Get a vault request

curl --request GET \
  --url https://api2.endstate.io/v1/units/{unit_id}/vault-requests/{request_id} \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api2.endstate.io/v1/units/{unit_id}/vault-requests/{request_id}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api2.endstate.io/v1/units/{unit_id}/vault-requests/{request_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api2.endstate.io/v1/units/{unit_id}/vault-requests/{request_id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api2.endstate.io/v1/units/{unit_id}/vault-requests/{request_id}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api2.endstate.io/v1/units/{unit_id}/vault-requests/{request_id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "id": "00000000-0000-4000-8000-000000000000",
  "unit_id": "22222222-2222-4222-8222-222222222222",
  "vault": {
    "id": "33333333-3333-4333-8333-333333333333",
    "name": "Alliance Vault",
    "logo_url": "https://vault.example/logo.png",
    "key_mode": "managed"
  },
  "status": "unvault_waiting",
  "notes": null,
  "rejection_reason": null,
  "decided_at": "2026-06-16T09:30:00.000Z",
  "available_at": "2026-09-04T12:00:00.000Z",
  "hold": null,
  "ready_to_ship": false,
  "dispatched_at": null,
  "expires_at": null,
  "created_at": "2026-06-15T12:00:00.000Z"
}

GET

units

{unit_id}

vault-requests

{request_id}

Get a vault request

curl --request GET \
  --url https://api2.endstate.io/v1/units/{unit_id}/vault-requests/{request_id} \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api2.endstate.io/v1/units/{unit_id}/vault-requests/{request_id}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api2.endstate.io/v1/units/{unit_id}/vault-requests/{request_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api2.endstate.io/v1/units/{unit_id}/vault-requests/{request_id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api2.endstate.io/v1/units/{unit_id}/vault-requests/{request_id}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api2.endstate.io/v1/units/{unit_id}/vault-requests/{request_id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "id": "00000000-0000-4000-8000-000000000000",
  "unit_id": "22222222-2222-4222-8222-222222222222",
  "vault": {
    "id": "33333333-3333-4333-8333-333333333333",
    "name": "Alliance Vault",
    "logo_url": "https://vault.example/logo.png",
    "key_mode": "managed"
  },
  "status": "unvault_waiting",
  "notes": null,
  "rejection_reason": null,
  "decided_at": "2026-06-16T09:30:00.000Z",
  "available_at": "2026-09-04T12:00:00.000Z",
  "hold": null,
  "ready_to_ship": false,
  "dispatched_at": null,
  "expires_at": null,
  "created_at": "2026-06-15T12:00:00.000Z"
}

Authorizations

Authorization

string

header

required

Use Authorization: Bearer end_sk_* for partner API keys (e.g. end_sk_AbCd_example_api_key).

Path Parameters

unit_id

string<uuid>

required

Unit id.

Example:

"22222222-2222-4222-8222-222222222222"

request_id

string<uuid>

required

Vault request id.

Example:

"00000000-0000-4000-8000-000000000000"

Response

The vault request.

string<uuid>

required

Vault request id.

unit_id

string<uuid>

required

The unit the request is for.

vault

object

required

The vault the request names.

Show child attributes

status

enum<string>

required

Where the request is now. pending: the owner approved and the vault has not decided. submitted: the vault confirmed it has the item and Endstate is recording it. active: the item is vaulted. unvault_waiting: the owner asked for the item back and the waiting period runs, or the item is ready to ship. unvaulting: the vault dispatched the item and Endstate is completing the unvault. unvaulted: the unvault is complete. cancelled, expired and rejected end a request that never vaulted the item, and never change again. failed: the item was not recorded as vaulted; the request becomes active if the item is later recorded as vaulted after all. A status can move back. A cancel of the unvault, once recorded, returns unvault_waiting to active, and unvaulting too in the rare case one is recorded after the dispatch. Rarely, the network revises its latest records, which can return unvaulted to unvaulting or active, unvault_waiting or unvaulting to active, and active to failed. Read the status as the request's current state, not as a one-way log.

Available options:

pending,

submitted,

active,

unvault_waiting,

unvaulting,

unvaulted,

cancelled,

expired,

rejected,

failed

notes

string | null

required

Free text the vault's staff left when they confirmed or rejected the request. Null when they left none.

rejection_reason

enum<string> | null

required

Why the request was rejected: the vault's reason, or owner_changed when the unit changed hands after its owner approved.

Available options:

wrong_item,

chip_unreadable,

unacceptable,

owner_changed,

null

decided_at

string<date-time> | null

required

When the vault confirmed or rejected the request, or Endstate rejected it; null until then.

available_at

string<date-time> | null

required

When the unvault's waiting period ends. Null until the owner's request to unvault is recorded, and again if the owner cancels it. A hold stops the clock, and lifting it moves this later by the time the hold lasted.

hold

object | null

required

The hold on a waiting unvault, or null. by says who placed it, the vault or the brand, and reason is their text. While it stands the item is not ready to ship.

Show child attributes

ready_to_ship

boolean

required

Whether the item is ready to ship: its waiting period has ended and nothing holds it. The vault records dispatch with a tap of the item from then on.

dispatched_at

string<date-time> | null

required

When the vault's tap recorded the item's dispatch. Endstate then completes the unvault; the vault hands the item over once the request reads unvaulted.

expires_at

string<date-time> | null

required

When a pending request expires; null once it has moved on.

created_at

string<date-time>

required

When the owner's approval opened the request.

Overview

Endpoints

Get a vault request

Authorizations

Path Parameters

Response