List access requests | Passport from Postman

{
  "data": [
    {
      "id": "d4e5f6a7-4444-5555-6666-777788889999",
      "requesterId": "user_01ABC",
      "namespaceId": "3f7c2b6e-1c2d-4a5b-9e8f-0a1b2c3d4e5f",
      "namespaceName": "payments",
      "status": "pending",
      "message": null,
      "entities": [
        {
          "type": "resource_endpoint",
          "id": "2b3c4d5e-7777-8888-9999-aaaabbbbcccc",
          "name": null,
          "endpoint": {
            "method": "POST",
            "host": "api.stripe.com",
            "path": "/v1/charges"
          }
        }
      ],
      "decisionReason": null,
      "decidedBy": null,
      "decidedAt": null,
      "createdAt": "2026-09-30T05:11:31.000Z",
      "updatedAt": "2026-09-30T05:11:31.000Z"
    }
  ],
  "pagination": {
    "limit": 50,
    "nextCursor": null
  }
}

Members see only their own requests. Admins see the whole team (optional requesterId filter). Supports status and namespaceId query filters plus cursor pagination.

Authentication

AuthorizationBearer

WorkOS API key (Authorization: Bearer sk_…). Scope comes from the key’s permissions: a key carrying passport:admin has admin scope (full catalog CRUD), any other key has member scope (reads + access requests). Organization-owned keys are admin by ownership and carry no associated user; keys minted for a user carry theirs, which is what access requests and createdBy are attributed to.

WorkOS API key (Authorization: Bearer sk_...). Scope comes from the key's permissions: a key carrying `passport:admin` has admin scope (full catalog CRUD), any other key has member scope (reads + access requests). Organization-owned keys are admin by ownership and carry no associated user; keys minted for a user carry theirs, which is what access requests and `createdBy` are attributed to.

Query parameters

limitintegerOptional1-100Defaults to 50

Page size. Out-of-range and non-numeric values are clamped rather than rejected: above 100 becomes 100, below 1 or non-numeric becomes the default 50. The applied value is returned as pagination.limit.

cursorstringOptional

Opaque pagination cursor from a previous page’s pagination.nextCursor.

statusenumOptional

Allowed values:

namespaceIdstringOptionalformat: "uuid"

requesterIdstringOptional

Admin only — narrow to a requester. Ignored for member keys.

Response headers

RateLimit-Limitinteger

Requests allowed in the current window.

RateLimit-Remaininginteger

Requests remaining in the current window.

RateLimit-Resetinteger

Unix epoch seconds when the window resets.

Response

datalist of objects

paginationobject

Errors

400

Bad Request Error

401

Unauthorized Error

429

Too Many Requests Error

500

Internal Server Error

503

Service Unavailable Error