List grant requests (own, or a scope's approver queue).

GET

/v1/iam/grant-requests

Code sample: Shell / cURL

curl --request GET \
  --url 'https://stratum.example.com/v1/iam/grant-requests?scopeType=organization&status=pending' \
  --header 'Authorization: Bearer <token>'

• A Stratum cluster endpoint.

Lists JIT elevation grant requests. With no scopeType query the caller’s OWN requests are returned (identity-scoped). Supplying scopeType (+ scopeId for organization/project scope) returns every request at that scope the approver queue — gated on iam:ListGrantRequests at the scope. Optionally filter by status.

Authorizations

• bearerAuth

Parameters

Query Parameters

scopeType

string

Allowed values: organization project install

scopeId

string

status

string

Allowed values: pending approved denied expired canceled

Responses

200

Grant requests.

Media typeapplication/json

object

items

required

Array<object>

object

id

required

Gr-… request id.

string

requesterId

required

string

role

required

string

scopeType

required

string

Allowed values: organization project install

scopeId

required

string

durationSeconds

required

integer

justification

string

status

required

Lifecycle state. pending awaits a decision; approved produced a time-bound binding (see grantedBindingId); denied/canceled are terminal; expired is a pending request auto-denied past its TTL by the expiry reconciler.

string

Allowed values: pending approved denied expired canceled

approverId

The principal that approved/denied (self, for an auto-approved request).

string

decidedAt

string format: date-time

decisionReason

string

grantedBindingId

The rb-… time-bound binding created on approval.

string

expiresAt

The PENDING-request TTL — after this the request is auto-denied (status: expired). NOT the granted binding’s expiry, which lives on the role binding itself.

string format: date-time

nullable

createdAt

required

string format: date-time

nextPageToken

string

Example

{
  "items": [
    {
      "scopeType": "organization",
      "status": "pending"
    }
  ]
}

401

Missing or invalid token.

Media typeapplication/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

Headers

WWW-Authenticate

string

403

Authenticated but not authorized.

Media typeapplication/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}