> ## Documentation Index
> Fetch the complete documentation index at: https://sidenet.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Grant tool provider

> Platform organization only, on a provider it shares (`share` = `platform_created` or `public`): lets one organization use the provider's stored credential. Without a grant a sharing organization lists the provider and its tools but every call answers `no credential for provider X` unless the caller brings a credential of its own. The grant holds no secret: the credential stays with the owner and is read on each call, so rotating it or revoking the grant applies on the next call. A caller's own credential (`tools_auth`, `runtimeAuth`) still wins over the grant. Idempotent: granting twice returns the existing grant with `200`. Refused with `422` on a provider that requires per-user credentials (`require_runtime_auth`), on a private provider, and for an organization the provider's share scope does not reach.



## OpenAPI

````yaml /api-reference/openapi.json post /v1/tool-providers/{id}/grants
openapi: 3.1.0
info:
  title: Sidenet API
  version: 1.0.0
  description: >-
    Sidenet HTTP endpoints exposed by the Sidenet Studio. All routes require an
    api key that can be generated through the studio in studio.sidenet.ai.
servers:
  - url: https://api.sidenet.ai
security:
  - bearerAuth: []
paths:
  /v1/tool-providers/{id}/grants:
    post:
      tags:
        - Tool providers
      summary: Grant tool provider
      description: >-
        Platform organization only, on a provider it shares (`share` =
        `platform_created` or `public`): lets one organization use the
        provider's stored credential. Without a grant a sharing organization
        lists the provider and its tools but every call answers `no credential
        for provider X` unless the caller brings a credential of its own. The
        grant holds no secret: the credential stays with the owner and is read
        on each call, so rotating it or revoking the grant applies on the next
        call. A caller's own credential (`tools_auth`, `runtimeAuth`) still wins
        over the grant. Idempotent: granting twice returns the existing grant
        with `200`. Refused with `422` on a provider that requires per-user
        credentials (`require_runtime_auth`), on a private provider, and for an
        organization the provider's share scope does not reach.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
            example: 8d3b1a75-6c02-4e59-b84f-27a9d5e10c63
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                org_id:
                  type: string
                  format: uuid
                  description: >-
                    The organization that may use the stored credential of this
                    provider.
                  example: 2b9d7c31-8e4f-4a2b-9d61-77c0a3f5e812
              required:
                - org_id
              additionalProperties: false
      responses:
        '200':
          description: The organization already held the grant; nothing changed
          content:
            application/json:
              schema:
                type: object
                properties:
                  grant:
                    type: object
                    properties:
                      id:
                        type: string
                        format: uuid
                      provider_id:
                        type: string
                        format: uuid
                      org_id:
                        type: string
                        format: uuid
                      org_name:
                        type: string
                        nullable: true
                      granted_at:
                        type: string
                        format: date-time
              example:
                grant:
                  id: 5e0c9a47-1f3d-4b82-a6c5-90d2e7b41f38
                  provider_id: 8d3b1a75-6c02-4e59-b84f-27a9d5e10c63
                  org_id: 2b9d7c31-8e4f-4a2b-9d61-77c0a3f5e812
                  org_name: Hotel Group X
                  granted_at: '2026-11-05T09:12:44.000Z'
        '201':
          description: The grant that was created
          content:
            application/json:
              schema:
                type: object
                properties:
                  grant:
                    type: object
                    properties:
                      id:
                        type: string
                        format: uuid
                      provider_id:
                        type: string
                        format: uuid
                      org_id:
                        type: string
                        format: uuid
                      org_name:
                        type: string
                        nullable: true
                      granted_at:
                        type: string
                        format: date-time
              example:
                grant:
                  id: 5e0c9a47-1f3d-4b82-a6c5-90d2e7b41f38
                  provider_id: 8d3b1a75-6c02-4e59-b84f-27a9d5e10c63
                  org_id: 2b9d7c31-8e4f-4a2b-9d61-77c0a3f5e812
                  org_name: Hotel Group X
                  granted_at: '2026-11-05T09:12:44.000Z'
        '400':
          description: Bad request
        '403':
          description: >-
            Not the owner: a provider shared with this organization is read-only
            here (the owner is named in `details`), and only the platform
            organization grants.
        '404':
          description: No such provider, or no such organization
        '422':
          description: >-
            The provider takes no grant (private, or per-user credentials
            required), or the organization cannot see it.
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        Organization API key, generated in studio.sidenet.ai. Backend only —
        never in a browser.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.