> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List access requests

> <Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Returns the people who asked to join the app and the people invited to it who haven't joined yet, newest first.

Check `status` on each entry. `pending` means the person asked for access and is waiting for you to [approve or deny](/api-reference/approve-or-deny-access-request) it. `approved` means they're invited or approved but haven't joined yet. `completed` means they've joined: the entry stays while they're one of the app's users, and they also appear in [List app users](/api-reference/list-app-users). Requests still waiting for the person to confirm their email don't appear.

Set `role` to list one role only. Every matching entry comes back at once, with no paging.

<Note>This endpoint accepts a personal API key belonging to a user with access to the app. A read-only key is refused, and workspace API keys are not accepted.</Note>



## OpenAPI

````yaml /developers/references/app-management/app-management-openapi.json get /api/apps/{app_id}/access-requests/all
openapi: 3.1.0
info:
  title: Base44 App Management API
  version: 1.0.0
servers:
  - url: https://app.base44.com
security:
  - PersonalAccessTokenAuth: []
paths:
  /api/apps/{app_id}/access-requests/all:
    get:
      summary: List access requests
      description: >-
        <Info>This API is in beta. Endpoints, fields, and behavior may still
        change, so avoid depending on it in production.</Info>


        Returns the people who asked to join the app and the people invited to
        it who haven't joined yet, newest first.


        Check `status` on each entry. `pending` means the person asked for
        access and is waiting for you to [approve or
        deny](/api-reference/approve-or-deny-access-request) it. `approved`
        means they're invited or approved but haven't joined yet. `completed`
        means they've joined: the entry stays while they're one of the app's
        users, and they also appear in [List app
        users](/api-reference/list-app-users). Requests still waiting for the
        person to confirm their email don't appear.


        Set `role` to list one role only. Every matching entry comes back at
        once, with no paging.


        <Note>This endpoint accepts a personal API key belonging to a user with
        access to the app. A read-only key is refused, and workspace API keys
        are not accepted.</Note>
      operationId: list_access_requests_api_apps__app_id__access_requests_all_get
      parameters:
        - name: app_id
          in: path
          required: true
          schema:
            type: string
            description: ID of the app.
            title: App Id
          description: ID of the app.
          example: 6820f3a4e7b91d003c45a1f2
        - name: role
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: >-
              List only entries with this app role. `all`, or leaving it out,
              lists every role.
            title: Role
          description: >-
            List only entries with this app role. `all`, or leaving it out,
            lists every role.
          example: user
      responses:
        '200':
          description: The app's access requests and pending invitations.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AccessRequestSummary'
                title: AccessRequests
        '401':
          description: Missing or invalid credentials.
        '403':
          description: You don't have access to this app, or your API key is read-only.
        '404':
          description: App not found.
components:
  schemas:
    AccessRequestSummary:
      properties:
        id:
          type: string
          title: Id
          description: ID of the access request.
          example: 68d4a1f7c2b9e5001a7f3c60
        app_id:
          type: string
          title: App Id
          description: ID of the app.
          example: 6820f3a4e7b91d003c45a1f2
        email:
          type: string
          title: Email
          description: Email of the person.
          example: jane@acme.com
        full_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Full Name
          description: Name of the person, or `null` when they didn't give one.
          example: Jane Cooper
        role:
          type: string
          title: Role
          description: App role the person gets when they join.
          example: user
        status:
          type: string
          title: Status
          description: >-
            `pending` when the person asked for access and is waiting for your
            review, `approved` when they're invited or approved but haven't
            joined yet, or `completed` once they've joined.
          example: pending
        requested_at:
          type: string
          title: Requested At
          description: >-
            When the request or invitation was made, as a UTC timestamp in ISO
            8601 format.
          example: '2026-09-20T08:12:44.201000Z'
        data:
          additionalProperties: true
          type: object
          title: Data
          description: >-
            Custom `User` fields stored on the invitation, limited by the `User`
            entity's field-level read rules.
          example:
            department: sales
      type: object
      required:
        - id
        - app_id
        - email
        - full_name
        - role
        - status
        - requested_at
        - data
      title: AccessRequestSummary
      description: 'Doc-only: the handler returns plain dicts with exactly these keys.'
  securitySchemes:
    PersonalAccessTokenAuth:
      type: http
      scheme: bearer
      description: 'Personal access token, sent as `Authorization: Bearer <token>`.'

````