curl --request PATCH \
--url https://{region}.api.plerion.com/v1/tenant/aws/access-grants/{id} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: <content-type>' \
--data '
{
"reviewDecision": "keep",
"reviewComment": "Vendor export feed, contract renewed 2026-07",
"grantee": "platform-team",
"nextReviewAt": "2027-01-31T00:00:00.000Z"
}
'import requests
url = "https://{region}.api.plerion.com/v1/tenant/aws/access-grants/{id}"
payload = {
"reviewDecision": "keep",
"reviewComment": "Vendor export feed, contract renewed 2026-07",
"grantee": "platform-team",
"nextReviewAt": "2027-01-31T00:00:00.000Z"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "<content-type>"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': '<content-type>'},
body: JSON.stringify({
reviewDecision: 'keep',
reviewComment: 'Vendor export feed, contract renewed 2026-07',
grantee: 'platform-team',
nextReviewAt: '2027-01-31T00:00:00.000Z'
})
};
fetch('https://{region}.api.plerion.com/v1/tenant/aws/access-grants/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{region}.api.plerion.com/v1/tenant/aws/access-grants/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'reviewDecision' => 'keep',
'reviewComment' => 'Vendor export feed, contract renewed 2026-07',
'grantee' => 'platform-team',
'nextReviewAt' => '2027-01-31T00:00:00.000Z'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: <content-type>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{region}.api.plerion.com/v1/tenant/aws/access-grants/{id}"
payload := strings.NewReader("{\n \"reviewDecision\": \"keep\",\n \"reviewComment\": \"Vendor export feed, contract renewed 2026-07\",\n \"grantee\": \"platform-team\",\n \"nextReviewAt\": \"2027-01-31T00:00:00.000Z\"\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "<content-type>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://{region}.api.plerion.com/v1/tenant/aws/access-grants/{id}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "<content-type>")
.body("{\n \"reviewDecision\": \"keep\",\n \"reviewComment\": \"Vendor export feed, contract renewed 2026-07\",\n \"grantee\": \"platform-team\",\n \"nextReviewAt\": \"2027-01-31T00:00:00.000Z\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{region}.api.plerion.com/v1/tenant/aws/access-grants/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = '<content-type>'
request.body = "{\n \"reviewDecision\": \"keep\",\n \"reviewComment\": \"Vendor export feed, contract renewed 2026-07\",\n \"grantee\": \"platform-team\",\n \"nextReviewAt\": \"2027-01-31T00:00:00.000Z\"\n}"
response = http.request(request)
puts response.read_body{
"data": {
"id": "0f9a1c3e-5b7d-4c21-9e8f-2a6b4d10c7f3",
"organizationId": "dc16d897-7f52-4b73-be57-96c7c9a853da",
"tenantId": "42749bc1-c99b-4c2c-a081-a6cda9370081",
"integrationId": "458511a1-9bc2-4fce-97a0-0e3139588e6e",
"assetId": "prn:assets:458511a1-9bc2-4fce-97a0-0e3139588e6e:aws:s3:bucket:ap-southeast-2:acme-prod-exports",
"resourceType": "AWS::S3::Bucket",
"awsAccountId": "111122223333",
"region": "ap-southeast-2",
"assetName": "acme-prod-exports",
"service": "AWS::S3",
"grantType": "resource_policy_statement",
"mechanism": "resource_policy",
"principal": "arn:aws:iam::444455556666:root",
"principalType": "aws_account",
"principalLabel": "Vendor - External",
"principalDetail": null,
"principalAccountId": "444455556666",
"grantScope": "cross-org",
"grantOrigin": "external",
"allowedActions": [
"s3:GetObject",
"s3:ListBucket"
],
"allowedNotActions": null,
"conditions": {
"StringEquals": {
"aws:PrincipalOrgID": "o-abc123"
}
},
"blockedByRcp": false,
"rcpStatus": "not-applicable",
"hasRuntimeConditions": true,
"trustStatus": "untrusted",
"trustedUntil": "2027-01-31T00:00:00.000Z",
"trustLapseReason": "expired",
"grantee": "platform-team",
"reviewDecision": "keep",
"reviewComment": "Vendor export feed, contract renewed 2026-07",
"nextReviewAt": "2027-01-31T00:00:00.000Z",
"reviewedBy": "ci-audit-key (API key)",
"reviewedAt": "2026-07-20T05:41:09.000Z",
"reviewHistory": [
{
"reviewedBy": "my-api-key (API key)",
"reviewedAt": "2026-07-20T05:41:09.000Z",
"decision": "keep",
"grantee": "platform-team",
"comment": "Vendor export feed, contract renewed 2026-07",
"nextReviewAt": "2027-01-31T00:00:00.000Z",
"trustedUntil": "2027-01-31T00:00:00.000Z",
"trustLapseReason": "expired"
}
],
"firstObservedAt": "2026-05-14T02:11:47.000Z",
"lastObservedAt": "2026-07-28T01:03:12.000Z"
}
}{
"errors": [
{
"field": "<string>",
"code": "<string>",
"message": "<string>"
}
]
}{
"errors": [
{
"code": "<string>",
"message": "<string>"
}
]
}{
"message": "Internal server error"
}Review an AWS access grant
Record a review decision on a single access grant. Send only the fields you want to change. Each accepted request updates the current review state and appends an entry to the grant’s review history.
curl --request PATCH \
--url https://{region}.api.plerion.com/v1/tenant/aws/access-grants/{id} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: <content-type>' \
--data '
{
"reviewDecision": "keep",
"reviewComment": "Vendor export feed, contract renewed 2026-07",
"grantee": "platform-team",
"nextReviewAt": "2027-01-31T00:00:00.000Z"
}
'import requests
url = "https://{region}.api.plerion.com/v1/tenant/aws/access-grants/{id}"
payload = {
"reviewDecision": "keep",
"reviewComment": "Vendor export feed, contract renewed 2026-07",
"grantee": "platform-team",
"nextReviewAt": "2027-01-31T00:00:00.000Z"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "<content-type>"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': '<content-type>'},
body: JSON.stringify({
reviewDecision: 'keep',
reviewComment: 'Vendor export feed, contract renewed 2026-07',
grantee: 'platform-team',
nextReviewAt: '2027-01-31T00:00:00.000Z'
})
};
fetch('https://{region}.api.plerion.com/v1/tenant/aws/access-grants/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{region}.api.plerion.com/v1/tenant/aws/access-grants/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'reviewDecision' => 'keep',
'reviewComment' => 'Vendor export feed, contract renewed 2026-07',
'grantee' => 'platform-team',
'nextReviewAt' => '2027-01-31T00:00:00.000Z'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: <content-type>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{region}.api.plerion.com/v1/tenant/aws/access-grants/{id}"
payload := strings.NewReader("{\n \"reviewDecision\": \"keep\",\n \"reviewComment\": \"Vendor export feed, contract renewed 2026-07\",\n \"grantee\": \"platform-team\",\n \"nextReviewAt\": \"2027-01-31T00:00:00.000Z\"\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "<content-type>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://{region}.api.plerion.com/v1/tenant/aws/access-grants/{id}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "<content-type>")
.body("{\n \"reviewDecision\": \"keep\",\n \"reviewComment\": \"Vendor export feed, contract renewed 2026-07\",\n \"grantee\": \"platform-team\",\n \"nextReviewAt\": \"2027-01-31T00:00:00.000Z\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{region}.api.plerion.com/v1/tenant/aws/access-grants/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = '<content-type>'
request.body = "{\n \"reviewDecision\": \"keep\",\n \"reviewComment\": \"Vendor export feed, contract renewed 2026-07\",\n \"grantee\": \"platform-team\",\n \"nextReviewAt\": \"2027-01-31T00:00:00.000Z\"\n}"
response = http.request(request)
puts response.read_body{
"data": {
"id": "0f9a1c3e-5b7d-4c21-9e8f-2a6b4d10c7f3",
"organizationId": "dc16d897-7f52-4b73-be57-96c7c9a853da",
"tenantId": "42749bc1-c99b-4c2c-a081-a6cda9370081",
"integrationId": "458511a1-9bc2-4fce-97a0-0e3139588e6e",
"assetId": "prn:assets:458511a1-9bc2-4fce-97a0-0e3139588e6e:aws:s3:bucket:ap-southeast-2:acme-prod-exports",
"resourceType": "AWS::S3::Bucket",
"awsAccountId": "111122223333",
"region": "ap-southeast-2",
"assetName": "acme-prod-exports",
"service": "AWS::S3",
"grantType": "resource_policy_statement",
"mechanism": "resource_policy",
"principal": "arn:aws:iam::444455556666:root",
"principalType": "aws_account",
"principalLabel": "Vendor - External",
"principalDetail": null,
"principalAccountId": "444455556666",
"grantScope": "cross-org",
"grantOrigin": "external",
"allowedActions": [
"s3:GetObject",
"s3:ListBucket"
],
"allowedNotActions": null,
"conditions": {
"StringEquals": {
"aws:PrincipalOrgID": "o-abc123"
}
},
"blockedByRcp": false,
"rcpStatus": "not-applicable",
"hasRuntimeConditions": true,
"trustStatus": "untrusted",
"trustedUntil": "2027-01-31T00:00:00.000Z",
"trustLapseReason": "expired",
"grantee": "platform-team",
"reviewDecision": "keep",
"reviewComment": "Vendor export feed, contract renewed 2026-07",
"nextReviewAt": "2027-01-31T00:00:00.000Z",
"reviewedBy": "ci-audit-key (API key)",
"reviewedAt": "2026-07-20T05:41:09.000Z",
"reviewHistory": [
{
"reviewedBy": "my-api-key (API key)",
"reviewedAt": "2026-07-20T05:41:09.000Z",
"decision": "keep",
"grantee": "platform-team",
"comment": "Vendor export feed, contract renewed 2026-07",
"nextReviewAt": "2027-01-31T00:00:00.000Z",
"trustedUntil": "2027-01-31T00:00:00.000Z",
"trustLapseReason": "expired"
}
],
"firstObservedAt": "2026-05-14T02:11:47.000Z",
"lastObservedAt": "2026-07-28T01:03:12.000Z"
}
}{
"errors": [
{
"field": "<string>",
"code": "<string>",
"message": "<string>"
}
]
}{
"errors": [
{
"code": "<string>",
"message": "<string>"
}
]
}{
"message": "Internal server error"
}Authorizations
Bearer API Key. For example, "Bearer {Tenant API Key}"
Headers
Bearer API Key. For example, "Bearer {Tenant API Key}"
application/json
Path Parameters
The ID of the access grant.
Body
Include at least one review field, or the request returns a 400. Send null to clear a field.
The decision on this grant. keep accepts it, remove marks it for revocation, review_later defers it, and trust_until_review trusts it until nextReviewAt. Send null to clear it.
trust_until_review is the only decision that changes classification. It requires nextReviewAt, which must be in the future and no more than 366 days ahead, and it sets trustStatus to trusted and trustedUntil to that date. Sending it without a usable date returns a 400. Plerion records a digest of the grant's actions, conditions and resource scope at that moment; if the grant is later widened, trust ends early, reviewDecision and nextReviewAt are cleared, and trustLapseReason becomes content_changed. Extending the review date on a grant whose permissions changed since it was trusted returns a 400.
Available options: keep, remove, review_later, trust_until_review
"keep"
Free-text note explaining the decision. Maximum 2000 characters.
2000"Vendor export feed, contract renewed 2026-07"
Free-text grantee for this grant, in whatever form your organization uses: a team, a person, or a service. Maximum 256 characters.
256"platform-team"
When this grant should next be reviewed, as an ISO 8601 date-time string. Required when reviewDecision is trust_until_review, where it also sets the end of the trust window.
"2027-01-31T00:00:00.000Z"
Response
The updated access grant
Show child attributes
Show child attributes
Was this page helpful?