Grant the partner a support session
Platform module
POST/support-sessions/grantsupportSessions.grant
The client org's Owner (org.support_session.grant) lets its partner's staff read the client org for 1 to 24 hours with a reason (app.grant_support_session). One open session at a time (support_session_active: 422); an org without a partner refuses (support_session_no_partner: 422). Requires `Idempotency-Key`; a replay returns the original response. A rule that refuses the request returns 422 with `refusal` and `reason`.
- Requires the capability org.support_session.grant.
- OAuth scopes: org.
- Send an Idempotency-Key header. A replay with the same key returns the original response.
- Error statuses: 400, 401, 409, 422, 429. Errors are RFC 9457 problem details.
Request body: SupportSessionGrantRequest
| Field | Type | Required | Description |
|---|---|---|---|
| hours | integer | Yes | Length of the session in hours, 1 to 24.Constraints: range 1 to any |
| reason | string | Yes | Why the partner needs access.Constraints: length 1 to 500 |
{
"hours": 4,
"reason": "Help with the venue import."
}Response 201: SupportSession
| Field | Type | Required | Description |
|---|---|---|---|
| id | string (uuid) | Yes | Identifier of the support session. |
| org_id | string (uuid) | Yes | Identifier of the owning organization, derived from the parent row and never accepted from the caller. |
| created_at | string (date-time) | Yes | When the row was created. |
| created_by | string (uuid) | null | Yes | Identifier of the person who created the row. |
| updated_at | string (date-time) | Yes | When the row was last updated. |
| updated_by | string (uuid) | null | Yes | Identifier of the person who last updated the row. |
| grantee_org_id | string (uuid) | Yes | Identifier of the partner org whose staff may read while the session lasts. |
| reason | string | Yes | Why the session was granted.Constraints: length 1 to 500 |
| starts_at | string (date-time) | Yes | When access began. |
| ends_at | string (date-time) | Yes | When access ends on its own, at most 24 hours after it began. |
| ended_at | string (date-time) | null | Yes | When someone ended the session early. |
| ended_by | string (uuid) | null | Yes | Identifier of the person who ended it early. |
{
"id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
"org_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
"created_at": "2026-10-08T14:30:00Z",
"created_by": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
"updated_at": "2026-10-08T14:30:00Z",
"updated_by": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
"grantee_org_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
"reason": "Help with the venue import.",
"starts_at": "2026-10-08T14:30:00Z",
"ends_at": "2026-10-08T14:30:00Z",
"ended_at": "2026-10-08T14:30:00Z",
"ended_by": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f"
}Code samples
curl -X POST "$XOS_BASE_URL/support-sessions/grant" \
-H "Authorization: Bearer $XOS_API_KEY" \
-H "Idempotency-Key: $(uuidgen)" \
-H "Content-Type: application/json" \
-d '{"hours":4,"reason":"Help with the venue import."}'const { data } = await xos.supportSessions.grant({
"hours": 4,
"reason": "Help with the venue import."
});response = xos.support_sessions.grant({"hours": 4, "reason": "Help with the venue import."})xos support-sessions grant --data '{"hours":4,"reason":"Help with the venue import."}'