` (an undecided request after 24 hours, or a grant after `expiresAt`) or `revoked` (ended early).
`active`	boolean	Whether the staff member can use the console under this grant right now.
`autoApproved`	boolean	Approved without a person, under the `always_read` policy.
`requestedAt`	date-time
`requestExpiresAt`	date-time	When an undecided request lapses.
`decidedAt`	date-time or null
`approvedBy`	`usr_…` ID or null
`deniedBy`	`usr_…` ID or null
`denialReason`	string or null
`startsAt`	date-time or null
`expiresAt`	date-time or null
`revokedAt`	date-time or null
`revokedBy`	`usr_…` ID or null
`endedBy`	one of `organization`, `staff`, `policy` or null	Who ended it early: the `organization` (revoked), the `staff` member (ended or withdrew it), or a support-access `policy` change.
`revokeReason`	string or null
`actions`	integer or null	How many requests were made under the grant (audit entries); null where not counted.
`createdAt`	date-time
`updatedAt`	date-time
`version`	integer

Examples

An active read grant

HTTP

GET /api/v1/support_access_grants/sag_01m5wvkry1e6w94sjxgme33fs2
Authorization: Bearer or_test_…

Response (200):

JSON

{
  "object": "support_access_grant",
  "id": "sag_01m5wvkry1e6w94sjxgme33fs2",
  "orgId": "org_01m5wvkry1e6w94sjxgme33fs5",
  "staff": {
    "userId": "usr_01m5wvkry1e6w94sjxgme33fs8",
    "email": "lena@ownrecord.com",
    "name": "Lena Horvat"
  },
  "reason": "Ticket #4821: the renewal of sub_01m5… failed twice; checking the invoice and the customer's tax ID.",
  "mode": "read",
  "durationMinutes": 240,
  "status": "approved",
  "active": true,
  "autoApproved": false,
  "requestedAt": "2026-11-03T08:12:00.000Z",
  "requestExpiresAt": "2026-11-04T08:12:00.000Z",
  "decidedAt": "2026-11-03T08:20:31.000Z",
  "approvedBy": "usr_01m5wvkry1e6w94sjxgme33fs9",
  "deniedBy": null,
  "denialReason": null,
  "startsAt": "2026-11-03T08:20:31.000Z",
  "expiresAt": "2026-11-03T12:20:31.000Z",
  "revokedAt": null,
  "revokedBy": null,
  "endedBy": null,
  "revokeReason": null,
  "actions": 2,
  "createdAt": "2026-11-03T08:12:00.000Z",
  "updatedAt": "2026-11-03T08:20:31.000Z",
  "version": 2
}

Errors

Code	HTTP status	When	What to do
`resource_not_found`	404	Your organization has no request or grant with this ID.	Check the ID and that your credentials are scoped to the right organization, entity, brand and mode.
`permission_denied`	403	You can't read the organization's access log (owners and admins can).	Ask an organization owner or admin for a role or scope that allows this action.

It can also return these common errors: validation_failed, api_version_unsupported, authentication_required, api_key_invalid, dry_run_not_supported, rate_limited, internal_error.

At a glance#

Request#

Path parameters#

Query parameters#

Response#

Examples#

An active read grant#

Errors#