Request just-in-time administrator access to a computer (POST form)
POST/computers/:computerId/access
Same behavior, authorization, and responses as GET /computers/{computerId}/access, with the parameters
supplied in the request body (JSON or application/x-www-form-urlencoded) instead of the query string. An empty body is accepted and uses the defaults. Malformed JSON gives 400 with an untyped {error} body.
Required role: any authenticated user (on-behalf requests need admin).
Request
Responses
- 200
- 400
- 401
- 403
- 404
- 409
- 422
Access request queued.
Bad request. Access routes: InvalidQuery 'Invalid Access Duration Requested.' for a bad t. Any route: InvalidQuery 'illegal key "$ne" in query|body' when a query or body key starts with $. Malformed JSON gives an untyped {error} body. Sudoers routes: BadRequestError for a non-Linux computer, a missing or empty sudoers_blob, or a missing sudoersHash. Admin add/remove on Linux: BadRequestError carrying the sudoers service message. Missing or malformed ids on the admin routes are 422, not 400.
No token, or the token is invalid or expired. The body is {message}: No auth token provided when no token is sent, otherwise the token check's message (jwt expired, jwt malformed, invalid signature, invalid token, jwt signature is required). Send Authorization: Bearer <token> exactly: the server drops the first seven characters of the header and reads the rest as the token, so a different scheme or an extra space fails. If Authorization is absent, the server reads a token field in the body, then a token query parameter, then x-access-token. Routes that validate query fields reject ?token= with 400 InvalidQuery.
The token's role is not allowed for this operation, or the token's scopes exclude the route
(Scope not allowed by token).
No record has the :id in the path (the id is malformed or unknown). The body is the bare text Invalid <Type> ID (for example Invalid Computer ID, Invalid User ID) with Content-Type text/html; charset=utf-8, not JSON. Some routes return an empty body.
Access is already requested (Access has already been requested to this computer.) or already granted (Access has already been granted to this computer.); context holds the existing request id and expires. Also returned, without context, when the token lacks the caller's encoded password for a macOS or directory-bridged Linux computer (Missing encpass in token for access request.).
Same 422 variants as GET /computers/{computerId}/access.