> ## Documentation Index
> Fetch the complete documentation index at: https://docs.interchange.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Manage organization advertiser grants
> Grant another organization reviewed access to exact advertisers
Organization advertiser grants let an advertiser owner authorize another
organization to work with specific advertisers. A grant names every advertiser
ID and capability, requires the invited organization to accept, and always has
an expiry date.
This feature is a limited beta and is unavailable unless Scope3 explicitly
enrolls the Organization. Every advertiser-grant REST endpoint and every V3
advertiser-grant entry point requires an eligible Organization, an active
time-bounded beta entitlement, and server-side beta exposure enabled by Scope3.
Delegated roster entries require the same checks, while owned roster entries
remain available. Being named in a grant does not bypass those checks. Scope3
enrolls internal teams first, followed by named beta Organizations; there is no
pricing or plan change in this release.
The advertiser owner keeps ownership and the existing advertiser and Campaign
IDs. A grant does not expose account IDs, members, billing, unrelated or future
advertisers, or private advertiser configuration. Names, email domains, CRM
associations, signup history, providers, external Business Manager membership,
and Partner status never create authority.
Grant lifecycle changes require a directly authenticated human organization
administrator. Service tokens, advertiser-scoped credentials, impersonated
sessions, and inherited child-account sessions cannot invite, accept, reject,
or revoke.
## Get the organization reference
Call `GET /api/v2/organization/advertiser-grants`. The
`data.organization.organizationRef` value is the exact reference another
organization uses to invite you. Share that reference with the advertiser
owner through a trusted channel. Display names and domains cannot substitute
for it.
## Invite an organization
`POST /api/v2/organization/advertiser-grants`
```bash curl theme={null}
curl -X POST "https://api.interchange.io/api/v2/organization/advertiser-grants" \
-H "Authorization: Bearer $SCOPE3_HUMAN_OAUTH_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"granteeOrganizationRef": "9f24ad79-d930-40b0-81a1-7c56be518f51",
"advertiserIds": ["12345"],
"capabilities": ["advertiser.read", "campaign.read", "campaign.manage"],
"purpose": "Operate the reviewed Q4 campaign portfolio",
"expiresAt": "2026-11-30T23:59:59Z"
}'
```
Every grant must include `advertiser.read`. `campaign.manage` also requires
`campaign.read`. Campaign management can be granted only when the owner still
holds that authority directly. Invitations expire within 365 days and cannot
silently expand to advertisers created later.
Grant lifecycle changes require a directly authenticated human organization
administrator. User API keys and service tokens cannot invite, accept, reject,
or revoke organization advertiser grants.
This release records reviewed campaign capabilities and establishes their
tenant-safe authorization boundary, but it does not extend the existing
Buyer Account Campaign endpoints. Those endpoints remain account-scoped
until delegated Campaign projection is released separately.
An existing pending or active grant for the same organizations and advertiser
must be rejected, revoked, or expired before a replacement is invited.
## Respond or revoke
The invited organization accepts or rejects the immutable invitation:
```bash curl theme={null}
curl -X POST "https://api.interchange.io/api/v2/organization/advertiser-grants/$GRANT_REF/accept" \
-H "Authorization: Bearer $SCOPE3_HUMAN_OAUTH_TOKEN" \
-H "Content-Type: application/json" \
-d '{"reason":"Reviewed the advertiser and capabilities"}'
```
Replace `accept` with `reject` to decline. Only the invited organization can
record either response. The granting organization can end a pending or active
grant immediately:
```bash curl theme={null}
curl -X POST "https://api.interchange.io/api/v2/organization/advertiser-grants/$GRANT_REF/revoke" \
-H "Authorization: Bearer $SCOPE3_HUMAN_OAUTH_TOKEN" \
-H "Content-Type: application/json" \
-d '{"reason":"The operating engagement ended"}'
```
Grant state is `invited`, `active`, `rejected`, `revoked`, or `expired`.
Acceptance, rejection, revocation, and observed expiry append to the grant's
history; they do not rewrite earlier events.
## Read grants and delegated advertisers
* `GET /api/v2/organization/advertiser-grants` lists incoming and outgoing
grants visible to organization administrators. The response returns at most
500 grants and sets `data.page.truncated` when more grants exist.
* `GET /api/v2/organization/advertiser-grants/{grantRef}` returns one grant and
its complete lifecycle history.
* `GET /api/v2/organization/advertisers` includes an accepted, unexpired exact
advertiser as `relationshipClass: "delegated"` with the grant reference,
owner organization, capabilities, and expiry. It never includes the owner's
backing account ID.
On MCP V3, use `save_advertiser_grant` for lifecycle changes,
`search({kind: "advertiser_grant"})` to list grants, and
`get({kind: "advertiser_grant", id: "..."})` for complete history. A
truncated search page returns `totalLowerBound`, `truncated: true`, and a
`nextCursor`; only an untruncated page returns the exact `total` observed
through that page.
Revoked and expired grants disappear from live roster reads immediately. A
stale roster entry or cached grant response is never evidence of current
authority. Every delegated operation rechecks the active accepted grant for the
exact advertiser and capability. Disabling cohort exposure or removing the beta
entitlement from either organization stops access without deleting grant or
audit history. This release does not add delegated Campaign operations.
## Errors
* `400 VALIDATION_ERROR` — an advertiser is not owned by the grantor, a
capability combination is invalid, or the expiry is outside the allowed
window.
* `403 ACCESS_DENIED` — the caller is not the required direct human
administrator, is the wrong party for the transition, lacks the active beta
entitlement, does not have server-side beta exposure enabled by Scope3, or
does not belong to an eligible Organization.
* `404 NOT_FOUND` — the organization, grant, or live authorized advertiser is
not visible to the caller.
* `409 CONFLICT` — the lifecycle state, live ownership, or owner-held campaign
authority changed, or an overlapping grant exists.
See [Errors](/v2/reference/errors) for the full error contract.
## Related
Read owned and actively delegated advertisers
Understand advertiser ownership and resources