Show which areas need approval
/api/v2/account/api-accessLists every portal area (area is the portal key used in scopes and event names, label its name) with whether it needs manual approval (sensitive) and where your client stands (status). Some areas, by default Occupational Health and DBS & Right To Work, are sensitive: their API calls, and the webhook events of the same area, are refused until Hub staff approve a request made by a user of your client in the Hub under API access. Use this call to show a clear message before you call such an area, instead of waiting for a 403.
status is not_required (the area is open), not_requested (nothing asked yet), pending (a request is waiting for review), approved (calls and events work), rejected (the last request was not approved) or revoked (staff withdrew an earlier approval). decided_at is when the current state was decided and is null for not_required, not_requested and pending. The reason staff gave for a rejection or a withdrawal is shown to your users in the Hub and in the email, never in the API. The states match the error codes a refused call returns: api_access_not_approved, api_access_pending, api_access_rejected and api_access_revoked.
Works with any valid key, whatever its scopes, and counts against the key's hourly limit. Read only: nothing is changed, sent or charged.
Request
Bearer token (bearerAuth)
Access token obtained from `POST /api/v1/auth/token`. Expires in 3600 seconds.
Provide your bearer token in the Authorization header when making requests to protected resources.
Example: Authorization: Bearer ********************
Responses
Body application/json
One row per portal area.
- areastringrequired
The portal key, as used in scopes (`occupational-health:*`) and as the first part of event names (`occupational-health.request.submitted`).
Example:occupational-health
- labelstringrequired
The name of the area to show to people.
Example:Occupational Health
- statusstringrequired
Where your client stands: `not_required` (the area is open), `not_requested` (nothing asked yet), `pending` (a request waits for review), `approved` (calls and webhook events work), `rejected` (the last request was not approved) or `revoked` (staff withdrew an earlier approval). The reason for a rejection or a withdrawal is shown to your users in the Hub and in an email, never here.
enum: "not_required" | "not_requested" | "pending" | "approved" | "rejected" | "revoked"Example:approved
- sensitivebooleanrequired
Whether the area needs manual approval. Hub staff choose which areas do, so read it instead of assuming.
Example:true
- decided_atstring | null<date-time>required
When the current state was decided (approval, rejection or withdrawal), in UTC. Null for `not_required`, `not_requested` and `pending`.
Example:2026-11-03T10:15:00Z
curl --location --request GET 'https://hub.hbcompliance.co.uk/api/v2/account/api-access' \
--header 'Authorization: Bearer <token>'{
"data": [
{
"area": "occupational-health",
"label": "Occupational Health",
"sensitive": true,
"status": "approved",
"decided_at": "2026-11-03T10:15:00Z"
}
]
}