API reference
Just-in-time access
Requests for temporary access, their approval, and active grants.
List temporary access grants
GET/v0/tenants/{tenant_id}/jit-grants
Returns grants created by approved requests: active ones and those that ended (revoked or expired). Not paginated.
Token: read-only or full access · Created by: owner or security admin
Path parameters
- tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Query parameters
- statestring
Only grants in this state.
Responses
200 The grants.
application/json
- itemsarray of JitGrantrequired
items fields
- idstringrequired
- request_idstringrequired
- kindstring
- subjectobject
subject fields
- namestring
- emailstring | null
- vendorstring | null
- connection_idstringrequired
- resource_namestring
- approverstring | null
- window_hoursinteger
- started_atstring (date-time)
- expires_atstring (date-time)required
- statestringrequired
revoke_pending= no longer usable from Cloudraw's side; removal is being retried. - recordingboolean
Recording was requested for this grant (stored; see
controls_enforcement). - mfaboolean
A second step was required for this grant (stored; see
controls_enforcement). - ended_atstring | null (date-time)
- ended_reasonstring | null
- device_idstring | null
Person grants: the device that gets access.
- claimed_atstring | null (date-time)
- claim_pendingboolean
Vendor grants: the vendor has not yet claimed their one-time credential.
- controls_enforcementobject
stored= the setting is recorded but not enforced yet.controls_enforcement fields
- recordingstring
- mfastring
- next_cursorstring | null
Opaque cursor for the next page; null on the last page.
401 unauthorized invalid-token token-expired
unauthorized: No Authorization: Bearer crw_… header was sent.
invalid-token: The token is unknown or was revoked.
token-expired: The token is past its expiry date. Create a new one.
403 insufficient-role tenant-assertion-mismatch
insufficient-role: The token's role ceiling does not allow this call.
tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.
404 tenant-not-found
tenant-not-found: No workspace with this id.
curl -sS -X GET "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants" \
-H "Authorization: Bearer $CLOUDRAW_TOKEN"$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Get -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants" -Headers $headersimport os, uuid, requests
r = requests.get(
"https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants",
headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
timeout=30,
)
r.raise_for_status()
print(r.json())const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants", {
method: "GET",
headers: {
Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
},
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());{
"items": [
{
"id": "jg_3m0x9k2s8d",
"request_id": "jr_5x8k2m0s9d",
"subject": {
"name": "Noa Peretz",
"email": "noa.peretz@example.org",
"vendor": "Contoso Systems"
},
"connection_id": "cx9m2v7d1pa",
"resource_name": "erp-db",
"approver": "dana.levi@example.com",
"window_hours": 4,
"started_at": "2026-10-13T09:30:00.000Z",
"expires_at": "2026-10-13T13:30:00.000Z",
"state": "active",
"recording": true,
"mfa": true,
"ended_at": null,
"ended_reason": null,
"kind": "vendor",
"device_id": null,
"claimed_at": null,
"claim_pending": true,
"controls_enforcement": {
"recording": "stored",
"mfa": "stored"
}
}
],
"next_cursor": null
}Revoke a temporary access grant
DELETE/v0/tenants/{tenant_id}/jit-grants/{grant_id}
Ends an active grant now: its access is removed and, for a supplier, the single-use identity is deleted. If the removal cannot be confirmed at once, the grant is already unusable from Cloudraw's side, shows revoke_pending, and removal is retried automatically; the answer then has state: pending and error: "revoke_pending". Audited and raises an alert.
Token: full access · Created by: owner
Path parameters
- tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
- grant_idstringrequired
Grant id.
Responses
202 Revoked (done) or being retried (pending).
application/json
- idstringrequired
- tenant_idstring
- statestringrequired
- result_uristring | null
- errorobject | string | null
Why it failed, or a short status note (e.g.
revoke_pending).
401 unauthorized invalid-token token-expired
unauthorized: No Authorization: Bearer crw_… header was sent.
invalid-token: The token is unknown or was revoked.
token-expired: The token is past its expiry date. Create a new one.
403 insufficient-scope insufficient-role tenant-assertion-mismatch
insufficient-scope: The token is read-only and this call changes something.
insufficient-role: The token's role ceiling does not allow this call.
tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.
404 grant-not-found tenant-not-found
grant-not-found: No grant with this id.
tenant-not-found: No workspace with this id.
409 grant-not-active
grant-not-active: The grant already ended.
502 revoke-failed
revoke-failed: Unexpected failure; retry.
503 busy
busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.
curl -sS -X DELETE "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants/jg_3m0x9k2s8d" \
-H "Authorization: Bearer $CLOUDRAW_TOKEN"$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Delete -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants/jg_3m0x9k2s8d" -Headers $headersimport os, uuid, requests
r = requests.delete(
"https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants/jg_3m0x9k2s8d",
headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
timeout=30,
)
r.raise_for_status()
print(r.status_code)const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants/jg_3m0x9k2s8d", {
method: "DELETE",
headers: {
Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
},
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(res.status);{
"id": "task_8k2x0m9s1d",
"tenant_id": "tq7x2m9k4ab",
"state": "done",
"result_uri": null,
"error": null
}Extend a temporary access grant
POST/v0/tenants/{tenant_id}/jit-grants/{grant_id}/extend
Moves an active grant's expiry later. The total length, counted from started_at, can never exceed the JIT policy max_window_hours (itself at most 24 hours). Audited.
Token: full access · Created by: owner
Path parameters
- tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
- grant_idstringrequired
Grant id.
Request body application/json
- add_hoursinteger
Hours to add, 1-24. Default 1.
Responses
200 The grant with its new expires_at.
application/json
- idstringrequired
- request_idstringrequired
- kindstring
- subjectobject
subject fields
- namestring
- emailstring | null
- vendorstring | null
- connection_idstringrequired
- resource_namestring
- approverstring | null
- window_hoursinteger
- started_atstring (date-time)
- expires_atstring (date-time)required
- statestringrequired
revoke_pending= no longer usable from Cloudraw's side; removal is being retried. - recordingboolean
Recording was requested for this grant (stored; see
controls_enforcement). - mfaboolean
A second step was required for this grant (stored; see
controls_enforcement). - ended_atstring | null (date-time)
- ended_reasonstring | null
- device_idstring | null
Person grants: the device that gets access.
- claimed_atstring | null (date-time)
- claim_pendingboolean
Vendor grants: the vendor has not yet claimed their one-time credential.
- controls_enforcementobject
stored= the setting is recorded but not enforced yet.controls_enforcement fields
- recordingstring
- mfastring
400 invalid-add-hours
invalid-add-hours: add_hours is not a whole number from 1 to 24.
401 unauthorized invalid-token token-expired
unauthorized: No Authorization: Bearer crw_… header was sent.
invalid-token: The token is unknown or was revoked.
token-expired: The token is past its expiry date. Create a new one.
403 insufficient-scope insufficient-role tenant-assertion-mismatch
insufficient-scope: The token is read-only and this call changes something.
insufficient-role: The token's role ceiling does not allow this call.
tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.
404 grant-not-found tenant-not-found
grant-not-found: No grant with this id.
tenant-not-found: No workspace with this id.
409 grant-not-active extension-exceeds-maximum-window
grant-not-active: The grant already ended.
extension-exceeds-maximum-window: The grant would last longer than max_window_hours from its start.
503 busy
busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.
curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants/jg_3m0x9k2s8d/extend" \
-H "Authorization: Bearer $CLOUDRAW_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"add_hours": 2
}'$body = @'
{
"add_hours": 2
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants/jg_3m0x9k2s8d/extend" -Headers $headers -ContentType "application/json" -Body $bodyimport os, uuid, requests
r = requests.post(
"https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants/jg_3m0x9k2s8d/extend",
headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
json={
"add_hours": 2
},
timeout=30,
)
r.raise_for_status()
print(r.json())const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-grants/jg_3m0x9k2s8d/extend", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
"add_hours": 2
}),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());{
"id": "jg_3m0x9k2s8d",
"request_id": "jr_5x8k2m0s9d",
"subject": {
"name": "Noa Peretz",
"email": "noa.peretz@example.org",
"vendor": "Contoso Systems"
},
"connection_id": "cx9m2v7d1pa",
"resource_name": "erp-db",
"approver": "dana.levi@example.com",
"window_hours": 6,
"started_at": "2026-10-13T09:30:00.000Z",
"expires_at": "2026-10-13T15:30:00.000Z",
"state": "active",
"recording": true,
"mfa": true,
"ended_at": null,
"ended_reason": null,
"kind": "vendor",
"device_id": null,
"claimed_at": null,
"claim_pending": true,
"controls_enforcement": {
"recording": "stored",
"mfa": "stored"
}
}Get the just-in-time access policy
GET/v0/tenants/{tenant_id}/jit-policy
Returns the workspace rules for temporary access: the longest grant, whether a sponsor is required, recording and second-step defaults, whether only trusted devices may get access, and whether your own people may request access from Cloudraw Connect.
Token: read-only or full access · Created by: owner or security admin
Path parameters
- tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Responses
200 The policy (defaults when never changed).
application/json
- sponsor_requiredboolean
An internal sponsor must vouch for each request.
- record_by_defaultboolean
New grants are marked for recording.
- block_unmanagedboolean
Person requests can only be approved for trusted devices, and the grant also requires the device to stay trusted.
- max_window_hoursinteger
Longest grant, 1-24 hours.
- require_mfaboolean
New grants are marked as requiring a second step.
- employee_requestsobject
employee_requests fields
- enabledboolean
Your own people may request access from Cloudraw Connect.
- connection_idsarray of string
Apps they may request; null = every app.
- versioninteger
401 unauthorized invalid-token token-expired
unauthorized: No Authorization: Bearer crw_… header was sent.
invalid-token: The token is unknown or was revoked.
token-expired: The token is past its expiry date. Create a new one.
403 insufficient-role tenant-assertion-mismatch
insufficient-role: The token's role ceiling does not allow this call.
tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.
404 tenant-not-found
tenant-not-found: No workspace with this id.
curl -sS -X GET "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-policy" \
-H "Authorization: Bearer $CLOUDRAW_TOKEN"$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Get -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-policy" -Headers $headersimport os, uuid, requests
r = requests.get(
"https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-policy",
headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
timeout=30,
)
r.raise_for_status()
print(r.json())const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-policy", {
method: "GET",
headers: {
Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
},
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());{
"sponsor_required": true,
"record_by_default": true,
"block_unmanaged": false,
"max_window_hours": 8,
"require_mfa": true,
"employee_requests": {
"enabled": true,
"connection_ids": [
"cx9m2v7d1pa"
]
},
"version": 4
}List access requests
GET/v0/tenants/{tenant_id}/jit-requests
Returns requests for temporary access to an app: from your own people (Cloudraw Connect), from outside suppliers (invite links) and those filed by admins. Filter with state=pending to get the ones waiting for a decision. Not paginated.
Token: read-only or full access · Created by: owner or security admin
Path parameters
- tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Query parameters
- statestring
Only requests in this state.
Responses
200 The requests.
application/json
- itemsarray of JitRequestrequired
items fields
- idstringrequired
- kindstringrequired
person= one of your people asked from Cloudraw Connect;vendor= an outside supplier through an invite link;admin= filed by an admin. - subjectobjectrequired
subject fields
- namestring
- emailstring | null
- vendorstring | null
Supplier company (null for your own people).
- connection_idstringrequired
The app asked for.
- resource_namestring
- modestring
Always
accesstoday. - window_hoursinteger
Requested duration, 1-24 hours (capped by the JIT policy).
- reasonstring
- sponsorstring
The internal person who vouches for the request.
- riskstring | null
- device_posturestring | null
- statestringrequired
pending_email= the vendor has not confirmed their e-mail yet; onlypendingrequests can be decided. - created_atstring (date-time)
- decided_atstring | null (date-time)
- decided_bystring | null
- decided_notestring | null
- grant_idstring | null
The grant created on approval.
- requested_bystring | null
- via_invitestring | null
The invite link used (vendor requests).
- deviceobject | null
The device that asked, as reported.
device fields
- namestring | null
- osstring | null
- email_verifiedboolean
- next_cursorstring | null
Opaque cursor for the next page; null on the last page.
401 unauthorized invalid-token token-expired
unauthorized: No Authorization: Bearer crw_… header was sent.
invalid-token: The token is unknown or was revoked.
token-expired: The token is past its expiry date. Create a new one.
403 insufficient-role tenant-assertion-mismatch
insufficient-role: The token's role ceiling does not allow this call.
tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.
404 tenant-not-found
tenant-not-found: No workspace with this id.
curl -sS -X GET "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests" \
-H "Authorization: Bearer $CLOUDRAW_TOKEN"$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Get -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests" -Headers $headersimport os, uuid, requests
r = requests.get(
"https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests",
headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
timeout=30,
)
r.raise_for_status()
print(r.json())const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests", {
method: "GET",
headers: {
Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
},
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());{
"items": [
{
"id": "jr_5x8k2m0s9d",
"kind": "vendor",
"subject": {
"name": "Noa Peretz",
"email": "noa.peretz@example.org",
"vendor": "Contoso Systems"
},
"connection_id": "cx9m2v7d1pa",
"resource_name": "erp-db",
"mode": "access",
"window_hours": 4,
"reason": "Apply vendor hotfix KB-2291 to the ERP database.",
"sponsor": "dana.levi@example.com",
"risk": "med",
"device_posture": null,
"state": "pending",
"created_at": "2026-10-13T09:24:11.000Z",
"decided_at": null,
"decided_by": null,
"decided_note": null,
"grant_id": null,
"requested_by": "vendor-invite:jinv_6k2x9m0s",
"via_invite": "jinv_6k2x9m0s",
"device": {
"name": "NOA-LAPTOP",
"os": "Windows 11"
},
"email_verified": true
}
],
"next_cursor": null
}Approve an access request
POST/v0/tenants/{tenant_id}/jit-requests/{request_id}/approve
Approves a pending request and creates a time-boxed grant to that one app. For your own person, access is given to the device that asked; for a supplier, a separate single-use identity is created that can reach only that app. The grant ends by itself at expires_at. The person who filed a request can never approve it (separation of duties). Audited and raises an alert.
Token: full access · Created by: owner
Idempotency: send Idempotency-Key. The answer carries a secret shown once: a retry with the same key answers 409 already-issued instead of the secret.
Path parameters
- tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
- request_idstringrequired
Access request id.
Headers
- Idempotency-Keystring
A unique value (e.g. a UUID) per logical operation. Retrying with the same key and body within 24 hours returns the first answer instead of doing the work twice.
Request body application/json
- window_hoursnumber
Grant length in hours (rounded, 1-24). Default: the requested window. Capped by the JIT policy
max_window_hours. - recordingboolean
Default: the JIT policy
record_by_default. - mfaboolean
Default: the JIT policy
require_mfa. - notestring
Up to 300 characters, shown in the request.
Responses
201 The new grant. enrollment_jwt appears only for supplier requests an admin filed (shown once).
application/json
400 invalid-window-hours invalid-note
invalid-window-hours: window_hours is not a number.
invalid-note: note is not text or is longer than 300 characters.
401 unauthorized invalid-token token-expired
unauthorized: No Authorization: Bearer crw_… header was sent.
invalid-token: The token is unknown or was revoked.
token-expired: The token is past its expiry date. Create a new one.
403 separation-of-duties insufficient-scope insufficient-role tenant-assertion-mismatch
separation-of-duties: You filed this request (or it is about you); someone else must approve it.
insufficient-scope: The token is read-only and this call changes something.
insufficient-role: The token's role ceiling does not allow this call.
tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.
404 request-not-found tenant-not-found
request-not-found: No request with this id.
tenant-not-found: No workspace with this id.
409 request-already-decided resource-no-longer-exists browser-only-app protected-file-server device-no-longer-enrolled device-not-trusted idempotency-key-reuse already-issued
request-already-decided: The request is not pending (already approved, denied, cancelled, expired, or the supplier has not confirmed their e-mail).
resource-no-longer-exists: The app was deleted.
browser-only-app: The app is recorded and browser-only; temporary direct access would bypass the recording. Use an access rule.
protected-file-server: The app is a protected file server reached only through the portal. Use an access rule.
device-no-longer-enrolled: The device that asked was removed.
device-not-trusted: The JIT policy allows only trusted devices and this device is not trusted now.
idempotency-key-reuse: The same Idempotency-Key was used with a different body within 24 hours.
already-issued: This Idempotency-Key already created a secret; it is shown only once. Retry with a new key.
502 grant-failed
grant-failed: Cloudraw could not create the access; nothing was granted. Retry.
503 busy
busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.
curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests/jr_5x8k2m0s9d/approve" \
-H "Authorization: Bearer $CLOUDRAW_TOKEN" \
-H "Idempotency-Key: $(uuidgen)" \
-H "Content-Type: application/json" \
-d '{
"window_hours": 2,
"note": "Approved for the maintenance window only."
}'$body = @'
{
"window_hours": 2,
"note": "Approved for the maintenance window only."
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN"; "Idempotency-Key" = [guid]::NewGuid().ToString() }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests/jr_5x8k2m0s9d/approve" -Headers $headers -ContentType "application/json" -Body $bodyimport os, uuid, requests
r = requests.post(
"https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests/jr_5x8k2m0s9d/approve",
headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}", "Idempotency-Key": str(uuid.uuid4())},
json={
"window_hours": 2,
"note": "Approved for the maintenance window only."
},
timeout=30,
)
r.raise_for_status()
print(r.json())const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests/jr_5x8k2m0s9d/approve", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
"Idempotency-Key": crypto.randomUUID(),
"Content-Type": "application/json",
},
body: JSON.stringify({
"window_hours": 2,
"note": "Approved for the maintenance window only."
}),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());{
"id": "jg_3m0x9k2s8d",
"request_id": "jr_5x8k2m0s9d",
"subject": {
"name": "Noa Peretz",
"email": "noa.peretz@example.org",
"vendor": "Contoso Systems"
},
"connection_id": "cx9m2v7d1pa",
"resource_name": "erp-db",
"approver": "dana.levi@example.com",
"window_hours": 2,
"started_at": "2026-10-13T09:30:00.000Z",
"expires_at": "2026-10-13T11:30:00.000Z",
"state": "active",
"recording": true,
"mfa": true,
"ended_at": null,
"ended_reason": null,
"kind": "vendor",
"device_id": null,
"claimed_at": null,
"claim_pending": true,
"controls_enforcement": {
"recording": "stored",
"mfa": "stored"
}
}Deny an access request
POST/v0/tenants/{tenant_id}/jit-requests/{request_id}/deny
Denies a pending request. Nothing is granted. Audited.
Token: full access · Created by: owner
Path parameters
- tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
- request_idstringrequired
Access request id.
Request body application/json
- notestring
Up to 300 characters, shown in the request.
Responses
200 The decided request.
application/json
- idstringrequired
- kindstringrequired
person= one of your people asked from Cloudraw Connect;vendor= an outside supplier through an invite link;admin= filed by an admin. - subjectobjectrequired
subject fields
- namestring
- emailstring | null
- vendorstring | null
Supplier company (null for your own people).
- connection_idstringrequired
The app asked for.
- resource_namestring
- modestring
Always
accesstoday. - window_hoursinteger
Requested duration, 1-24 hours (capped by the JIT policy).
- reasonstring
- sponsorstring
The internal person who vouches for the request.
- riskstring | null
- device_posturestring | null
- statestringrequired
pending_email= the vendor has not confirmed their e-mail yet; onlypendingrequests can be decided. - created_atstring (date-time)
- decided_atstring | null (date-time)
- decided_bystring | null
- decided_notestring | null
- grant_idstring | null
The grant created on approval.
- requested_bystring | null
- via_invitestring | null
The invite link used (vendor requests).
- deviceobject | null
The device that asked, as reported.
device fields
- namestring | null
- osstring | null
- email_verifiedboolean
400 invalid-note
invalid-note: note is not text or is longer than 300 characters.
401 unauthorized invalid-token token-expired
unauthorized: No Authorization: Bearer crw_… header was sent.
invalid-token: The token is unknown or was revoked.
token-expired: The token is past its expiry date. Create a new one.
403 insufficient-scope insufficient-role tenant-assertion-mismatch
insufficient-scope: The token is read-only and this call changes something.
insufficient-role: The token's role ceiling does not allow this call.
tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.
404 request-not-found tenant-not-found
request-not-found: No request with this id.
tenant-not-found: No workspace with this id.
409 request-already-decided
request-already-decided: The request is not pending.
503 busy
busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.
curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests/jr_5x8k2m0s9d/deny" \
-H "Authorization: Bearer $CLOUDRAW_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"note": "Please schedule this through the change board."
}'$body = @'
{
"note": "Please schedule this through the change board."
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests/jr_5x8k2m0s9d/deny" -Headers $headers -ContentType "application/json" -Body $bodyimport os, uuid, requests
r = requests.post(
"https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests/jr_5x8k2m0s9d/deny",
headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
json={
"note": "Please schedule this through the change board."
},
timeout=30,
)
r.raise_for_status()
print(r.json())const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/jit-requests/jr_5x8k2m0s9d/deny", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
"note": "Please schedule this through the change board."
}),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());{
"id": "jr_5x8k2m0s9d",
"kind": "vendor",
"subject": {
"name": "Noa Peretz",
"email": "noa.peretz@example.org",
"vendor": "Contoso Systems"
},
"connection_id": "cx9m2v7d1pa",
"resource_name": "erp-db",
"mode": "access",
"window_hours": 4,
"reason": "Apply vendor hotfix KB-2291 to the ERP database.",
"sponsor": "dana.levi@example.com",
"risk": "med",
"device_posture": null,
"state": "denied",
"created_at": "2026-10-13T09:24:11.000Z",
"decided_at": "2026-10-13T09:24:11.000Z",
"decided_by": "dana.levi@example.com",
"decided_note": "Please schedule this through the change board.",
"grant_id": null,
"requested_by": "vendor-invite:jinv_6k2x9m0s",
"via_invite": "jinv_6k2x9m0s",
"device": {
"name": "NOA-LAPTOP",
"os": "Windows 11"
},
"email_verified": true
}