Request support access to an organization

Asks an organization for time-boxed access to its console, for Ownrecord platform support staff (spec §39.3). Platform roles never see an organization's customers, invoices, ledger or settings by themselves: a support-access grant is the only way in, and every request made under it is in the organization's audit log and Access log.

Give a reason (the organization sees it), a mode — read acts as a viewer, write as an organization admin without secrets (no API keys, processor keys, members or security settings) — and a duration of 15 to 1440 minutes (24 hours).

What happens depends on the organization's support-access policy:

• on_request (the default): the request waits for an owner or admin (support_access.approve). An undecided request lapses after 24 hours.
• always_read: a read request is approved on the spot (autoApproved: true) and starts now. A write request still needs approval.
• off: refused with support_access_disabled.

Either way the organization gets one SUPPORT_ACCESS_REQUESTED alert (live mode, info) in its inbox, and its owners and admins get Ownrecord's "support access requested" security email with the reason and the link to the request in Security → Access log.

One open request or grant per staff member and organization. The grant starts when it is approved and ends after the duration, when the organization revokes it, or when you end it (support_access.end).

At a glance#

• REST: POST /api/v1/platform/support_access_grants
• MCP tool: support_access_request
• Operation ID: support_access.request
• Scope: Platform
• Permission: platform:support_access
• Risk tier: write
• Dry run: Supported (send Ownrecord-Dry-Run: true)
• Idempotency: Idempotency-Key required
• Modes: Test and live
• Authentication: API key with the platform:support_access scope
• Since: M12

Request#

Body#

A JSON object (Content-Type: application/json):

Response#

201 Created with a JSON object:

Examples#

Ask for four hours of read access#

Under the default on_request policy the request waits for an owner or admin.

POST /api/v1/platform/support_access_grants
Authorization: Bearer or_test_…
Idempotency-Key: 3f1c9a52-7d0e-4b8f-9a61-0c2d5e8b7f14
Content-Type: application/json

{
  "orgId": "org_01m5wvkry1e6w94sjxgme33fs5",
  "reason": "Ticket #4821: the renewal of sub_01m5… failed twice; checking the invoice and the customer's tax ID.",
  "mode": "read",
  "durationMinutes": 240
}

Response (201):

{
  "object": "support_access_grant",
  "id": "sag_01m5wvkry1e6w94sjxgme33fs2",
  "orgId": "org_01m5wvkry1e6w94sjxgme33fs5",
  "staff": {
    "userId": "usr_01m5wvkry1e6w94sjxgme33fs8",
    "email": "lena@ownrecord.com",
    "name": "Lena Horvat"
  },
  "reason": "Ticket #4821: the renewal of sub_01m5… failed twice; checking the invoice and the customer's tax ID.",
  "mode": "read",
  "durationMinutes": 240,
  "status": "requested",
  "active": false,
  "autoApproved": false,
  "requestedAt": "2026-11-03T08:12:00.000Z",
  "requestExpiresAt": "2026-11-04T08:12:00.000Z",
  "decidedAt": null,
  "approvedBy": null,
  "deniedBy": null,
  "denialReason": null,
  "startsAt": null,
  "expiresAt": null,
  "revokedAt": null,
  "revokedBy": null,
  "endedBy": null,
  "revokeReason": null,
  "actions": null,
  "createdAt": "2026-11-03T08:12:00.000Z",
  "updatedAt": "2026-11-03T08:12:00.000Z",
  "version": 1,
  "org": {
    "slug": "acme",
    "name": "Acme"
  }
}

Errors#

It can also return these common errors: api_version_unsupported, invalid_json, unsupported_media_type, authentication_required, api_key_invalid, idempotency_key_required, idempotency_key_reused, idempotency_in_progress, rate_limited, internal_error.