Delegated Access

Download OpenAPI specification:Download

Manage delegated access, which allows a user to perform actions on behalf of another user. These APIs allow logged-in users to request consent from other app users, grant consent requests, view all consents related to their account, and revoke any granted permissions.

To request delegated access, see OAuth2.0 Token.
To create a dependent user with delegated access, see Create users

Grant consent

Grant the requested consent once it's approved by the user. This will provide the requesting user (the actor) permissions to act on behalf of the user that approved the consent (the subject). Since the approving user must be logged-in, this is authorized using a user access token of the subject.

SecurityHTTP: UserAccessToken
Request
Request Body schema: application/json
required
consent_id
required
string

Consent ID returned to your consent URI upon redirection

Responses
204

Consent has been created for the user

400
post/v1/delegated-access/consents/me/grant
Request samples
application/json
{
  • "consent_id": "string"
}
Response samples
application/json
{
  • "message": "Bad request",
  • "error_code": 400
}

Request consent

Send a consent request to give the requesting user (the actor) permissions to act on behalf of another user (the subject) when needed. An email will be sent to the subject with a link to your consent page. The consent URI will include a query param named consent_id used to grant the consent, permissions array, and the subject's user ID as subject_id. Since this call must be initiated by a logged-in user, it's authorized using a user access token of the actor.

SecurityHTTP: UserAccessToken
Request
Request Body schema: application/json
required
permissions
required
Array of strings

Names of permissions

consent_uri
required
string

URI of your consent page, which the browser will redirect to when the user clicks the link in the consent email. The URI must accept the following query parameters: consent_id used to grant the consent, permissions array of permissions to present the user to approve, subject_id and actor_id. This URI must also be configured as an allowed redirect URI in the Admin Portal.

subject_id
required
string

ID of the user that grants permissions to another user to act on their behalf

consent_expiration
number

Validity period of the consent in seconds. Once expired, new consent must be granted to obtain the permissions

Responses
200

Consent request has been sent

400
404
post/v1/delegated-access/consents/me/request
Request samples
application/json
{}
Response samples
application/json
{
  • "message": "Bad request",
  • "error_code": 400
}

Get consents

Get all the consents that were granted or requested by the specified user. This call is authorized by a user access token of this user.

SecurityHTTP: UserAccessToken
Responses
200

The requested user permissions

400
404
get/v1/delegated-access/consents/me
Request samples 
Response samples 
application/json
{
  • "consents_as_actor": [
    ],
  • "consents_as_subject": [
    ]
}
Revoke permissions as actor
Revokes my permissions (the actor) to act on behalf of another user (the subject). This call is initiated by the actor who is logged-in, so it's authorized using a user access token.


SecurityHTTP: UserAccessToken 
Request 
query Parameters
permissions
Array of strings
Names of permissions to revoke. If no permissions are specified, all permissions will be revoked.


 
subject_id
required
string
ID of the user that granted the permissions.


 
Responses 
200
Permissions revoked


400
404
delete/v1/delegated-access/consents/me/permissions/actor
Request samples 
Response samples 
application/json
{
  • "message": "Bad request",
  • "error_code": 400
}
Revoke permissions as subject
Revokes permissions of another user (the actor) to act on my behalf (the subject). This call is initiated by the subject who is logged-in, so it's authorized using a user access token.


SecurityHTTP: UserAccessToken 
Request 
query Parameters
permissions
Array of strings
Names of permissions to revoke. If no permissions are specified, all permissions will be revoked.


 
actor_id
required
string
ID of the user that received the permissions.


 
Responses 
200
Permissions revoked


400
404
delete/v1/delegated-access/consents/me/permissions/subject
Request samples 
Response samples 
application/json
{
  • "message": "Bad request",
  • "error_code": 400
}