> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Approve or deny access request

> <Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Approves or denies someone's request to join the app.

Approving a request from someone who confirmed their email adds them to the app's users with the request's role, and emails them that they're in. A request made before email confirmation existed is marked `approved` instead, and the person joins when they next sign in. Someone who signed up with a password can't be approved until they confirm their email. Approving an entry that's already `approved` or `completed` sends the approval email again.

Denying deletes the request without notifying the person, and denying an invitation withdraws it. Denying a `completed` entry deletes only the entry; remove the person with [Remove app user](/api-reference/remove-app-user).

<Note>This endpoint accepts a personal API key belonging to a user with editor access to the app. A read-only key is refused, and workspace API keys are not accepted.</Note>



## OpenAPI

````yaml /developers/references/app-management/app-management-openapi.json post /api/apps/{app_id}/access-requests/{request_id}/{action}
openapi: 3.1.0
info:
  title: Base44 App Management API
  version: 1.0.0
servers:
  - url: https://app.base44.com
security:
  - PersonalAccessTokenAuth: []
paths:
  /api/apps/{app_id}/access-requests/{request_id}/{action}:
    post:
      summary: Approve or deny access request
      description: >-
        <Info>This API is in beta. Endpoints, fields, and behavior may still
        change, so avoid depending on it in production.</Info>


        Approves or denies someone's request to join the app.


        Approving a request from someone who confirmed their email adds them to
        the app's users with the request's role, and emails them that they're
        in. A request made before email confirmation existed is marked
        `approved` instead, and the person joins when they next sign in. Someone
        who signed up with a password can't be approved until they confirm their
        email. Approving an entry that's already `approved` or `completed` sends
        the approval email again.


        Denying deletes the request without notifying the person, and denying an
        invitation withdraws it. Denying a `completed` entry deletes only the
        entry; remove the person with [Remove app
        user](/api-reference/remove-app-user).


        <Note>This endpoint accepts a personal API key belonging to a user with
        editor access to the app. A read-only key is refused, and workspace API
        keys are not accepted.</Note>
      operationId: >-
        review_access_request_api_apps__app_id__access_requests__request_id___action__post
      parameters:
        - name: request_id
          in: path
          required: true
          schema:
            type: string
            description: >-
              ID of the access request, as `id` in the response of [List access
              requests](/api-reference/list-access-requests).
            title: Request Id
          description: >-
            ID of the access request, as `id` in the response of [List access
            requests](/api-reference/list-access-requests).
          example: 68d4a1f7c2b9e5001a7f3c60
        - name: action
          in: path
          required: true
          schema:
            enum:
              - approve
              - deny
            type: string
            description: '`approve` to let the person in, or `deny` to delete the request.'
            title: Action
          description: '`approve` to let the person in, or `deny` to delete the request.'
          example: approve
        - name: app_id
          in: path
          required: true
          schema:
            type: string
            description: ID of the app.
            title: App Id
          description: ID of the app.
          example: 6820f3a4e7b91d003c45a1f2
      responses:
        '200':
          description: The reviewed access request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReviewAccessRequestResponse'
        '400':
          description: >-
            You're approving someone who signed up with a password and hasn't
            confirmed their email yet.
        '401':
          description: Missing or invalid credentials.
        '403':
          description: >-
            You don't have editor access to this app, or your API key is
            read-only.
        '404':
          description: App not found, or the app has no access request with this ID.
        '422':
          description: '`action` isn''t `approve` or `deny`.'
components:
  schemas:
    ReviewAccessRequestResponse:
      properties:
        success:
          type: boolean
          title: Success
          description: >-
            Always `true`. A review that doesn't happen returns an error
            instead.
          example: true
        message:
          type: string
          title: Message
          description: '`Access request approved` or `Access request denied`.'
          example: Access request approved
        access_request:
          $ref: '#/components/schemas/ReviewedAccessRequest'
      type: object
      required:
        - success
        - message
        - access_request
      title: ReviewAccessRequestResponse
      description: 'Doc-only: the handler returns a plain dict with exactly these keys.'
    ReviewedAccessRequest:
      properties:
        id:
          type: string
          title: Id
          description: ID of the access request.
          example: 68d4a1f7c2b9e5001a7f3c60
        app_id:
          type: string
          title: App Id
          description: ID of the app.
          example: 6820f3a4e7b91d003c45a1f2
        email:
          type: string
          title: Email
          description: Email of the person.
          example: jane@acme.com
        status:
          type: string
          title: Status
          description: >-
            `completed` when the person was added to the app, `approved` when
            they join once they sign up, or `denied`.
          example: completed
      type: object
      required:
        - id
        - app_id
        - email
        - status
      title: ReviewedAccessRequest
  securitySchemes:
    PersonalAccessTokenAuth:
      type: http
      scheme: bearer
      description: 'Personal access token, sent as `Authorization: Bearer <token>`.'

````