Grant Access

Deprecated

This operation is deprecated. It still works. Use the successor operation of the Consumers API instead.

Every response of this operation carries a Deprecation: @1792368000 header and a Link header whose rel is successor-version:

Link: </apiops/projects/{projectName}/consumers>; rel="successor-version"

Endpoint

PUT /apiops/projects/{projectName}/credentials/{username}/access/

Authentication

Requires a Personal API Access Token.

Header

Authorization: Bearer YOUR_TOKEN

Request

Headers

Header	Value	Required
Authorization	Bearer {token}	Yes
Content-Type	application/json	Yes

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
username	string	Yes	Username of the consumer

Request Body

Full JSON Body Example - Grant Access to Single API Proxy

{
  "credentialAccessList": [
    {
      "name": "MyAPI",
      "type": "API_PROXY"
    }
  ]
}

Full JSON Body Example - Grant Access to Multiple Resources

{
  "credentialAccessList": [
    {
      "name": "MyAPI",
      "type": "API_PROXY"
    },
    {
      "name": "PaymentAPI",
      "type": "API_PROXY"
    },
    {
      "name": "MyAPIGroup",
      "type": "API_PROXY_GROUP"
    }
  ]
}

Full JSON Body Example - Grant Access with Expiration

{
  "credentialAccessList": [
    {
      "name": "MyAPI",
      "type": "API_PROXY",
      "expireTime": "2024-12-31T23:59:59.000Z"
    },
    {
      "name": "MyAPIGroup",
      "type": "API_PROXY_GROUP",
      "expireTime": "2025-06-30T23:59:59.000Z"
    }
  ]
}

Request Body Fields

The request body is an object containing an array of access objects.

Access Object

Field	Type	Required	Description
name	string	Yes	Name of the API Proxy or API Proxy Group
type	string	Yes	Type of access. See EnumAccessType
expireTime	string|null	No	Expiration time in ISO 8601 format (e.g., "2024-12-31T23:59:59.000Z"). If not provided or null, access does not expire

EnumAccessType

• API_PROXY - Grant access to a specific API Proxy
• API_PROXY_GROUP - Grant access to an API Proxy Group

Request Body Object

Field	Type	Required	Description
credentialAccessList	array	Yes	Array of access objects

Notes

• Request body must be an object with credentialAccessList array (even for single access)
• Each access object must have name and type
• name must match an existing API Proxy or API Proxy Group
• type must be either API_PROXY or API_PROXY_GROUP
• expireTime is optional. If provided, access expires at the specified time. Use ISO 8601 format (UTC)
• Cannot grant access that already exists
• Access is automatically deployed to all environments

Response

Success Response (200 OK)

{
  "status": "SUCCESS",
  "deploymentResult": {
    "success": true,
    "message": "Deployment completed successfully",
    "environmentResults": [
      {
        "environmentName": "production",
        "success": true,
        "message": "Deployed successfully"
      },
      {
        "environmentName": "staging",
        "success": true,
        "message": "Deployed successfully"
      }
    ]
  }
}

Error Response (400 Bad Request)

{
  "status": "FAILURE",
  "resultMessage": "Credential access object name can not be empty!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "Credential access object type can not be empty!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "API Proxy (name:MyAPI) is not found or user does not have privilege to access it!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "Credential (username:api-user) has already access to API Proxy (name:MyAPI)!"
}

Common Causes

• Empty access object
• Missing name or type field
• API Proxy or API Proxy Group does not exist
• Access already granted
• Invalid access type

Error Response (401 Unauthorized)

{
  "status": "FAILURE",
  "resultMessage": "Token is not valid!"
}

cURL Example

Example 1: Grant Access to Single API Proxy

curl -X PUT \
  "https://demo.apinizer.com/apiops/projects/MyProject/credentials/api-user/access/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "credentialAccessList": [
      {
        "name": "MyAPI",
        "type": "API_PROXY"
      }
    ]
  }'

Example 2: Grant Access to Multiple Resources

curl -X PUT \
  "https://demo.apinizer.com/apiops/projects/MyProject/credentials/api-user/access/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "credentialAccessList": [
      {
        "name": "MyAPI",
        "type": "API_PROXY"
      },
      {
        "name": "MyAPIGroup",
        "type": "API_PROXY_GROUP"
      }
    ]
  }'

Example 3: Grant Access with Expiration

curl -X PUT \
  "https://demo.apinizer.com/apiops/projects/MyProject/credentials/api-user/access/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "credentialAccessList": [
      {
        "name": "MyAPI",
        "type": "API_PROXY",
        "expireTime": "2024-12-31T23:59:59.000Z"
      }
    ]
  }'

Notes and Warnings

• Request Body Format:

  • Request body must be an object with credentialAccessList array
  • Even for single access, use object format with array inside

• Access Validation:

  • API Proxy or API Proxy Group must exist
  • Must be within the project scope

• Duplicate Access:

  • Cannot grant access that already exists
  • Check existing access before granting

• Automatic Deployment:

  • Access is automatically deployed to all environments
  • Deployment results are returned in the response

• API Proxy Group:

  • Granting access to API Proxy Group grants access to all APIs in the group
  • More efficient than granting access to individual APIs

• Expiration Time:

  • expireTime is optional and can be set per access entry
  • Use ISO 8601 format (UTC): "YYYY-MM-DDTHH:mm:ss.sssZ"
  • If not provided or null, access does not expire
  • Expired access is automatically revoked
  • Each access entry can have its own expiration time

Permissions

• User must have IDENTITY + MANAGE permission in the project
• For automatic deployment, user must also have IDENTITY + DEPLOY_UNDEPLOY permission

Related Documentation

• Get Granted Access List - Get list of granted accesses
• Revoke Access - Revoke access from API Proxy or Group
• List Credentials - List all consumers