Access on request

Access on request gives a member a vault, or more in a vault they already open, until a set time. The member asks. Someone who manages the vault gives it, or declines. When the time comes, the access ends by itself on every device and on ZestSSH Cloud: nobody has to take it back.

For example, Sam asks for Edit in the vault that holds web-01.example.com for 2 hours. Priya, who manages that vault, gives it. Two hours later it is gone.

Who can ask, and who can answer

Asking: any member below admin. Owners and admins open every vault already. Owners-only vaults cannot be asked for.
Answering: someone who has Manage in the vault for good and ranks above the member who asks. They can give only levels they have in that vault themselves, and never Manage.

A member cannot see the names of vaults they do not open. To ask for one of those, they describe it in a note, and whoever answers picks the vault.

Ask for access

Open Team: on a computer, in the sidebar; on a phone, More, then the team’s name under Team.
On the Overview, under Access for a set time, choose Ask for access.
Choose what you need:
- More in a vault I open, then pick the Vault; or
- A vault I can’t open, then say which one in the Note.
Choose the Access: Connect, Use or Edit. In a vault you open, only levels above what you have are offered.
Choose For how long: 1, 2, 4 or 8 hours, or 1, 3, 7 or 30 days. It starts at 2 hours.
Add a Note if you like: what it is for. The note is encrypted with the team’s key, so only the team’s members can read it, not ZestSSH Cloud.
Choose Send request. You see Request sent. You’ll be told when it’s answered.

The request shows under Access for a set time as You asked for access, Waiting for an answer, with Withdraw.

At most five of your requests can wait at once. Otherwise you see Five of your requests are waiting. Withdraw one first.
Asking again for the same vault replaces your request for it.
A request nobody answers lapses after seven days, and you are told: It waited seven days without an answer and was removed. You can ask again.

What the levels give:

Level	What it gives
Connect	Connect to the vault’s hosts. Its passwords and keys stay hidden.
Use	Connect, and see and copy the vault’s passwords and keys.
Edit	Use, and add, change and delete the vault’s items.

See Vaults, access and roles.

Answer a request

People who can answer get a notice, Someone asks for access in the team, and see the request on the Overview under Needs attention, such as “Sam asks for access”, with the vault, the level, the time and the note.
Choose Answer. The Give Sam access window opens with the request filled in.
If the request names no vault, read the note and Pick the vault they mean. A vault the request names cannot be changed.
Check Access and For how long. You can change both; the levels offered are the ones you have in that vault. The window shows when it Ends.
Choose Give access. Giving access needs a sign-in from the last ten minutes: if ZestSSH asks you to Confirm it’s you, choose Sign in again.

You see “Sam has access until” the end time, and Sam is told You were given access in the team.

To say no, choose Decline. Nothing is kept of a declined request, and the member is told The access you asked for was not given. You can ask again.

Two warnings can show in the window:

With Use or Edit they can see the passwords and keys in this vault. Ending their access doesn’t take back what they saw.
This vault signs people in with certificates, and their role has no user name on its hosts. They can open the vault but not connect.

Give access without a request

Anyone who manages a vault sees Give someone a vault, or more in one, until a time you set. It ends by itself. under Access for a set time. Choose Give access, pick the Member, the Vault, the Access and For how long, then choose Give access.

Giving again before the time is up replaces what was given, with the new end time.

When access ends

At the end time the access ends by itself, whether or not anyone is online:

On the member’s devices, by the device’s own clock, even with no connection. A vault held only for the set time leaves the device with its items and keys, and the member is told Your time is over in the team. In a vault they open anyway, only what was added falls away.
On ZestSSH Cloud, which stops counting the access from that second. Where nothing else gives the member that vault, within five minutes it also deletes the copies of the vault’s key it held for them and marks the key for replacement. Those who may replace keys then see Replace keys on the team’s banner.
Certificates from the vault’s certificate authority never outlast the access they rest on. The owner’s device that signs them and ZestSSH Cloud both cap them at the end time.

Ending access cannot take back a password or key the member saw or copied while they had it.

End it early

What is running is listed under Access for a set time, such as “Sam has access for a set time”, with the vault and until the end time.

Someone who manages the vault chooses End now, then End access. They lose it at once. Passwords and keys they opened there are still known to them. The member is told Your access in the team was ended early.
The member can choose Give it up, then Give it up again in the window that asks. It leaves the device at once, and they can ask again.

Ending early needs no recent sign-in.

How it shows in the record

Giving and ending early are entries in the team’s signed record, so every member’s device checks them. The Trust page lists them, with who signed each one:

Entry on the Trust page	Written when
”Gave Sam access to Production for a set time”	Someone gave access.
”Ended Sam’s access to Production early”	Someone who manages the vault ended it.
”Gave up their access to Production”	The member gave it up.

Open an entry (Change # and its number) to see What was signed: the member, the vault, what was given, until (the end time, in seconds since 1970) and req, the request it answered. Signed by names who signed it.

Nothing is written when access ends by itself: the entry already says when it ends. The record holds no other times, so the Trust page shows when this device first saw each entry, under First seen here.

Requests are not in the record. ZestSSH Cloud keeps a request only until it is answered, withdrawn or seven days old, and nothing of it after that: no history of who asked for what, or of who said no.

Limits

Times. The app gives access for 1 hour to 30 days. ZestSSH Cloud refuses an end time that has passed, with By ZestSSH Cloud’s clock that time has already passed. Check this device’s clock., and one more than 30 days ahead, with Access is given for 30 days at most.
Never Manage, and never more than the giver has in the vault.
Not for owners or admins: Owners and admins open every vault already. Nobody gives access to themselves.
Not for owners-only vaults.
Only downwards. You give access only to people who rank below you.
No Business needed. Access on request comes with every team.

Next steps

Vaults, access and roles: what each level allows.
Team rules: what members need to keep syncing.
Approved devices: let members in only from approved devices.