Access Requests and Grants

Inrupt's Enterprise Solid Server (ESS) supports an authorization mechanism based on Access Requests and Grants. With Access Requests and Grants:

1. An agent sends an Access Request to the resource owner . In ESS, the Access Request is serialized as a VC. This request includes the specific access mode (e.g. Read , Write , Append ), the resources to access, the purpose the data will be used, etc.

2. The resource owner decides to deny or grant the Access Request:

• For an approved request, ESS creates an Access Grant with an approved status.

• For a denied request, ESS creates an Access Grant with a denied status.

  In ESS, the Access Grant is serialized as a VC, and the resource owner can revoke the Access Grant in the future.

1. Once the resource owner approves the Access Grant, the requesting agent can retrieve the resource with a direct HTTP request using their ESS Access Token. The Access Grant is a receipt — ESS checks the grant server-side when the agent makes the request, so no additional token exchange is needed.

Note:

• An Access Request for a Container, by default, also applies to the Container’s descendants, unless explicitly specified otherwise in the request (See inherit: false ).

• An Access Grant for a Container, by default, also applies to the Container’s descendants, unless explicitly specified otherwise in the grant (See inherit: false ).

Access Grant Effective Period

An active (i.e., not revoked) access grant is effective:

• Starting from its issuanceDate to its expirationDate , and

• While its credentialSubject.id (the grantor) remains a resource owner .

Services to Support Access Requests and Grants

To support access requests and grants, ESS provides the following services:

• Access Grant Service. The Access Grant service is responsible for issuing, verifying, and revoking Verifiable Credentials.

• Authorization Service to manage the ACPs.