# Create grant

URL: https://docs.hanzo.ai/docs/openapi/dataroom/post-dataroom-trust-requests-by-id-grant

> Answers a request by opening access: it mints a share link over what was asked for, addressed to the address that asked and closing at expiry, records the decision, and mails the asker.

`POST /v1/dataroom/trust/requests/{id}/grant`

> [Dataroom →](https://docs.hanzo.ai/docs/openapi/dataroom) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides)

|               |                                                              |
| ------------- | ------------------------------------------------------------ |
| **Address**   | `https://api.hanzo.ai/v1/dataroom/trust/requests/{id}/grant` |
| **Method**    | `POST`                                                       |
| **Operation** | `post_dataroom_trust_requests_by_id_grant`                   |
| **Auth**      | `Authorization: Bearer $HANZO_API_KEY`                       |

Answers a request by opening access: it mints a share link over what was
asked for, addressed to the address that asked and closing at expiry, records the
decision, and mails the asker.

The link is NEVER a public URL. It carries the asker's address on its allow list,
so forwarding it to somebody else does not open it, and it expires. What the
party then does with it — which document, which page, for how long — is recorded
by the data room's own view tracking, which is where the access record for this
release lives; there is no second log.

A request that was already answered is refused rather than answered twice, so a
second click cannot mint a second link. Only an admin of the org may call it, and
the request is resolved in that org's own store, so another org's request id is
not found — which is also what stops one org deciding another's queue.

Mail is best effort and the grant does not depend on it: a deployment that sends
no mail still records the grant and says so in `delivery`, so the approver knows
to pass the address on themselves.

## Request

4 fields, body `application/json` (required).

| Field  | In   | Type            | Required | Description                                       |
| ------ | ---- | --------------- | -------- | ------------------------------------------------- |
| `id`   | path | string          | yes      | ID is the request to answer, taken from the path. |
| `days` | body | integer (int64) | —        | Days is how long the grant stays open, from now.  |
| `id`   | body | string          | —        | ID is the request to answer, taken from the path. |
| `note` | body | string          | —        | Note is why.                                      |

## Response

| Status    | Body                  | Meaning |
| --------- | --------------------- | ------- |
| `200`     | dataroom.trustGranted | ok      |
| `default` | problem-details       | refused |

`200` body — 4 fields.

| Field       | In   | Type            | Always | Description                                                                                                                                                  |
| ----------- | ---- | --------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `delivery`  | body | string          | —      | Delivery is empty when the asker was mailed, and otherwise says what happened instead — so an approver is never left believing a mail went out that did not. |
| `expiresAt` | body | integer (int64) | —      | ExpiresAt is when the grant closes, in unix milliseconds.                                                                                                    |
| `link`      | body | string          | —      | Link is the share link's id.                                                                                                                                 |
| `state`     | body | string          | —      | State is "granted".                                                                                                                                          |

Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors).

## Examples

**CLI**

```bash
hanzo dataroom trust requests grant <id>
```

**SDK**

**.ts**

```ts
import { Configuration, DataroomApi } from 'hanzoai';

const api = new DataroomApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.postDataroomTrustRequestsByIdGrant({ id: 'id', days: 0, id: "<id>" });
```

**.py**

```python
from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import DataroomApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = DataroomApi(client).post_dataroom_trust_requests_by_id_grant(id='id', days=0, id="<id>")
```

**.go**

```go
cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.DataroomAPI.PostDataroomTrustRequestsByIdGrant(context.Background()).Execute()
if err != nil {
	return err
}
```

**.rs**

```rust
use hanzo_client::apis::{configuration::Configuration, dataroom_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = dataroom_api::post_dataroom_trust_requests_by_id_grant(&cfg, Default::default()).await?;
```

**.java**

```java
import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.DataroomApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new DataroomApi(client).postDataroomTrustRequestsByIdGrant();
```

**HTTP**

```bash
curl -X POST https://api.hanzo.ai/v1/dataroom/trust/requests/<id>/grant \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "days": 0,
       "id": "<id>"
     }'
```

**MCP**

MCP reaches **dataroom** through the `dataroom` tool, which names its 19 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them:

```bash
curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "get_dataroom_analytic_dataroom"
         }
       }
     }'
```

---

[Dataroom API](https://docs.hanzo.ai/docs/openapi/dataroom) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)