> ## Documentation Index
> Fetch the complete documentation index at: https://docs.b3os.org/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /v1/agent-cards/grants

Allow one card to be disclosed to an agent. Signed-in users only — a request authenticated with an API key is refused, because an agent that could grant itself access would make the allowlist meaningless.

` POST /v1/agent-cards/grants `

Allow one card to be disclosed to an agent. Signed-in users only — a request
authenticated with an API key is refused, because an agent that could grant itself
access would make the allowlist meaningless.

## Request body (required)

Content type: ` application/json `

Grant details

- ` value `: type ` unknown `

  - ` oneOf alternative 1 `: type ` object `

  - ` oneOf alternative 2 `: type ` object `

    - Required fields: ` cardId `, ` connectorId `

    - ` cardId `: type ` string ` — CardID is the Airwallex card this grant allows to be disclosed. At most 255 characters, the width of the column that stores it; a longer value is refused as a 400 rather than reaching Postgres.

      - maxLength: ` 255 `

    - ` connectorId `: type ` string ` — ConnectorID names the Airwallex account holding the card. Required: redeeming the grant needs it, and a grant that cannot be redeemed must not be creatable. At most 255 characters, the width of the column that stores it.

      - maxLength: ` 255 `

    - ` maxUses `: type ` integer ` — MaxUses is the ceiling on how many handles this grant may ever mint — a grant is not a standing licence to read a card. 1 to 1000; at or below zero is floored to 1.

      - maximum: ` 1000 `

    - ` note `: type ` string ` — Note is free text shown alongside the grant. At most 1000 characters.

      - maxLength: ` 1000 `

    - ` ttlMinutes `: type ` integer ` — TTLMinutes is how long the grant stays valid. No bound is enforced here: a value outside 1 minute to 30 days is clamped to the 30-day maximum.

## Responses

### ` 200 ` — OK

Content type: ` application/json `

- ` value `: type ` object `

  - ` code `: type ` integer `

    - example: ` 200 `

  - ` data `: type ` object `

    - ` approvedAt `: type ` string `

    - ` cardId `: type ` string `

    - ` connectorId `: type ` string `

    - ` createdAt `: type ` string `

    - ` expiresAt `: type ` string `

    - ` grantedBy `: type ` string `

    - ` id `: type ` string `

    - ` maxUses `: type ` integer `

    - ` note `: type ` string `

    - ` organizationId `: type ` string `

    - ` purpose `: type ` string `

    - ` requestedBy `: type ` string `

    - ` retiredAt `: type ` string ` — RetiredAt exists for the unique index, not for the domain. idx_agent_card_grants_live keeps one live grant per card, but a partial index predicate cannot reference now(), so expiry is stamped here instead and the index excludes it. Only ever set on a row that is already past ExpiresAt, and never by a human — a human withdrawing permission sets RevokedAt, which redeem and the UI both read and this column deliberately is not.

    - ` revokedAt `: type ` string `

    - ` updatedAt `: type ` string `

    - ` uses `: type ` integer `

  - ` message `: type ` string `

    - example: ` "success" `

  - ` requestId `: type ` string `

    - example: ` "abc-123" `

### ` 400 ` — Bad Request

Content type: ` application/json `

- ` value `: type ` object `

  - ` code `: type ` integer `

  - ` details `: type ` array `

    - ` array item `: type ` unknown `

  - ` message `: type ` string `

  - ` requestId `: type ` string `

### ` 403 ` — Forbidden

Content type: ` application/json `

- ` value `: type ` object `

  - ` code `: type ` integer `

  - ` details `: type ` array `

    - ` array item `: type ` unknown `

  - ` message `: type ` string `

  - ` requestId `: type ` string `

### ` 409 ` — Conflict

Content type: ` application/json `

- ` value `: type ` object `

  - ` code `: type ` integer `

  - ` details `: type ` array `

    - ` array item `: type ` unknown `

  - ` message `: type ` string `

  - ` requestId `: type ` string `

## Request examples

### cURL

```curl
curl -X POST 'https://api.example.com/v1/agent-cards/grants' \
  -H 'Authorization: Bearer YOUR_API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{}'
```

### JavaScript

```javascript
const response = await fetch('https://api.example.com/v1/agent-cards/grants', {
  method: 'POST',
  headers: {
      "Authorization": "Bearer YOUR_API_TOKEN",
      "Content-Type": "application/json"
  },
  body: JSON.stringify({})
});

const data = await response.json();
console.log(data);
```

### Python

```python
import requests

headers = {
    'Authorization': 'Bearer YOUR_API_TOKEN'
}

response = requests.post('https://api.example.com/v1/agent-cards/grants', headers=headers, json={})
print(response.json())
```

### Go

```go
package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	body := strings.NewReader(`{}`)
	req, _ := http.NewRequest("POST", "https://api.example.com/v1/agent-cards/grants", body)
	req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
	req.Header.Set("Content-Type", "application/json")

	resp, _ := http.DefaultClient.Do(req)
	defer resp.Body.Close()
	result, _ := io.ReadAll(resp.Body)
	fmt.Println(string(result))
}
```