Skip to main content
The AccessOwl API is a REST API that lets you manage access requests, revocations, applications, policies, and users programmatically. This API drives your own AccessOwl organization. It is not how an application gets connected to AccessOwl. Those integrations are built by AccessOwl against each app’s own interface, so no SCIM or SAML endpoint is needed on the app side. See the Integrations overview for how that works.

​
Base URL

All requests are made to:
The current API version is v1, so every endpoint is prefixed with /api/v1.

​
Authentication

The API uses Bearer token authentication. Pass your AccessOwl API token in the Authorization header on every request:
API tokens are created and managed from within AccessOwl by an organization admin. API tokens are created with either read or write permission. A read token can call every GET endpoint, but returns 403 Access denied on mutating requests (POST, PUT, PATCH, DELETE), including POST /api/v1/access_requests/{access_request_id}/grant. If you get a 403 on a request you expect to work, check the token’s permission in AccessOwl. Permission is set when the token is created and can’t be changed afterwards, so create a new token with write permission and replace the old one. Treat tokens as secrets: store them securely and never commit them to source control. Requests without a valid token return 401 Unauthorized.

​
Rate limiting

Each API token is limited to 1,000 requests per hour. Exceeding the limit returns 429 Too Many Requests with a Retry-After header indicating how many seconds to wait before retrying:
When you receive a 429, pause for the number of seconds in Retry-After before sending further requests.

​
Idempotency

Mutating requests (POST, PUT, PATCH, DELETE) accept an optional Idempotency-Key header so a retried request doesn’t perform the same operation twice.
Generate a unique key for each operation you want to make idempotent. We recommend a V4 UUID, or another random string with enough entropy to avoid collisions. The key must be 1–255 characters and is remembered for 14 days. Unlike some APIs, AccessOwl does not replay the original response. Instead, the first request with a given key is processed normally and every later request reusing that key is rejected:
  • Same key, same request body: returns 409 Conflict. The duplicate is not processed again. A 409 confirms that a request with this key was already received — it does not report the outcome of the original request, which may still have failed. If you need the result, query the relevant resource directly.
  • Same key, different request body: returns 422 Unprocessable Entity. A key must not be reused for a different operation.
  • Missing or malformed key: returns 400 Bad Request.
To retry safely after a network error or timeout, send the same request with the same key. You’ll either get the original response (if the first request hadn’t reached us) or a 409, telling you the operation was already submitted and you should not send it again.

​
Responses

The API returns JSON. Successful requests return a 2xx status code; client and server errors return 4xx and 5xx codes respectively, with an error payload describing what went wrong.

​
FAQ

There is no AccessOwl MCP server today. This REST API is the programmatic surface for managing applications, reading current access, creating access requests and marking them granted. If the goal is an AI agent handling access work, that already works through Claude in Slack with no MCP involved, see what you can ask it.
Last modified on August 28, 2026