View and Respond to Access Requests

Respond to data product, asset, and masking exception requests

Data stewards are able to make determinations on access requests for access to data products, assets, and masking exceptions.

Respond to an access request

If you approve an unmasking request for a user, but that user is targeted by a masking policy that uses the for everyone who clause, the column will remain masked for the user. The for everyone who clause acts as a guardrail for the masking policy, preventing the users targeted by the clause from getting an exception to the masking rule. See the Data policies reference guide for details.

With the UI

1. Navigate to the Access Requests page.
2. Click the request you want to approve or deny.
3. Review the request details depending on the request type:

   1. Data access request: Review the request details, data sources, and data use agreement.
   2. Masking exception request: Review the request details, columns the user wants unmasked access to, and data use agreement.
4. Select Continue to determination, and opt to view the Determination history tab for data access requests.
5. Select the determination for access:

   • Temporarily approve: Approve the access request for a specific period of time. If the request form had an access duration question, the requester's response will be presented as a recommendation.

     • Enter your reason to approve access to the data.
     • Use the dropdowns to select how long the user should have access to the data. If entering a custom time range, you must enter a whole, positive number.
   • Approve: Approve the access request indefinitely.

     • Enter your reason to approve access to the data.
   • Deny: Deny the access request.

     • Enter your reason to deny access to the data.
6. Click Submit determination. Your determination cannot be edited after it is submitted, even if the request remains open for other data stewards to approve.

AI-powered feature

When available, review assist will offer a recommended determination for the access request and provide a reasoning for its recommendation. Opt to accept the recommendation or override it with your own.

With the API

Ensure you set the correct global segment and use a Request app personal access token (PAT) when using the Request app API. See the Request app API docs for additional guidance or to download the OpenAPI YAML for your own client generation.

Approve or reject an approval record

put

Modify a pending approval record as an approver

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

Body

statusstring · enumRequiredExample: PENDINGPossible values:

reasonstringOptional

durationnumber · min: 1Optional

durationUnitstring · enumOptionalPossible values:

Responses

200Success

application/json

idstring · cuidRequired

dataAccessRequestIdstring · cuidRequired

prerequisitesstring[]Required

statusstring · enumRequiredExample: PENDINGPossible values:

reasonstringOptional

createdAtstring · date-timeRequired

updatedAtstring · date-timeRequired

approverCriteriaMetone of · nullableRequired

durationone of · nullableRequired

numberOptional

durationUnitone of · nullableRequired

stringOptional

put/api/approval-record/{id}

PUT /marketplace/api/approval-record/{id} HTTP/1.1
Host: na.api.immutacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 72

{
  "status": "PENDING",
  "reason": "text",
  "duration": 1,
  "durationUnit": "HOURS"
}

200Success

{
  "id": "text",
  "dataAccessRequestId": "text",
  "approvers": [
    {
      "type": "USER",
      "id": "text",
      "displayName": "text"
    }
  ],
  "prerequisites": [
    "text"
  ],
  "actionBy": {
    "id": 1,
    "iamId": "text",
    "globalUserId": "123e4567-e89b-12d3-a456-426614174000",
    "username": "text",
    "name": "text",
    "email": "text",
    "authorizations": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    }
  },
  "status": "PENDING",
  "reason": "text",
  "createdAt": "2026-01-01T00:00:00.000Z",
  "updatedAt": "2026-01-01T00:00:00.000Z",
  "approverCriteriaMet": [
    {
      "type": "USER",
      "id": "text",
      "displayName": "text"
    }
  ],
  "duration": 1,
  "durationUnit": "text"
}

Review all pending access requests and stats

Requirement: Immuta permission GOVERNANCE

With the UI

1. Navigate to the Access Requests page.
2. View the number of pending requests, average age of all pending requests, and the number of stewards needing to take actions on pending requests.
3. Hover over the Stewards needing to take action stat to understand which users, groups, and permissions can make determinations on the current pending requests.
4. Opt to filter the access requests by status or reviewers as needed.

With the API

Ensure you set the correct global segment and use a Request app personal access token (PAT) when using the Request app API. See the Request app API docs for additional guidance or to download the OpenAPI YAML for your own client generation.

Search access requests

get

Search and filter access requests the current user can manage

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Query parameters

searchTextstringOptional

userIdsstring[]Optional

includeTemporarybooleanOptionalDeprecated

Whether to include temporary access requests

Default: false

expirationbooleanOptional

Filter access requests by whether it has an expiration

dataProductIdone ofOptional

The ID of the data product to filter requests by

string · cuidOptional

The ID of the data product to filter requests by

or

string · uuidOptional

assetIdstring · uuidOptional

The ID of the asset to filter requests by

targetTypestring[]Optional

Target type filter selections (DATA_PRODUCT, COLUMNS, or legacy type strings like table/view/schema)

offsetnumberOptionalDefault: 0

limitnumber · min: 1OptionalDefault: 10

sortOrderstring · enumOptionalDefault: descPossible values:

sortBystring · enumOptionalDefault: createdAtPossible values:

Responses

200Success

application/json

get/api/access-request

GET /marketplace/api/access-request HTTP/1.1
Host: na.api.immutacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

200Success

{
  "data": [
    {
      "id": "text",
      "requestingUser": {
        "id": 1,
        "iamId": "text",
        "globalUserId": "123e4567-e89b-12d3-a456-426614174000",
        "username": "text",
        "name": "text",
        "email": "text",
        "authorizations": {
          "ANY_ADDITIONAL_PROPERTY": [
            "text"
          ]
        }
      },
      "user": {
        "id": 1,
        "iamId": "text",
        "globalUserId": "123e4567-e89b-12d3-a456-426614174000",
        "username": "text",
        "name": "text",
        "email": "text",
        "authorizations": {
          "ANY_ADDITIONAL_PROPERTY": [
            "text"
          ]
        }
      },
      "formVersion": "text",
      "form": null,
      "type": "DATA_ACCESS",
      "metadata": null,
      "status": "PENDING",
      "expiration": "2026-01-01T00:00:00.000Z",
      "createdAt": "2026-01-01T00:00:00.000Z",
      "updatedAt": "2026-01-01T00:00:00.000Z",
      "dataProduct": {
        "id": "text",
        "name": "text",
        "description": "All sales records from the current fiscal year"
      },
      "asset": {
        "id": "text",
        "type": "DATA_OBJECT",
        "name": "text",
        "metadata": {
          "subjectMatterExperts": [
            {
              "id": "123e4567-e89b-12d3-a456-426614174000",
              "username": "text",
              "name": "text"
            }
          ],
          "objectPath": [
            "text"
          ],
          "technology": "Snowflake",
          "host": "text",
          "port": 1,
          "legacyType": "text",
          "dataSourceId": 1,
          "description": "text",
          "externalLink": "text"
        }
      }
    }
  ],
  "meta": {
    "offset": 0,
    "limit": 10,
    "totalCount": 1,
    "pageCount": 1,
    "currentPage": 1,
    "totalPages": 1
  }
}

View the access requests of a specific data product

With the UI

1. Navigate to the Data product you want to view requests for.
2. Click the Access requests tab.
3. Opt to filter by status, type, or date.

With the API

Ensure you set the correct global segment and use a Request app personal access token (PAT) when using the Request app API. See the Request app API docs for additional guidance or to download the OpenAPI YAML for your own client generation.

Search all access requests for the data product

get

Search all access requests for the data product using the provided filters

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

Query parameters

searchTextstringOptional

userIdsstring[]Optional

includeTemporarybooleanOptionalDeprecated

Whether to include temporary access requests

Default: false

expirationbooleanOptional

Filter access requests by whether it has an expiration

dataProductIdone ofOptional

The ID of the data product to filter requests by

string · cuidOptional

The ID of the data product to filter requests by

or

string · uuidOptional

assetIdstring · uuidOptional

The ID of the asset to filter requests by

targetTypestring[]Optional

Target type filter selections (DATA_PRODUCT, COLUMNS, or legacy type strings like table/view/schema)

offsetnumberOptionalDefault: 0

limitnumber · min: 1OptionalDefault: 10

sortOrderstring · enumOptionalDefault: descPossible values:

sortBystring · enumOptionalDefault: createdAtPossible values:

Responses

200Success

application/json

get/api/data-product/{id}/request

GET /marketplace/api/data-product/{id}/request HTTP/1.1
Host: na.api.immutacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

200Success

{
  "data": [
    {
      "id": "text",
      "requestingUser": {
        "id": 1,
        "iamId": "text",
        "globalUserId": "123e4567-e89b-12d3-a456-426614174000",
        "username": "text",
        "name": "text",
        "email": "text",
        "authorizations": {
          "ANY_ADDITIONAL_PROPERTY": [
            "text"
          ]
        }
      },
      "user": {
        "id": 1,
        "iamId": "text",
        "globalUserId": "123e4567-e89b-12d3-a456-426614174000",
        "username": "text",
        "name": "text",
        "email": "text",
        "authorizations": {
          "ANY_ADDITIONAL_PROPERTY": [
            "text"
          ]
        }
      },
      "formVersion": "text",
      "form": null,
      "type": "DATA_ACCESS",
      "metadata": null,
      "status": "PENDING",
      "expiration": "2026-01-01T00:00:00.000Z",
      "createdAt": "2026-01-01T00:00:00.000Z",
      "updatedAt": "2026-01-01T00:00:00.000Z",
      "dataProduct": {
        "id": "text",
        "name": "text",
        "description": "All sales records from the current fiscal year"
      },
      "asset": {
        "id": "text",
        "type": "DATA_OBJECT",
        "name": "text",
        "metadata": {
          "subjectMatterExperts": [
            {
              "id": "123e4567-e89b-12d3-a456-426614174000",
              "username": "text",
              "name": "text"
            }
          ],
          "objectPath": [
            "text"
          ],
          "technology": "Snowflake",
          "host": "text",
          "port": 1,
          "legacyType": "text",
          "dataSourceId": 1,
          "description": "text",
          "externalLink": "text"
        }
      }
    }
  ],
  "meta": {
    "offset": 0,
    "limit": 10,
    "totalCount": 1,
    "pageCount": 1,
    "currentPage": 1,
    "totalPages": 1
  }
}

View the approval record for a request

With the UI

1. Navigate to the Access Requests page.
2. Click the request you want the details for.

With the API

Ensure you set the correct global segment and use a Request app personal access token (PAT) when using the Request app API. See the Request app API docs for additional guidance or to download the OpenAPI YAML for your own client generation.

Get individual access request

get

Returns specific details for a specific access request

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

Responses

200Success

application/json

Access request with user and data product metadata

idstring · cuidRequired

formVersionstringRequired

formanyOptional

The request form submission

typestring · enumRequiredExample: DATA_ACCESSPossible values:

metadataanyOptional

Metadata associated with the access request

statusstring · enumRequiredExample: PENDINGPossible values:

expirationstring · date-timeOptional

When the temporary access will expire

createdAtstring · date-timeRequired

updatedAtstring · date-timeRequired

get/api/access-request/{id}

GET /marketplace/api/access-request/{id} HTTP/1.1
Host: na.api.immutacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

200Success

{
  "id": "text",
  "requestingUser": {
    "id": 1,
    "iamId": "text",
    "globalUserId": "123e4567-e89b-12d3-a456-426614174000",
    "username": "text",
    "name": "text",
    "email": "text",
    "authorizations": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    }
  },
  "user": {
    "id": 1,
    "iamId": "text",
    "globalUserId": "123e4567-e89b-12d3-a456-426614174000",
    "username": "text",
    "name": "text",
    "email": "text",
    "authorizations": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    }
  },
  "formVersion": "text",
  "form": null,
  "type": "DATA_ACCESS",
  "metadata": null,
  "status": "PENDING",
  "expiration": "2026-01-01T00:00:00.000Z",
  "createdAt": "2026-01-01T00:00:00.000Z",
  "updatedAt": "2026-01-01T00:00:00.000Z",
  "dataProduct": {
    "id": "text",
    "name": "text",
    "description": "All sales records from the current fiscal year"
  },
  "asset": {
    "id": "text",
    "type": "DATA_OBJECT",
    "name": "text",
    "metadata": {
      "subjectMatterExperts": [
        {
          "id": "123e4567-e89b-12d3-a456-426614174000",
          "username": "text",
          "name": "text"
        }
      ],
      "objectPath": [
        "text"
      ],
      "technology": "Snowflake",
      "host": "text",
      "port": 1,
      "legacyType": "text",
      "dataSourceId": 1,
      "description": "text",
      "externalLink": "text"
    }
  }
}

Revoke access

Revoking access to data depends on the type of access granted:

• Data access: To revoke a user's data access to an asset or data product, remove them as a member from the data product, or revoke access through the access request (see below).
• Masking exception: To revoke a user's unmasked access to a masked column, revoke access through the access request (see below).

With the UI

1. Navigate to the Access Requests page.
2. Click the request that originally granted the user access to the data product.
3. Click Revoke Access, and then Confirm revoke access.

With the API

Ensure you set the correct global segment and use a Request app personal access token (PAT) when using the Request app API. See the Request app API docs for additional guidance or to download the OpenAPI YAML for your own client generation.

Revoke access to a data product

delete

Updates the specified access request to revoked and revokes access to data sources associated with the data product

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

requestIdstringRequired

Responses

204Success

No content

delete/api/data-product/{id}/request/{requestId}

DELETE /marketplace/api/data-product/{id}/request/{requestId} HTTP/1.1
Host: na.api.immutacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

204Success

No content