Grant Consumer Access

Endpoint

POST /apiops/projects/{projectName}/consumers/{consumerKey}/access

Authentication

Requires a Personal API Access Token.

Authorization: Bearer YOUR_TOKEN

Request

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
consumerKey	string	Yes	Consumer key, assigned by the installation. Returned as consumerKey by every consumer response

Request Body

{
  "accessList": [
    {
      "name": "MyAPI",
      "type": "API_PROXY",
      "environments": [ { "environmentName": "production", "enabled": true } ],
      "disallowedEndpoints": [ { "name": "/orders", "httpMethod": "DELETE" } ]
    },
    {
      "name": "MyGroup",
      "type": "API_PROXY_GROUP",
      "expireTime": "2027-12-31T23:59:59.000Z",
      "disallowedApiProxies": ["BillingAPI"]
    }
  ]
}

Field	Type	Required	Description
accessList	array	Yes	Targets to change. An empty or missing list answers 400 malformedRequest (params.reason = accessListRequired)
accessList[].name	string	Yes	Name of an API proxy or API proxy group of the project
accessList[].type	string	Yes	API_PROXY or API_PROXY_GROUP
accessList[].expireTime	timestamp	No	Expiry of the grant. Used by grant
accessList[].environments	array	No	Environments to set, by name. Each item has environmentName and enabled. An environment you do not list stays enabled
accessList[].disallowedEndpoints	array	No	API_PROXY rows only. Endpoints the consumer may not call. Each item has name and httpMethod
accessList[].disallowedApiProxies	array of string	No	API_PROXY_GROUP rows only. Names of API proxies of the group that the consumer may not call

An entry without name or type answers 400 malformedRequest (params.reason = nameAndTypeRequired). An environment entry without environmentName answers 400 malformedRequest (params.reason = environmentNameRequired). A restriction on the wrong row type answers 400 malformedRequest: disallowedEndpoints on a group row (params.reason = apiProxyOnly), or disallowedApiProxies on an API proxy row (params.reason = apiProxyGroupOnly).

Response

200 OK as a write response. result is the access list of the consumer after the grant.

Errors

Status	Error key	Cause
404	resourceNotFound	A target is unknown in the project
404	resourceNotFound	An environment, an endpoint or a restricted API proxy is unknown. params.reason is environmentNotFound, endpointNotFound or apiProxyNotInGroup (the API proxy is not a member of the group)
409	lifecycleConflict	A target is already granted (params.reason = accessAlreadyGranted)

Warning

The targets are applied in order. A refusal leaves the targets before it granted. On a retry, send only the remaining targets.

cURL Example

curl -X POST \
  "https://demo.apinizer.com/apiops/projects/MyProject/consumers/CONSUMER_KEY/access" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "accessList": [ { "name": "MyAPI", "type": "API_PROXY" } ] }'

Permissions

• User must have IDENTITY + MANAGE permission in the project
• A project outside the scope of the caller answers 404 resourceNotFound, never 403
• The admin project has no consumers: a call on it answers 400 malformedRequest (params.reason = platformScopeNotSupported)