Approve an access request

POST/workspaces/{workspace}/access-requests/{accessRequest}/approve

Shares some or all of the requested documents. The requester is emailed a private link that works until access ends (your access_days setting). A request can only be decided once.

Authentication

Send an API token as a bearer token. This endpoint needs a read and write token, made by an editor, admin or owner. Create one in My account → API tokens; see scopes and roles.

Authorization: Bearer 42|bynh_pat_•••••••Header

Path parameters

workspacestringRequired
Your workspace slug, e.g. dokan.
accessRequestintegerRequired
Access request id.

Request body

application/json

document_idsstringRequired
1–50 distinct ids, all from this request. NDA documents need a signed NDA.

Response

200 OK

Request detail.

idintegerAccess request id.
companystringCompany.
requester{name, title, email}Who asked.
notestring|nullTheir note.
nda_signedbooleanSigned your NDA.
statusenumDecision state (use access_expires_at to tell if access has ended). One of pending, approved, declined.
access_expires_atstring|nullISO 8601.
access_daysintegerWorkspace setting: how long approved access lasts.
documents[]objectid, title, pages, visibility, visibility_label, granted.
activity[]{at, text}Localized timeline, oldest first.
created_atstringISO 8601.

Rate limits

This endpoint counts toward your general limit of 120 requests a minute. When you go over, wait for the number of seconds in Retry-After.

Errors

401The token is missing, wrong, revoked or expired.

403The token is read-only (message: “This token is read-only. Create a read and write token to make changes.”). Or: The token’s owner is a viewer (“Viewers can read everything but can’t change it.”), or the workspace’s editing is paused (a billing message, e.g. “Your trial has ended, so editing is paused. …”).

404The token belongs to another workspace, or its owner is no longer a member.

422“Pick at least one document to share.”, “Pick documents from this request.”, “Wait for them to sign your NDA before sharing NDA documents.”, or “This request was already decided.” (errors.status).

Every error is JSON with a message. See Errors.

Next →Decline an access request

curl -X POST "https://api.bynh.io/api/v1/workspaces/dokan/access-requests/1/approve" \
  -H "Authorization: Bearer $BYNH_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
    "document_ids": [
      412,
      415
    ]
  }'

Response200 OK

application/json

{
  "data": {
    "id": 88,
    "company": "Almarai Retail",
    "requester": {
      "name": "Noura Alsaud",
      "title": "Head of vendor risk",
      "email": "noura@almarai-retail.sa"
    },
    "note": "Annual supplier review.",
    "nda_signed": true,
    "status": "approved",
    "access_expires_at": "2026-10-31T08:15:00+00:00",
    "access_days": 30,
    "documents": [
      {
        "id": 412,
        "title": "ISO 27001 certificate 2025",
        "pages": 2,
        "visibility": "nda",
        "visibility_label": "Behind NDA",
        "granted": true
      },
      {
        "id": 415,
        "title": "SOC 2 Type II report",
        "pages": 64,
        "visibility": "nda",
        "visibility_label": "Behind NDA",
        "granted": true
      }
    ],
    "activity": [
      {
        "at": "2026-09-30T13:22:05+00:00",
        "text": "Request sent from trust.dokan.sa"
      },
      {
        "at": "2026-09-30T13:24:40+00:00",
        "text": "Mutual NDA signed · v2"
      },
      {
        "at": "2026-10-01T08:15:00+00:00",
        "text": "Shared by Sara Alqahtani"
      }
    ],
    "created_at": "2026-09-30T13:22:05+00:00"
  }
}

Examples use Dokan, a sample workspace. Responses are shortened where lists are long.