Overview

This API keeps access requests together with their requested capability profiles, accepts intake submissions and scores how well each one matches an agent.

Keeping the score traceable

Every score comes with more than just a number - it includes the individual criteria and their weight. That's deliberate: when a requester asks why they didn't get access, you can answer - and you'll notice yourself if a criterion like security_review_passed is systematically skewing the list.

Data protection is built in

Every access request carries a retention_until. It's derived from the case at hand when the request is created and recomputed with every activity. Once it passes, name, team and contact details are removed overnight; the statistical attributes remain for reporting.

A consent is required. Without it the API rejects the create request with 400 - deliberately, since consent obtained after the fact is rarely something you can actually prove.

A deletion request is carried out immediately via POST /access-requests/{id}/deletion; it takes precedence over any retention deadline.

Scopes required

access-requests:read for querying, access-requests:write for maintaining and scoring.