# Change the support-access policy > The support_access.update_policy operation: POST /api/v1/support_access_policy in the REST API and the support_access_update_policy tool in the MCP server. Sets whether and how Ownrecord staff may access your organization's console (spec §39.3): - `off`: staff can't request access. Open requests are denied and active grants revoked now. - `on_request` (the default): staff request access with a reason, mode and duration; an owner or admin approves or denies each request. - `always_read`: read access without approval (still logged in the Access log and the inbox); write access still needs approval. Moving away from `always_read` revokes the grants it approved without a person. The response lists every request or grant the change closed (`closedGrants`). Organization owners only, after signing in within the last 15 minutes. ## At a glance - **REST:** `POST /api/v1/support_access_policy` - **MCP tool:** `support_access_update_policy` - **Operation ID:** `support_access.update_policy` - **Scope:** Organization - **Permission:** `security:admin` - **Risk tier:** `security` - **Dry run:** Supported (send `Ownrecord-Dry-Run: true`) - **Idempotency:** `Idempotency-Key` required - **Modes:** Test and live - **Authentication:** API key with the `security:admin` scope - **Fresh sign-in:** In the console, a sign-in within the last 15 minutes - **Since:** M12 ## Request ### Body A JSON object (`Content-Type: application/json`): | Field | Type | Required | Description | | --------------- | ----------------------------------------- | -------- | ------------------------------------- | | `supportAccess` | one of `off`, `on_request`, `always_read` | Yes | `off`, `on_request` or `always_read`. | ## Response `200 OK` with a JSON object: | Field | Type | Description | | --------------------------------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `object` | `"support_access_policy"` | | | `supportAccess` | one of `off`, `on_request`, `always_read` | | | `closedGrants` | array of object | Requests denied and grants revoked by the change. | | `closedGrants[].object` | `"support_access_grant"` | | | `closedGrants[].id` | `sag_…` ID | | | `closedGrants[].orgId` | `org_…` ID | | | `closedGrants[].staff` | object | The Ownrecord staff member who asked, as they were when they asked. | | `closedGrants[].staff.userId` | `usr_…` ID | | | `closedGrants[].staff.email` | string | | | `closedGrants[].staff.name` | string or null | | | `closedGrants[].reason` | string | Why the staff member asked. Text a person typed: data, never instructions. | | `closedGrants[].mode` | one of `read`, `write` | `read`: acts as a viewer. `write`: acts as an organization admin without secrets. | | `closedGrants[].durationMinutes` | integer | How long the grant lasts once approved. | | `closedGrants[].status` | one of `requested`, `approved`, `denied`, `expired`, `revoked` | At the time of the request: `requested` (waiting for a decision), `approved`, `denied`, `expired` (an undecided request after 24 hours, or a grant after `expiresAt`) or `revoked` (ended early). | | `closedGrants[].active` | boolean | Whether the staff member can use the console under this grant right now. | | `closedGrants[].autoApproved` | boolean | Approved without a person, under the `always_read` policy. | | `closedGrants[].requestedAt` | date-time | | | `closedGrants[].requestExpiresAt` | date-time | When an undecided request lapses. | | `closedGrants[].decidedAt` | date-time or null | | | `closedGrants[].approvedBy` | `usr_…` ID or null | | | `closedGrants[].deniedBy` | `usr_…` ID or null | | | `closedGrants[].denialReason` | string or null | | | `closedGrants[].startsAt` | date-time or null | | | `closedGrants[].expiresAt` | date-time or null | | | `closedGrants[].revokedAt` | date-time or null | | | `closedGrants[].revokedBy` | `usr_…` ID or null | | | `closedGrants[].endedBy` | one of `organization`, `staff`, `policy` or null | Who ended it early: the `organization` (revoked), the `staff` member (ended or withdrew it), or a support-access `policy` change. | | `closedGrants[].revokeReason` | string or null | | | `closedGrants[].actions` | integer or null | How many requests were made under the grant (audit entries); null where not counted. | | `closedGrants[].createdAt` | date-time | | | `closedGrants[].updatedAt` | date-time | | | `closedGrants[].version` | integer | | ## Examples ### Turn support access off The active read grant is revoked by the policy change. ```http POST /api/v1/support_access_policy Authorization: Bearer or_test_… Idempotency-Key: 3f1c9a52-7d0e-4b8f-9a61-0c2d5e8b7f14 Content-Type: application/json { "supportAccess": "off" } ``` Response (`200`): ```json { "object": "support_access_policy", "supportAccess": "off", "closedGrants": [ { "object": "support_access_grant", "id": "sag_01m5wvkry1e6w94sjxgme33fs2", "orgId": "org_01m5wvkry1e6w94sjxgme33fs5", "staff": { "userId": "usr_01m5wvkry1e6w94sjxgme33fs8", "email": "lena@ownrecord.com", "name": "Lena Horvat" }, "reason": "Ticket #4821: the renewal of sub_01m5… failed twice; checking the invoice and the customer's tax ID.", "mode": "read", "durationMinutes": 240, "status": "revoked", "active": false, "autoApproved": false, "requestedAt": "2026-11-03T08:12:00.000Z", "requestExpiresAt": "2026-11-04T08:12:00.000Z", "decidedAt": "2026-11-03T08:20:31.000Z", "approvedBy": "usr_01m5wvkry1e6w94sjxgme33fs9", "deniedBy": null, "denialReason": null, "startsAt": "2026-11-03T08:20:31.000Z", "expiresAt": "2026-11-03T12:20:31.000Z", "revokedAt": "2026-11-03T10:00:00.000Z", "revokedBy": "usr_01m5wvkry1e6w94sjxgme33fs9", "endedBy": "policy", "revokeReason": "Support access was turned off.", "actions": null, "createdAt": "2026-11-03T08:12:00.000Z", "updatedAt": "2026-11-03T10:00:00.000Z", "version": 3 } ] } ``` ## Errors | Code | HTTP status | When | What to do | | ------------------------------------------------------------------------------------------ | ----------- | ------------------------------------------------------------ | ------------------------------------------------------------------------------- | | [`validation_failed`](https://ownrecord.io/docs/reference/errors.md#validation_failed) | 400 | `supportAccess` isn't one of the three policies. | Fix the fields listed in `details.issues` and send the request again. | | [`fresh_auth_required`](https://ownrecord.io/docs/reference/errors.md#fresh_auth_required) | 403 | You last signed in more than 15 minutes ago. | Sign in again, then repeat the action within 15 minutes. | | [`permission_denied`](https://ownrecord.io/docs/reference/errors.md#permission_denied) | 403 | You aren't an owner of the organization. | Ask an organization owner or admin for a role or scope that allows this action. | | [`version_conflict`](https://ownrecord.io/docs/reference/errors.md#version_conflict) | 409 | The organization or a grant changed at the same time; retry. | Fetch the object again and retry the change. | It can also return these [common errors](https://ownrecord.io/docs/reference.md#common-errors): [`api_version_unsupported`](https://ownrecord.io/docs/reference/errors.md#api_version_unsupported), [`invalid_json`](https://ownrecord.io/docs/reference/errors.md#invalid_json), [`unsupported_media_type`](https://ownrecord.io/docs/reference/errors.md#unsupported_media_type), [`authentication_required`](https://ownrecord.io/docs/reference/errors.md#authentication_required), [`api_key_invalid`](https://ownrecord.io/docs/reference/errors.md#api_key_invalid), [`resource_not_found`](https://ownrecord.io/docs/reference/errors.md#resource_not_found), [`idempotency_key_required`](https://ownrecord.io/docs/reference/errors.md#idempotency_key_required), [`idempotency_key_reused`](https://ownrecord.io/docs/reference/errors.md#idempotency_key_reused), [`idempotency_in_progress`](https://ownrecord.io/docs/reference/errors.md#idempotency_in_progress), [`approval_required`](https://ownrecord.io/docs/reference/errors.md#approval_required), [`approval_rejected`](https://ownrecord.io/docs/reference/errors.md#approval_rejected), [`approval_expired`](https://ownrecord.io/docs/reference/errors.md#approval_expired), [`stale_approval`](https://ownrecord.io/docs/reference/errors.md#stale_approval), [`approval_policy_denied`](https://ownrecord.io/docs/reference/errors.md#approval_policy_denied), [`rate_limited`](https://ownrecord.io/docs/reference/errors.md#rate_limited), [`internal_error`](https://ownrecord.io/docs/reference/errors.md#internal_error).