---
title: "Log an access request"
url: "https://nexora.apim.eu/apis/access-requests/versions/85552175-ec5d-4510-b24d-c293a66d9945/operations/logRequest"
---

> Full API specification: https://nexora.apim.eu/apis/access-requests/versions/85552175-ec5d-4510-b24d-c293a66d9945.md

# Log an access request

`POST` `/requests`

Operation ID: `logRequest`

Typically called from the internal service catalog's request form.

## Request body (required)

Content types: `application/json`

## Responses

- `201` - Logged
- `400` - The request doesn't match the schema

## OpenAPI definition

```yaml
openapi: 3.0.3
info:
  title: Access & Onboarding Requests
  version: 1.0.0
servers:
  - url: https://api.nexora.example/v1
    description: Production
  - url: https://sandbox.api.nexora.example/v1
    description: Sandbox
paths:
  /requests:
    post:
      tags:
        - Requests
      summary: Log an access request
      description: Typically called from the internal service catalog's request form.
      operationId: logRequest
      security:
        - apiKey: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessRequestInput"
            example:
              requester_first_name: Anna
              requester_last_name: Bergmann
              email: a.bergmann@nexora.example
              business_unit: Revenue Operations
              consent:
                purpose: access_grant
                granted_at: 2026-08-18T10:22:00Z
              requested_capability_profile:
                agent_categories:
                  - copilot
                  - workflow-agent
                business_units:
                  - Revenue Operations
                min_integration_count: 3
                max_cost_per_1k_tokens_usd: 0.02
                requires_compliance_certification: true
      responses:
        "201":
          description: Logged
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AccessRequest"
        "400":
          $ref: "#/components/responses/ValidationError"
security:
  - apiKey: []
components:
  schemas:
    AccessRequestInput:
      type: object
      required:
        - requester_last_name
        - email
        - consent
      properties:
        requester_first_name:
          type: string
          example: Anna
        requester_last_name:
          type: string
          example: Bergmann
        email:
          type: string
          format: email
          example: a.bergmann@nexora.example
        business_unit:
          type: string
          example: Revenue Operations
        consent:
          $ref: "#/components/schemas/Consent"
        requested_capability_profile:
          $ref: "#/components/schemas/CapabilityProfile"
    AccessRequest:
      allOf:
        - $ref: "#/components/schemas/AccessRequestInput"
        - type: object
          properties:
            id:
              type: string
              example: req_71ab
            status:
              $ref: "#/components/schemas/RequestStatus"
            retention_until:
              type: string
              format: date
              description: Automatically set deletion deadline. Anonymized after it passes.
              example: 2027-02-18
            created_at:
              type: string
              format: date-time
              example: 2026-08-18T10:22:04Z
    Consent:
      type: object
      description: Record of consent under applicable data protection policy.
      required:
        - purpose
        - granted_at
      properties:
        purpose:
          type: string
          enum:
            - access_grant
            - product_updates
        granted_at:
          type: string
          format: date-time
          example: 2026-08-18T10:22:00Z
        revoked_at:
          type: string
          format: date-time
          nullable: true
          example: null
    CapabilityProfile:
      type: object
      properties:
        agent_categories:
          type: array
          items:
            type: string
            enum:
              - copilot
              - autonomous-agent
              - workflow-agent
              - rag-assistant
              - voice-agent
        business_units:
          type: array
          items:
            type: string
            example: Revenue Operations
        min_integration_count:
          type: number
          format: float
          example: 3
        min_tool_count:
          type: number
          format: float
          example: 2
        max_cost_per_1k_tokens_usd:
          type: number
          format: float
          example: 0.02
        max_monthly_budget_usd:
          type: integer
          example: 4000
        requires_compliance_certification:
          type: boolean
          example: true
    RequestStatus:
      type: string
      enum:
        - new
        - scored
        - invited
        - declined
        - closed
      example: scored
    Error:
      type: object
      description: Uniform error format across all Nexora AI APIs.
      required:
        - code
        - message
      properties:
        code:
          type: string
          example: validation_failed
        message:
          type: string
          example: Consent is required to log an access request.
        details:
          type: array
          items:
            $ref: "#/components/schemas/ErrorDetail"
    ErrorDetail:
      type: object
      properties:
        field:
          type: string
          example: consent.purpose
        reason:
          type: string
          example: missing
  responses:
    ValidationError:
      description: The request doesn't match the schema
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/Error"
  securitySchemes:
    apiKey:
      type: apiKey
      in: header
      name: apikey
      description: |
        Every call carries an API key in the `apikey` header. You generate the
        key in the Nexora AI portal under "My Apps"; it's shown exactly once.

        Each key has the scopes it's allowed to use attached to it. If one is
        missing, the API responds with `403` and `code: "scope_missing"`; the
        missing scope is in `details[].field`.
```