CloudrawAPI v0
Menu

API reference

Just-in-time access

Requests for temporary access, their approval, and active grants.

List temporary access grants

GET/v0/tenants/{tenant_id}/jit-grants

read-only token

Returns grants created by approved requests: active ones and those that ended (revoked or expired). Not paginated.

Token: read-only or full access · Created by: owner or security admin

Path parameters

  • tenant_idstringrequired

    Your workspace id (Settings → Workspace in the console; it is also in every console URL).

    Example: tq7x2m9k4ab

Query parameters

  • statestring

    Only grants in this state.

    Example: active

Responses

200 The grants.

application/json

  • itemsarray of JitGrantrequired
    items fields
    • idstringrequired
    • request_idstringrequired
    • kindstring

      One of: person, vendor.

    • subjectobject
      subject fields
      • namestring
      • emailstring | null
      • vendorstring | null
    • connection_idstringrequired
    • resource_namestring
    • approverstring | null
    • window_hoursinteger
    • started_atstring (date-time)
    • expires_atstring (date-time)required
    • statestringrequired

      revoke_pending = no longer usable from Cloudraw's side; removal is being retried.

      One of: active, revoke_pending, revoked, expired.

    • recordingboolean

      Recording was requested for this grant (stored; see controls_enforcement).

    • mfaboolean

      A second step was required for this grant (stored; see controls_enforcement).

    • ended_atstring | null (date-time)
    • ended_reasonstring | null
    • device_idstring | null

      Person grants: the device that gets access.

    • claimed_atstring | null (date-time)
    • claim_pendingboolean

      Vendor grants: the vendor has not yet claimed their one-time credential.

    • controls_enforcementobject

      stored = the setting is recorded but not enforced yet.

      controls_enforcement fields
      • recordingstring
      • mfastring
  • next_cursorstring | null

    Opaque cursor for the next page; null on the last page.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-role tenant-assertion-mismatch

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 tenant-not-found

tenant-not-found: No workspace with this id.

curl
curl -sS -X GET "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"
PowerShell
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Get -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants" -Headers $headers
Python
import os, uuid, requests

r = requests.get(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.json())
Node.js
const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());
Response 200 · application/json
{
  "items": [
    {
      "id": "jg_3m0x9k2s8d",
      "request_id": "jr_5x8k2m0s9d",
      "subject": {
        "name": "Noa Peretz",
        "email": "noa.peretz@example.org",
        "vendor": "Contoso Systems"
      },
      "connection_id": "cx9m2v7d1pa",
      "resource_name": "erp-db",
      "approver": "dana.levi@example.com",
      "window_hours": 4,
      "started_at": "2026-10-13T09:30:00.000Z",
      "expires_at": "2026-10-13T13:30:00.000Z",
      "state": "active",
      "recording": true,
      "mfa": true,
      "ended_at": null,
      "ended_reason": null,
      "kind": "vendor",
      "device_id": null,
      "claimed_at": null,
      "claim_pending": true,
      "controls_enforcement": {
        "recording": "stored",
        "mfa": "stored"
      }
    }
  ],
  "next_cursor": null
}

Revoke a temporary access grant

DELETE/v0/tenants/{tenant_id}/jit-grants/{grant_id}

full-access token

Ends an active grant now: its access is removed and, for a supplier, the single-use identity is deleted. If the removal cannot be confirmed at once, the grant is already unusable from Cloudraw's side, shows revoke_pending, and removal is retried automatically; the answer then has state: pending and error: "revoke_pending". Audited and raises an alert.

Token: full access · Created by: owner

Path parameters

  • tenant_idstringrequired

    Your workspace id (Settings → Workspace in the console; it is also in every console URL).

    Example: tq7x2m9k4ab

  • grant_idstringrequired

    Grant id.

    Example: jg_3m0x9k2s8d

Responses

202 Revoked (done) or being retried (pending).

application/json

  • idstringrequired
  • tenant_idstring
  • statestringrequired

    One of: pending, running, done, failed.

  • result_uristring | null
  • errorobject | string | null

    Why it failed, or a short status note (e.g. revoke_pending).

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 grant-not-found tenant-not-found

grant-not-found: No grant with this id.

tenant-not-found: No workspace with this id.

409 grant-not-active

grant-not-active: The grant already ended.

502 revoke-failed

revoke-failed: Unexpected failure; retry.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl
curl -sS -X DELETE "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants/jg_3m0x9k2s8d" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"
PowerShell
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Delete -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants/jg_3m0x9k2s8d" -Headers $headers
Python
import os, uuid, requests

r = requests.delete(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants/jg_3m0x9k2s8d",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.status_code)
Node.js
const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants/jg_3m0x9k2s8d", {
  method: "DELETE",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(res.status);
Response 202 · application/json
{
  "id": "task_8k2x0m9s1d",
  "tenant_id": "tq7x2m9k4ab",
  "state": "done",
  "result_uri": null,
  "error": null
}

Extend a temporary access grant

POST/v0/tenants/{tenant_id}/jit-grants/{grant_id}/extend

full-access token

Moves an active grant's expiry later. The total length, counted from started_at, can never exceed the JIT policy max_window_hours (itself at most 24 hours). Audited.

Token: full access · Created by: owner

Path parameters

  • tenant_idstringrequired

    Your workspace id (Settings → Workspace in the console; it is also in every console URL).

    Example: tq7x2m9k4ab

  • grant_idstringrequired

    Grant id.

    Example: jg_3m0x9k2s8d

Request body application/json

  • add_hoursinteger

    Hours to add, 1-24. Default 1.

    Range: 1–24.

Responses

200 The grant with its new expires_at.

application/json

  • idstringrequired
  • request_idstringrequired
  • kindstring

    One of: person, vendor.

  • subjectobject
    subject fields
    • namestring
    • emailstring | null
    • vendorstring | null
  • connection_idstringrequired
  • resource_namestring
  • approverstring | null
  • window_hoursinteger
  • started_atstring (date-time)
  • expires_atstring (date-time)required
  • statestringrequired

    revoke_pending = no longer usable from Cloudraw's side; removal is being retried.

    One of: active, revoke_pending, revoked, expired.

  • recordingboolean

    Recording was requested for this grant (stored; see controls_enforcement).

  • mfaboolean

    A second step was required for this grant (stored; see controls_enforcement).

  • ended_atstring | null (date-time)
  • ended_reasonstring | null
  • device_idstring | null

    Person grants: the device that gets access.

  • claimed_atstring | null (date-time)
  • claim_pendingboolean

    Vendor grants: the vendor has not yet claimed their one-time credential.

  • controls_enforcementobject

    stored = the setting is recorded but not enforced yet.

    controls_enforcement fields
    • recordingstring
    • mfastring
400 invalid-add-hours

invalid-add-hours: add_hours is not a whole number from 1 to 24.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 grant-not-found tenant-not-found

grant-not-found: No grant with this id.

tenant-not-found: No workspace with this id.

409 grant-not-active extension-exceeds-maximum-window

grant-not-active: The grant already ended.

extension-exceeds-maximum-window: The grant would last longer than max_window_hours from its start.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl
curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants/jg_3m0x9k2s8d/extend" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "add_hours": 2
}'
PowerShell
$body = @'
{
  "add_hours": 2
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants/jg_3m0x9k2s8d/extend" -Headers $headers -ContentType "application/json" -Body $body
Python
import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants/jg_3m0x9k2s8d/extend",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "add_hours": 2
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())
Node.js
const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants/jg_3m0x9k2s8d/extend", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "add_hours": 2
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());
Response 200 · application/json
{
  "id": "jg_3m0x9k2s8d",
  "request_id": "jr_5x8k2m0s9d",
  "subject": {
    "name": "Noa Peretz",
    "email": "noa.peretz@example.org",
    "vendor": "Contoso Systems"
  },
  "connection_id": "cx9m2v7d1pa",
  "resource_name": "erp-db",
  "approver": "dana.levi@example.com",
  "window_hours": 6,
  "started_at": "2026-10-13T09:30:00.000Z",
  "expires_at": "2026-10-13T15:30:00.000Z",
  "state": "active",
  "recording": true,
  "mfa": true,
  "ended_at": null,
  "ended_reason": null,
  "kind": "vendor",
  "device_id": null,
  "claimed_at": null,
  "claim_pending": true,
  "controls_enforcement": {
    "recording": "stored",
    "mfa": "stored"
  }
}

Get the just-in-time access policy

GET/v0/tenants/{tenant_id}/jit-policy

read-only token

Returns the workspace rules for temporary access: the longest grant, whether a sponsor is required, recording and second-step defaults, whether only trusted devices may get access, and whether your own people may request access from Cloudraw Connect.

Token: read-only or full access · Created by: owner or security admin

Path parameters

  • tenant_idstringrequired

    Your workspace id (Settings → Workspace in the console; it is also in every console URL).

    Example: tq7x2m9k4ab

Responses

200 The policy (defaults when never changed).

application/json

  • sponsor_requiredboolean

    An internal sponsor must vouch for each request.

  • record_by_defaultboolean

    New grants are marked for recording.

  • block_unmanagedboolean

    Person requests can only be approved for trusted devices, and the grant also requires the device to stay trusted.

  • max_window_hoursinteger

    Longest grant, 1-24 hours.

  • require_mfaboolean

    New grants are marked as requiring a second step.

  • employee_requestsobject
    employee_requests fields
    • enabledboolean

      Your own people may request access from Cloudraw Connect.

    • connection_idsarray of string

      Apps they may request; null = every app.

  • versioninteger
401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-role tenant-assertion-mismatch

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 tenant-not-found

tenant-not-found: No workspace with this id.

curl
curl -sS -X GET "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-policy" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"
PowerShell
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Get -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-policy" -Headers $headers
Python
import os, uuid, requests

r = requests.get(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-policy",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.json())
Node.js
const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-policy", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());
Response 200 · application/json
{
  "sponsor_required": true,
  "record_by_default": true,
  "block_unmanaged": false,
  "max_window_hours": 8,
  "require_mfa": true,
  "employee_requests": {
    "enabled": true,
    "connection_ids": [
      "cx9m2v7d1pa"
    ]
  },
  "version": 4
}

List access requests

GET/v0/tenants/{tenant_id}/jit-requests

read-only token

Returns requests for temporary access to an app: from your own people (Cloudraw Connect), from outside suppliers (invite links) and those filed by admins. Filter with state=pending to get the ones waiting for a decision. Not paginated.

Token: read-only or full access · Created by: owner or security admin

Path parameters

  • tenant_idstringrequired

    Your workspace id (Settings → Workspace in the console; it is also in every console URL).

    Example: tq7x2m9k4ab

Query parameters

  • statestring

    Only requests in this state.

    Example: pending

Responses

200 The requests.

application/json

  • itemsarray of JitRequestrequired
    items fields
    • idstringrequired
    • kindstringrequired

      person = one of your people asked from Cloudraw Connect; vendor = an outside supplier through an invite link; admin = filed by an admin.

      One of: person, vendor, admin.

    • subjectobjectrequired
      subject fields
      • namestring
      • emailstring | null
      • vendorstring | null

        Supplier company (null for your own people).

    • connection_idstringrequired

      The app asked for.

    • resource_namestring
    • modestring

      Always access today.

    • window_hoursinteger

      Requested duration, 1-24 hours (capped by the JIT policy).

    • reasonstring
    • sponsorstring

      The internal person who vouches for the request.

    • riskstring | null

      One of: low, med, high, .

    • device_posturestring | null
    • statestringrequired

      pending_email = the vendor has not confirmed their e-mail yet; only pending requests can be decided.

      One of: pending_email, pending, approved, denied, cancelled, expired.

    • created_atstring (date-time)
    • decided_atstring | null (date-time)
    • decided_bystring | null
    • decided_notestring | null
    • grant_idstring | null

      The grant created on approval.

    • requested_bystring | null
    • via_invitestring | null

      The invite link used (vendor requests).

    • deviceobject | null

      The device that asked, as reported.

      device fields
      • namestring | null
      • osstring | null
    • email_verifiedboolean
  • next_cursorstring | null

    Opaque cursor for the next page; null on the last page.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-role tenant-assertion-mismatch

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 tenant-not-found

tenant-not-found: No workspace with this id.

curl
curl -sS -X GET "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"
PowerShell
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Get -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests" -Headers $headers
Python
import os, uuid, requests

r = requests.get(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.json())
Node.js
const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());
Response 200 · application/json
{
  "items": [
    {
      "id": "jr_5x8k2m0s9d",
      "kind": "vendor",
      "subject": {
        "name": "Noa Peretz",
        "email": "noa.peretz@example.org",
        "vendor": "Contoso Systems"
      },
      "connection_id": "cx9m2v7d1pa",
      "resource_name": "erp-db",
      "mode": "access",
      "window_hours": 4,
      "reason": "Apply vendor hotfix KB-2291 to the ERP database.",
      "sponsor": "dana.levi@example.com",
      "risk": "med",
      "device_posture": null,
      "state": "pending",
      "created_at": "2026-10-13T09:24:11.000Z",
      "decided_at": null,
      "decided_by": null,
      "decided_note": null,
      "grant_id": null,
      "requested_by": "vendor-invite:jinv_6k2x9m0s",
      "via_invite": "jinv_6k2x9m0s",
      "device": {
        "name": "NOA-LAPTOP",
        "os": "Windows 11"
      },
      "email_verified": true
    }
  ],
  "next_cursor": null
}

Approve an access request

POST/v0/tenants/{tenant_id}/jit-requests/{request_id}/approve

full-access tokenidempotent

Approves a pending request and creates a time-boxed grant to that one app. For your own person, access is given to the device that asked; for a supplier, a separate single-use identity is created that can reach only that app. The grant ends by itself at expires_at. The person who filed a request can never approve it (separation of duties). Audited and raises an alert.

Token: full access · Created by: owner

Idempotency: send Idempotency-Key. The answer carries a secret shown once: a retry with the same key answers 409 already-issued instead of the secret.

Path parameters

  • tenant_idstringrequired

    Your workspace id (Settings → Workspace in the console; it is also in every console URL).

    Example: tq7x2m9k4ab

  • request_idstringrequired

    Access request id.

    Example: jr_5x8k2m0s9d

Headers

  • Idempotency-Keystring

    A unique value (e.g. a UUID) per logical operation. Retrying with the same key and body within 24 hours returns the first answer instead of doing the work twice.

    Example: 6f1c2b9e-3d4a-4c1e-9b8f-0a7d5e2c1b3f

Request body application/json

  • window_hoursnumber

    Grant length in hours (rounded, 1-24). Default: the requested window. Capped by the JIT policy max_window_hours.

  • recordingboolean

    Default: the JIT policy record_by_default.

  • mfaboolean

    Default: the JIT policy require_mfa.

  • notestring

    Up to 300 characters, shown in the request.

Responses

201 The new grant. enrollment_jwt appears only for supplier requests an admin filed (shown once).

application/json

400 invalid-window-hours invalid-note

invalid-window-hours: window_hours is not a number.

invalid-note: note is not text or is longer than 300 characters.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 separation-of-duties insufficient-scope insufficient-role tenant-assertion-mismatch

separation-of-duties: You filed this request (or it is about you); someone else must approve it.

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 request-not-found tenant-not-found

request-not-found: No request with this id.

tenant-not-found: No workspace with this id.

409 request-already-decided resource-no-longer-exists browser-only-app protected-file-server device-no-longer-enrolled device-not-trusted idempotency-key-reuse already-issued

request-already-decided: The request is not pending (already approved, denied, cancelled, expired, or the supplier has not confirmed their e-mail).

resource-no-longer-exists: The app was deleted.

browser-only-app: The app is recorded and browser-only; temporary direct access would bypass the recording. Use an access rule.

protected-file-server: The app is a protected file server reached only through the portal. Use an access rule.

device-no-longer-enrolled: The device that asked was removed.

device-not-trusted: The JIT policy allows only trusted devices and this device is not trusted now.

idempotency-key-reuse: The same Idempotency-Key was used with a different body within 24 hours.

already-issued: This Idempotency-Key already created a secret; it is shown only once. Retry with a new key.

502 grant-failed

grant-failed: Cloudraw could not create the access; nothing was granted. Retry.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl
curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests/jr_5x8k2m0s9d/approve" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "window_hours": 2,
  "note": "Approved for the maintenance window only."
}'
PowerShell
$body = @'
{
  "window_hours": 2,
  "note": "Approved for the maintenance window only."
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN"; "Idempotency-Key" = [guid]::NewGuid().ToString() }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests/jr_5x8k2m0s9d/approve" -Headers $headers -ContentType "application/json" -Body $body
Python
import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests/jr_5x8k2m0s9d/approve",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}", "Idempotency-Key": str(uuid.uuid4())},
    json={
        "window_hours": 2,
        "note": "Approved for the maintenance window only."
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())
Node.js
const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests/jr_5x8k2m0s9d/approve", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Idempotency-Key": crypto.randomUUID(),
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "window_hours": 2,
    "note": "Approved for the maintenance window only."
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());
Response 201 · application/json
{
  "id": "jg_3m0x9k2s8d",
  "request_id": "jr_5x8k2m0s9d",
  "subject": {
    "name": "Noa Peretz",
    "email": "noa.peretz@example.org",
    "vendor": "Contoso Systems"
  },
  "connection_id": "cx9m2v7d1pa",
  "resource_name": "erp-db",
  "approver": "dana.levi@example.com",
  "window_hours": 2,
  "started_at": "2026-10-13T09:30:00.000Z",
  "expires_at": "2026-10-13T11:30:00.000Z",
  "state": "active",
  "recording": true,
  "mfa": true,
  "ended_at": null,
  "ended_reason": null,
  "kind": "vendor",
  "device_id": null,
  "claimed_at": null,
  "claim_pending": true,
  "controls_enforcement": {
    "recording": "stored",
    "mfa": "stored"
  }
}

Deny an access request

POST/v0/tenants/{tenant_id}/jit-requests/{request_id}/deny

full-access token

Denies a pending request. Nothing is granted. Audited.

Token: full access · Created by: owner

Path parameters

  • tenant_idstringrequired

    Your workspace id (Settings → Workspace in the console; it is also in every console URL).

    Example: tq7x2m9k4ab

  • request_idstringrequired

    Access request id.

    Example: jr_5x8k2m0s9d

Request body application/json

  • notestring

    Up to 300 characters, shown in the request.

Responses

200 The decided request.

application/json

  • idstringrequired
  • kindstringrequired

    person = one of your people asked from Cloudraw Connect; vendor = an outside supplier through an invite link; admin = filed by an admin.

    One of: person, vendor, admin.

  • subjectobjectrequired
    subject fields
    • namestring
    • emailstring | null
    • vendorstring | null

      Supplier company (null for your own people).

  • connection_idstringrequired

    The app asked for.

  • resource_namestring
  • modestring

    Always access today.

  • window_hoursinteger

    Requested duration, 1-24 hours (capped by the JIT policy).

  • reasonstring
  • sponsorstring

    The internal person who vouches for the request.

  • riskstring | null

    One of: low, med, high, .

  • device_posturestring | null
  • statestringrequired

    pending_email = the vendor has not confirmed their e-mail yet; only pending requests can be decided.

    One of: pending_email, pending, approved, denied, cancelled, expired.

  • created_atstring (date-time)
  • decided_atstring | null (date-time)
  • decided_bystring | null
  • decided_notestring | null
  • grant_idstring | null

    The grant created on approval.

  • requested_bystring | null
  • via_invitestring | null

    The invite link used (vendor requests).

  • deviceobject | null

    The device that asked, as reported.

    device fields
    • namestring | null
    • osstring | null
  • email_verifiedboolean
400 invalid-note

invalid-note: note is not text or is longer than 300 characters.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 request-not-found tenant-not-found

request-not-found: No request with this id.

tenant-not-found: No workspace with this id.

409 request-already-decided

request-already-decided: The request is not pending.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl
curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests/jr_5x8k2m0s9d/deny" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "note": "Please schedule this through the change board."
}'
PowerShell
$body = @'
{
  "note": "Please schedule this through the change board."
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests/jr_5x8k2m0s9d/deny" -Headers $headers -ContentType "application/json" -Body $body
Python
import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests/jr_5x8k2m0s9d/deny",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "note": "Please schedule this through the change board."
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())
Node.js
const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests/jr_5x8k2m0s9d/deny", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "note": "Please schedule this through the change board."
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());
Response 200 · application/json
{
  "id": "jr_5x8k2m0s9d",
  "kind": "vendor",
  "subject": {
    "name": "Noa Peretz",
    "email": "noa.peretz@example.org",
    "vendor": "Contoso Systems"
  },
  "connection_id": "cx9m2v7d1pa",
  "resource_name": "erp-db",
  "mode": "access",
  "window_hours": 4,
  "reason": "Apply vendor hotfix KB-2291 to the ERP database.",
  "sponsor": "dana.levi@example.com",
  "risk": "med",
  "device_posture": null,
  "state": "denied",
  "created_at": "2026-10-13T09:24:11.000Z",
  "decided_at": "2026-10-13T09:24:11.000Z",
  "decided_by": "dana.levi@example.com",
  "decided_note": "Please schedule this through the change board.",
  "grant_id": null,
  "requested_by": "vendor-invite:jinv_6k2x9m0s",
  "via_invite": "jinv_6k2x9m0s",
  "device": {
    "name": "NOA-LAPTOP",
    "os": "Windows 11"
  },
  "email_verified": true
}