---
title: "Access requests"
description: "List the people who asked to download or view a brand, then approve or reject each request."
---

> Documentation Index
> Fetch the complete documentation index at: https://tarkle.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Access requests

When a brand asks visitors for access, each request appears in the **Requests** tab of the brand in Tarkle. The API lists the same requests and makes the same decisions.

Your token needs the `brands:requests` scope. One scope covers listing and deciding, and it is separate from `brands:read` and `brands:write`. Name the workspace with `X-Workspace-Key`. The token's creator must be an owner or admin of that workspace.

## List requests

```bash
curl -H "Authorization: Bearer $TARKLE_TOKEN" -H "X-Workspace-Key: $KEY" \
  "https://tarkle.com/api/v1/brands/acme/requests?status=pending"
```

The response has `data` and `next_cursor`. Each request has `id`, `kind` (`view` or `download`), `name`, `company`, `email`, `message`, `status`, `created_at` and `decided_at`. The newest come first.

- `status` is `pending`, `approved` or `rejected`. Any other value answers `400`.
- A page holds 25 requests. `limit` is 1 to 100. Send `next_cursor` back as `cursor` and stop when it is `null`. See [paging and limits](/docs/api/paging-and-limits).

## Approve or reject

```bash
curl -X POST -H "Authorization: Bearer $TARKLE_TOKEN" -H "X-Workspace-Key: $KEY" \
  -H "Content-Type: application/json" -d '{"action": "approve"}' \
  https://tarkle.com/api/v1/brands/acme/requests/REQUEST_ID
```

`action` is `approve` or `reject`. The response holds the request `id` and its new `status`. A request id that is not a valid uuid answers `400`; an unknown brand or request answers `404`.

You can change a decision: approving a rejected request, or rejecting an approved one, is allowed. Repeating the decision the request already has answers `409 conflict`.

Every decision is recorded in the workspace Activity as `brand_request.approved` or `brand_request.rejected`, with the token's name, the request id and its kind.

## What each decision does

**Approving a download request** issues a new download link and emails it to the visitor. The response includes `emailed`: `true` when the email was sent, `false` when it was not. A failed email does not undo the approval. To send the link again, reject the request and approve it again.

**Approving a view request** only marks it approved. It sends no email and creates no link, so the response has no `emailed` field. The brand page does not read this status, so it does not open the page for the visitor.

**Rejecting** marks the request rejected and takes back the link that was issued for it. No email is sent.

The API has no call to delete a request.

## Related

- [Endpoints](/docs/api/brands/endpoints)
- [Paging and limits](/docs/api/paging-and-limits)
- [Errors](/docs/api/errors)

Source: https://tarkle.com/docs/api/brands/access-requests/index.mdx