Grant Access

Endpoint

PUT /apiops/projects/{projectName}/credentials/{username}/access/

Authentication

Requires a Personal API Access Token.

Header

Authorization: Bearer YOUR_TOKEN

Request

Headers

Header	Value	Required
Authorization	Bearer {token}	Yes
Content-Type	application/json	Yes

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
username	string	Yes	Username of the credential

Request Body

Full JSON Body Example - Grant Access to Single API Proxy

{
  "credentialAccessList": [
    {
      "name": "MyAPI",
      "type": "API_PROXY"
    }
  ]
}

Full JSON Body Example - Grant Access to Multiple Resources

{
  "credentialAccessList": [
    {
      "name": "MyAPI",
      "type": "API_PROXY"
    },
    {
      "name": "PaymentAPI",
      "type": "API_PROXY"
    },
    {
      "name": "MyAPIGroup",
      "type": "API_PROXY_GROUP"
    }
  ]
}

Full JSON Body Example - Grant Access with Expiration

{
  "credentialAccessList": [
    {
      "name": "MyAPI",
      "type": "API_PROXY",
      "expireTime": "2024-12-31T23:59:59.000Z"
    },
    {
      "name": "MyAPIGroup",
      "type": "API_PROXY_GROUP",
      "expireTime": "2025-06-30T23:59:59.000Z"
    }
  ]
}

Full JSON Body Example - Grant Access with AI Model Restriction

Restricts which AI models the credential may call on an AI proxy. The same restriction can be managed on the credential's access screen in the Manager UI.

{
  "credentialAccessList": [
    {
      "name": "MyAiProxy",
      "type": "API_PROXY",
      "enabledAiModelRestriction": true,
      "allowedAiModelIds": ["gpt-4o", "gpt-4o-mini"]
    }
  ]
}

Request Body Fields

The request body is an object containing an array of access objects.

Access Object

Field	Type	Required	Description
name	string	Yes	Name of the API Proxy or API Proxy Group
type	string	Yes	Type of access. See EnumAccessType
expireTime	string|null	No	Expiration time in ISO 8601 format (e.g., "2024-12-31T23:59:59.000Z"). If not provided or null, access does not expire
enabledAiModelRestriction	boolean	No	API_PROXY only. When true, the credential may call only the AI models listed in allowedAiModelIds on this AI proxy. Applied to every environment of the proxy. true with an empty list means unrestricted
allowedAiModelIds	string[]	No	API_PROXY only. Model ids the credential may call (e.g., "gpt-4o"). Entries are trimmed and de-duplicated. Providing a non-empty list without enabledAiModelRestriction turns the restriction on

EnumAccessType

• API_PROXY - Grant access to a specific API Proxy
• API_PROXY_GROUP - Grant access to an API Proxy Group

Request Body Object

Field	Type	Required	Description
credentialAccessList	array	Yes	Array of access objects

Notes

• Request body must be an object with credentialAccessList array (even for single access)
• Each access object must have name and type
• name must match an existing API Proxy or API Proxy Group
• type must be either API_PROXY or API_PROXY_GROUP
• expireTime is optional. If provided, access expires at the specified time. Use ISO 8601 format (UTC)
• enabledAiModelRestriction / allowedAiModelIds are optional and only valid on API_PROXY entries; sending them on an API_PROXY_GROUP entry is rejected with 400
• Cannot grant access that already exists
• Access is automatically deployed to all environments

Response

Success Response (200 OK)

{
  "status": "SUCCESS",
  "deploymentResult": {
    "success": true,
    "message": "Deployment completed successfully",
    "environmentResults": [
      {
        "environmentName": "production",
        "success": true,
        "message": "Deployed successfully"
      },
      {
        "environmentName": "staging",
        "success": true,
        "message": "Deployed successfully"
      }
    ]
  }
}

Error Response (400 Bad Request)

{
  "status": "FAILURE",
  "resultMessage": "Credential access object name can not be empty!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "Credential access object type can not be empty!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "API Proxy (name:MyAPI) is not found or user does not have privilege to access it!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "Credential (username:api-user) has already access to API Proxy (name:MyAPI)!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "AI model restriction (enabledAiModelRestriction / allowedAiModelIds) is only supported for API_PROXY access entries (name:MyAPIGroup)!"
}

Common Causes

• Empty access object
• Missing name or type field
• API Proxy or API Proxy Group does not exist
• Access already granted
• Invalid access type

Error Response (401 Unauthorized)

{
  "status": "FAILURE",
  "resultMessage": "Token is not valid!"
}

cURL Example

Example 1: Grant Access to Single API Proxy

curl -X PUT \
  "https://demo.apinizer.com/apiops/projects/MyProject/credentials/api-user/access/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "credentialAccessList": [
      {
        "name": "MyAPI",
        "type": "API_PROXY"
      }
    ]
  }'

Example 2: Grant Access to Multiple Resources

curl -X PUT \
  "https://demo.apinizer.com/apiops/projects/MyProject/credentials/api-user/access/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "credentialAccessList": [
      {
        "name": "MyAPI",
        "type": "API_PROXY"
      },
      {
        "name": "MyAPIGroup",
        "type": "API_PROXY_GROUP"
      }
    ]
  }'

Example 3: Grant Access with Expiration

curl -X PUT \
  "https://demo.apinizer.com/apiops/projects/MyProject/credentials/api-user/access/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "credentialAccessList": [
      {
        "name": "MyAPI",
        "type": "API_PROXY",
        "expireTime": "2024-12-31T23:59:59.000Z"
      }
    ]
  }'

Notes and Warnings

• Request Body Format:

  • Request body must be an object with credentialAccessList array
  • Even for single access, use object format with array inside

• Access Validation:

  • API Proxy or API Proxy Group must exist
  • Must be within the project scope

• Duplicate Access:

  • Cannot grant access that already exists
  • Check existing access before granting

• Automatic Deployment:

  • Access is automatically deployed to all environments
  • Deployment results are returned in the response

• API Proxy Group:

  • Granting access to API Proxy Group grants access to all APIs in the group
  • More efficient than granting access to individual APIs

• AI Model Restriction (AI proxies):

  • enabledAiModelRestriction + allowedAiModelIds limit the models the credential may call on that AI proxy; the gateway rejects requests for models outside the list
  • Only valid on API_PROXY entries; an API_PROXY_GROUP entry carrying these fields is rejected
  • The restriction is written to every environment of the proxy; adjust per-environment values afterwards on the credential's access screen

• Expiration Time:

  • expireTime is optional and can be set per access entry
  • Use ISO 8601 format (UTC): "YYYY-MM-DDTHH:mm:ss.sssZ"
  • If not provided or null, access does not expire
  • Expired access is automatically revoked
  • Each access entry can have its own expiration time

Permissions

• User must have IDENTITY + MANAGE permission in the project
• For automatic deployment, user must also have IDENTITY + DEPLOY_UNDEPLOY permission

Related Documentation

• Get Granted Access List - Get list of granted accesses
• Revoke Access - Revoke access from API Proxy or Group
• List Credentials - List all credentials