Authorization

Use a server-side API key with the listed grants and permitted resource access.

identities:access:manage

Request headers

X-Api-Keyrequired: Your server-side integration credential.
Idempotency-Keyrequired: Stable key for this intended action. Reuse it for retries of the same request.
Content-Typeapplication/json: Encode the request body as JSON.

Path parameters

idstring · required: Opaque identifier in the authorized resource scope. Nested identifiers must belong to their parent resource.

Request body

resourceobject · required: The resource values for this request.
Show object fields
typestring · required
traveler, case, order
idstring · required
Opaque resource identifier. Treat this value as a string.
scopesarray · required: The scopes values for this request.
customerIdstring · optional: Required business context for a traveler relationship. For a case or order, the service derives it from the resource.
expiresAtstring · optional: Optional expiry of this access relationship.

Response

201Created

Returns the authorized resource or result for this operation. List results use items, nextCursor, and hasMore.

Behavior to account for

Provisioning access is separate from issuing sessions. Requested resources must already lie within the integration’s administratively approved resource and delegation policy.

Errors

Authentication failures return 401 or 403. Inaccessible resources return 404. Business and idempotency conflicts return 409. Rate limits return 429 with retry guidance.

Error handling guide

curl --request POST 'https://api.wincora.com/api/v1/tenant/customer-identities/id_example/access' \ --header 'X-Api-Key: YOUR_API_KEY' \ --header 'Idempotency-Key: request-example-001' \ --header 'Content-Type: application/json' \ --data '{ "resource": { "type": "case", "id": "case_example" }, "scopes": [ "traveler:cases:read", "traveler:documents:write" ] }'

import os import requests response = requests.request( 'POST', 'https://api.wincora.com/api/v1/tenant/customer-identities/id_example/access', headers={ "X-Api-Key": os.environ["WINCORA_API_KEY"], "Idempotency-Key": "request-example-001", "Content-Type": "application/json" }, json={ "resource": { "type": "case", "id": "case_example" }, "scopes": [ "traveler:cases:read", "traveler:documents:write" ] }, timeout=30, ) response.raise_for_status() result = response.json()