Permissions and the API

Roles and permissions

Permission	What it allows	Roles
Read requests (request.read)	Requests in your units, the products, catalog items and the accounts' sold products.	Request Manager, Request Fulfiller, Viewer, Analyst, Auditor
Work on requests (request.write)	Edit answers before a decision, cancel or close, mark items done or failed, end sold products.	Request Manager, Request Fulfiller
Approve requests (request.approve)	Approve or reject, never a request you made.	Request Manager
Request for an account (request.order)	Make requests for an account, as staff.	Request Manager
Request Management settings (request.settings)	Products and catalog items.	Request Manager
Request Management dashboard (request.dashboard)	The process's dashboard, when there is one.	Request Manager, Analyst, Auditor

Org admins have them all. Requests are seen in the unit of their catalog item; products, catalog items and sold products by everyone with Read requests in the organization.

Events

Admins can send these to a webhook (Platform → Webhooks), signed and retried like the desk's own:

Event	When
requests.submitted	A request was made.
requests.approved	A request was approved.
requests.rejected	A request was rejected, with the note.
requests.item_approved	An item of an approved request is ready for automatic fulfilment.
requests.fulfilled	Every item of a request is done.
requests.sold_product_ended	An account's sold product was ended.

Automatic fulfilment

For a product whose fulfilment is An integration does it:

1. Add a webhook for requests.item_approved under Platform → Webhooks, to the system that does the work.
2. Give that system an API token of someone with Work on requests, with the scope requests:write.
3. On each approved item, it gets the request, the account, the requester, the item (its product's key, whether it is new or a change, the sold product it changes, the approved entitlements and answers) and a callback address.
4. It reports back to the callback as often as it likes: progress (fulfilling), then done or failed, with a note and the details to keep. Details are kept on the item and, when done, on the sold product.

The API, the event's fields and the MCP tools are described in the Request Management API.