List access requests

GET/workspaces/{workspace}/access/requests

Returns requests for your private documents, newest first, 25 per page, with counts for each state.

Authentication

Send an API token as a bearer token. This endpoint needs a read token, made by any member of the workspace. Create one in My account → API tokens; see scopes and roles.

Authorization: Bearer 42|bynh_pat_•••••••Header

Path parameters

workspacestringRequired
Your workspace slug, e.g. dokan.

Query parameters

statusenumdefault all
approved means access is still live. One of all, waiting, approved, declined, ended.
qstring
Searches name, email and company (max 120).
pageintegerdefault 1
Page number.

Response

200 OK

25 per page; meta {counts {all, waiting, approved, declined, ended}, page, last_page, total, approved_domains, access_days}. No links.

idintegerAccess request id.
requester{name, email, title}Who asked.
personal_emailbooleanEmail is from a personal provider (e.g. gmail.com).
companystringCompany.
documents[]{id, title}Documents asked for.
documents_labelstringTitles joined, or “All private documents”.
all_documentsbooleanAsked for every requestable document (more than 2).
reasonstring|nullLocalized reason label (Vendor review, Procurement, Audit, Due diligence, Contract renewal, Something else).
notestring|nullRequester’s note.
nda_signedbooleanSigned your NDA.
nda_versionstring|nullNDA version signed.
stateenumended: approved but revoked or past access_expires_at. One of waiting, approved, declined, ended.
auto_approvedbooleanApproved by an approved email domain.
decided_bystring|nullName.
decided_atstring|nullISO 8601.
access_expires_atstring|nullISO 8601.
revoked_atstring|nullISO 8601.
revoked_bystring|nullName.
inbox_item_idinteger|nullLinked inbox item (list only; null on revoke).
created_atstringISO 8601.

Rate limits

This endpoint counts toward your general limit of 120 requests a minute. When you go over, wait for the number of seconds in Retry-After.

Errors

401The token is missing, wrong, revoked or expired.

404The token belongs to another workspace, or its owner is no longer a member.

422Bad status, q or page.

Every error is JSON with a message. See Errors.

Next →Export access requests as CSV

curl "https://api.bynh.io/api/v1/workspaces/dokan/access/requests?status=waiting" \
  -H "Authorization: Bearer $BYNH_TOKEN" \
  -H "Accept: application/json"

Response200 OK

application/json

{
  "data": [
    {
      "id": 88,
      "requester": {
        "name": "Noura Alsaud",
        "email": "noura@almarai-retail.sa",
        "title": "Head of vendor risk"
      },
      "personal_email": false,
      "company": "Almarai Retail",
      "documents": [
        {
          "id": 412,
          "title": "ISO 27001 certificate 2025"
        },
        {
          "id": 415,
          "title": "SOC 2 Type II report"
        }
      ],
      "documents_label": "ISO 27001 certificate 2025, SOC 2 Type II report",
      "all_documents": false,
      "reason": "Vendor review",
      "note": "Annual supplier review.",
      "nda_signed": true,
      "nda_version": "v2",
      "state": "waiting",
      "auto_approved": false,
      "decided_by": null,
      "decided_at": null,
      "access_expires_at": null,
      "revoked_at": null,
      "revoked_by": null,
      "inbox_item_id": 502,
      "created_at": "2026-09-30T13:22:05+00:00"
    }
  ],
  "meta": {
    "counts": {
      "all": 64,
      "waiting": 1,
      "approved": 12,
      "declined": 3,
      "ended": 48
    },
    "page": 1,
    "last_page": 3,
    "total": 64,
    "approved_domains": 4,
    "access_days": 30
  }
}

Examples use Dokan, a sample workspace. Responses are shortened where lists are long.