purposes, Instant expiration)](https://api.docs.inrupt.com/docs/developer-tools/api/java/inrupt-client/latest/com/inrupt/client/accessgrant/AccessGrantClient.html#requestAccess\(java.net.URI,java.util.Set,java.util.Set,java.util.Set,java.time.Instant\)) can accept the request details as individual parameters:
For example, the following code uses ExamplePrinter’s instantiated AccessGrantClient to create a Read request:
public AccessRequest createReadRequest(List<String> resourceURLs, String resourceOwner) {
URI resourceOwnerURI = URI.create(resourceOwner);
Set<URI> resourcesURIs = resourceURLs.stream().map(URI::create).collect(Collectors.toSet());
Set<String> modes = Set.of("Read"); // Available modes are "Read", "Write", and "Append".
Set<URI> purposes = Set.of(
URI.create("https://purpose.example.com/PhotoPrinting"),
URI.create("https://purpose.example.com/ServiceProvision"));
Instant currentInstant = Instant.now();
Instant expiration = currentInstant.plus(30, ChronoUnit.MINUTES);
AccessRequest accessRequest = accessgrantClient.requestAccess(
resourceOwnerURI,
resourcesURIs,
modes,
purposes,
expiration).toCompletableFuture().join();
return accessRequest;
}
{% endtab %}
{% endtabs %}
### Create an Access Grant
Resource owners can use their access management application to view Access Requests made to them and decide whether to grant the requested access or not. If the resource owner decides to grant an Access Request, the access management application can call [AccessGrantClient.grantAccess](https://api.docs.inrupt.com/docs/developer-tools/api/java/inrupt-client/latest/com/inrupt/client/accessgrant/AccessGrantClient.html#grantAccess\(com.inrupt.client.accessgrant.AccessRequest\)) to create an Access Grant. Optionally, the application can also call [AccessGrantClient.verify](https://api.docs.inrupt.com/docs/developer-tools/api/java/inrupt-client/latest/com/inrupt/client/accessgrant/AccessGrantClient.html#verify\(com.inrupt.client.accessgrant.AccessCredential\)) to verify the Access Request before displaying it to the user.
For example, the user (the resource owner) who visited ExamplePrinter’s website to print pictures can login to a trusted access management application. The access management application can display the Access Request made to the user by the ExamplePrinter. If the user decides to grant the requested access, the application can create an Access Grant. The access manage application has a backend server that uses various [AccessGrantClient](https://api.docs.inrupt.com/docs/developer-tools/api/java/inrupt-client/latest/com/inrupt/client/accessgrant/AccessGrantClient.html) methods, namely:
#### 1. Instantiate the Grantor’s AccessGrantClient
To instantiate an [AccessGrantClient](https://api.docs.inrupt.com/docs/developer-tools/api/java/inrupt-client/latest/com/inrupt/client/accessgrant/AccessGrantClient.html) for the grantor/resource owner, call the constructor with the following parameters:
| Parameters | Descriptions |
|---|
| Access Grant Service URL | The root URL of the ESS Access Grant service |
| Authenticated Session | The authenticated session of the user (the resource owner). |
For example, the following instantiates an [AccessGrantClient](https://api.docs.inrupt.com/docs/developer-tools/api/java/inrupt-client/latest/com/inrupt/client/accessgrant/AccessGrantClient.html) using Inrupt PodSpaces Access Grant Service URI and the resource owner’s session:
public class AccessManagementAppRequestHandler {
private final URI PS_ACCESS_GRANT_URI = URI.create("https://vc.inrupt.com");
private Session userSession; // Session for a resource owner.
// ... Logic to initialize a session for a resource owner has been omitted for brevity.
AccessGrantClient agClientForUser = new AccessGrantClient(PS_ACCESS_GRANT_URI)
.session(userSession);
// ...
// ...
}
#### 2. Get the Access Requests Made to the User
{% hint style="info" %}
The user can only retrieve Access Requests where the user is either the requestor (creator of the Access Request) or the resource owner (recipient of the Access Request).
{% endhint %}
If the Access Request’s id is known, the application can directly retrieve the Access Request using [AccessGrantClient.fetch](https://api.docs.inrupt.com/docs/developer-tools/api/java/inrupt-client/latest/com/inrupt/client/accessgrant/AccessGrantClient.html#fetch\(java.net.URI,java.lang.Class\)) with the Access Request’s id.
The **`fetch`** operation can return expired or future Access Requests.
```java
// String requestID = "https://vc.{ESS DOMAIN}/vc/xxxxxx...";
AccessRequest accessRequest = agClientForUser.fetch(URI.create(requestID), AccessRequest.class)
.toCompletableFuture()
.join();
```
#### 3. Verify the Requested Access
To [verify the Access Request](https://docs.inrupt.com/ess/latest/services/service-access-grant/service-access-grant-verifier/), use [AccessGrantClient.verify](https://api.docs.inrupt.com/docs/developer-tools/api/java/inrupt-client/latest/com/inrupt/client/accessgrant/AccessGrantClient.html#verify\(com.inrupt.client.accessgrant.AccessCredential\)), passing it the Access Request.
For example, the following example uses [AccessGrantClient.verify](https://api.docs.inrupt.com/docs/developer-tools/api/java/inrupt-client/latest/com/inrupt/client/accessgrant/AccessGrantClient.html#verify\(com.inrupt.client.accessgrant.AccessCredential\)) to verify an Access Request, checking for errors and warning.
```java
// AccessRequest accessRequest = ...;
AccessCredentialVerification verification = agClientForUser.verify(accessRequest).toCompletableFuture().join();
if (verification.getChecks().isEmpty() || !verification.getErrors().isEmpty()) {
// Handle invalid Access Request
}
if (!verification.getWarnings().isEmpty()) {
// Handle warnings
}
```
#### 4. Create the Access Grant
For a valid Access Request, if the resource owner decides to grant the requested access, the application can call [AccessGrantClient.grantAccess](https://api.docs.inrupt.com/docs/developer-tools/api/java/inrupt-client/latest/com/inrupt/client/accessgrant/AccessGrantClient.html#grantAccess\(com.inrupt.client.accessgrant.AccessRequest\)), passing in the specific Access Request to grant.
For example:
```java
AccessGrant accessGrant = agClientForUser.grantAccess(accessRequest).toCompletableFuture().join();
```