> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dacard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Credential requests

> Request access to a teammate's integration credentials. The integration owner approves or rejects.

Request access to a teammate's integration credentials. The integration owner receives a notification and approves or rejects. Used by team members who need read or write access to an integration they don't own.

## Read a pending request (public preview)

```bash theme={null}
curl -X GET https://app.dacard.ai/api/credential-requests/{token}
```

The `{token}` is delivered to the requester via email. Public route; the token is the only auth.

Response:

```json theme={null}
{
  "integrationName": "GitHub (Acme org)",
  "ownerEmail": "founder@acme.com",
  "scope": "read",
  "expiresAt": "2026-05-13T12:00:00Z",
  "status": "pending"
}
```

## Approve or reject

```bash theme={null}
curl -X POST https://app.dacard.ai/api/credential-requests/{token} \
  -H "Authorization: Bearer $DACARD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "decision": "approve" }'
```

| Property | Value |
| - | - |
| **Auth (POST)** | Required (the integration owner) |
| **Idempotent** | Yes |

Body: `{ "decision": "approve" }` or `{ "decision": "reject" }`.

## Errors

| Status | Code | When |
| - | - | - |
| 401 | `AUTH_REQUIRED` | POST without session. |
| 403 | `FORBIDDEN` | Caller is not the integration owner. |
| 404 | `Token invalid or expired` | Bad or aged-out token. |
| 410 | `TEAM_INVITE_EXPIRED` | TTL passed (reused for credential request expiry). |
| 500 | `INTERNAL_ERROR` | Write failed. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.