Grant answers a request by opening access: it mints a share link over what was…
Grant answers a request by opening access: it mints a share link over what was asked for, addressed to the address that asked and closing at expiry,…
POST /v1/dataroom/trust/requests/{id}/grant
| Address | https://api.hanzo.ai/v1/dataroom/trust/requests/{id}/grant |
| Method | POST |
| Operation | post_dataroom_trust_requests_by_id_grant |
| Auth | Authorization: Bearer $HANZO_API_KEY |
Grant answers a request by opening access: it mints a share link over what was asked for, addressed to the address that asked and closing at expiry, records the decision, and mails the asker.
The link is NEVER a public URL. It carries the asker's address on its allow list, so forwarding it to somebody else does not open it, and it expires. What the party then does with it — which document, which page, for how long — is recorded by the data room's own view tracking, which is where the access record for this release lives; there is no second log.
A request that was already answered is refused rather than answered twice, so a second click cannot mint a second link. Only an admin of the org may call it, and the request is resolved in that org's own store, so another org's request id is not found — which is also what stops one org deciding another's queue.
Mail is best effort and the grant does not depend on it: a deployment that sends
no mail still records the grant and says so in delivery, so the approver knows
to pass the address on themselves.
Request
4 fields, body application/json (required).
| Field | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string | yes | ID is the request to answer, taken from the path. |
days | body | integer | — | Days is how long the grant stays open, from now. |
id | body | string | — | ID is the request to answer, taken from the path. |
note | body | string | — | Note is why. |
Response
| Status | Body | Meaning |
|---|---|---|
200 | trustGranted | ok |
200 body — 4 fields.
| Field | In | Type | Always | Description |
|---|---|---|---|---|
delivery | body | string | — | Delivery is empty when the asker was mailed, and otherwise says what happened instead — so an approver is never left believing a mail went out that did not. |
expiresAt | body | integer | — | ExpiresAt is when the grant closes, in unix milliseconds. |
link | body | string | — | Link is the share link's id. |
state | body | string | — | State is "granted". |
Failure carries the platform error shape — see Errors.
Examples
hanzo has no subcommand for this operation — the CLI serves only what cloud's live route table confirms. Use HTTP or an SDK.
import { Configuration, DataroomApi } from 'hanzoai';
const api = new DataroomApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.postDataroomTrustRequestsByIdGrant({ id: 'id', days: 0, id: "<id>" });from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import DataroomApi
client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = DataroomApi(client).post_dataroom_trust_requests_by_id_grant(id='id', days=0, id="<id>")cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)
resp, _, err := client.DataroomAPI.PostDataroomTrustRequestsByIdGrant(context.Background()).Execute()
if err != nil {
return err
}use hanzo_cloud::apis::{configuration::Configuration, dataroom_api};
let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();
let result = dataroom_api::post_dataroom_trust_requests_by_id_grant(&cfg, Default::default()).await?;import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.DataroomApi;
ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));
var result = new DataroomApi(client).postDataroomTrustRequestsByIdGrant();The method above is the one at the current release of the document. [email protected] (npm) and [email protected] (PyPI) were generated from an earlier release, where this operation carried a different id, so it spells the method differently — regenerating the clients is what makes the two agree. SDKs →
curl -X POST https://api.hanzo.ai/v1/dataroom/trust/requests/<id>/grant \
-H "Authorization: Bearer $HANZO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"days": 0,
"id": "<id>"
}'The door reaches dataroom through the dataroom tool, which names its 17 operations with its own verbs — this one among them, under a name only the door declares. describe explains any of them:
curl -X POST https://api.hanzo.ai/v1/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "describe",
"arguments": {
"op": "get_dataroom_analytic_dataroom"
}
}
}'How is this guide?