---
title: "Overview"
description: "This API keeps access requests together with their requested capability profiles, accepts intake submissions and scores how well each one matches an agent."
url: "https://nexora.apim.eu/apis/access-requests/docs/overview"
image: "https://nexora.apim.eu/_og/d/c_Ocean.takumi,title_Overview,description_~VGhpcyBBUEkga2VlcHMgYWNjZXNzIHJlcXVlc3RzIHRvZ2V0aGVyIHdpdGggdGhlaXIgcmVxdWVzdGVkIGNhcGFiaWxpdHkgcHJvZmlsZXMsIGFjY2VwdHMgaW50YWtlIHN1Ym1pc3Npb25zIGFuZCBzY29yZXMgaG93IHdlbGwgZWFjaCBvbmUgbWF0Y2hlcyBhbiBhZ2VudC4,props_eyJ0aGVtZSI6eyJtb2RlIjoiZGFyayIsImNvbG9ycyI6eyJwcmltYXJ5IjoiIzM5RkYxNCJ9fX0,p_Ii9hcGlzL2FjY2Vzcy1yZXF1ZXN0cy9kb2NzL292ZXJ2aWV3Ig,s_o2YcKV62ofmRll_Z.png"
---

# Overview

This API keeps access requests together with their requested capability profiles, accepts intake submissions and scores how well each one matches an agent.

## [Keeping the score traceable](#keeping-the-score-traceable)

Every score comes with more than just a number - it includes the individual criteria and their weight. That's deliberate: when a requester asks why they didn't get access, you can answer - and you'll notice yourself if a criterion like `security_review_passed` is systematically skewing the list.

| Points | Rating |
| :----- | :----- |
| 0-39   | low    |
| 40-69  | medium |
| 70-100 | high   |

## [Data protection is built in](#data-protection-is-built-in)

Every access request carries a `retention_until`. It's derived from the case at hand when the request is created and recomputed with every activity. Once it passes, name, team and contact details are removed overnight; the statistical attributes remain for reporting.

A `consent` is required. Without it the API rejects the create request with `400` - deliberately, since consent obtained after the fact is rarely something you can actually prove.

A deletion request is carried out immediately via `POST /access-requests/{id}/deletion`; it takes precedence over any retention deadline.

## [Scopes required](#scopes-required)

`access-requests:read` for querying, `access-requests:write` for maintaining and scoring.