# Create a per-batch scoped, time-boxed savings grant

Source: https://docs.levelfour.ai/api-reference/savings-grants/post-recommendations-grants


## POST /api/v1/recommendations/grants

### Authentication

Send `Authorization: Bearer <token>`.

### Request body

Required. Content type `application/json`.

- `batch_parent_id` (string, required): recommendation_id to grant scoped access for. A batch parent grants the merged policy of its children; a single recommendation grants its own policy.

### Responses

#### 201: Successful Response

- `success` (boolean, default `true`)
- `timestamp` (date-time string)
- `data` (object, required)
  - `grant_id` (string, required): UUID minted per apply; correlates the pingback to the dashboard session
  - `launch_stack_url` (string, nullable): AWS Console quickcreate URL that attaches the scoped, time-boxed grant
  - `connect_command` (string, nullable): GCP Cloud Shell command the customer runs to apply the scoped, time-boxed grant. The per-grant bearer secret travels in the Authorization header, not the URL.
  - `expires_at` (date-time string, required): When the grant expires (DateLessThan baked into every statement)
  - `scope_summary` (object, required)
    - `action_count` (integer, default `0`): Distinct IAM actions in the merged grant
    - `resource_count` (integer, default `0`): Distinct resources the grant scopes to
    - `policy_group_count` (integer, default `0`): Number of managed policies the grant attaches to the role
    - `child_count` (integer, default `0`): Number of recommendations covered by this batch grant
  - `stale_grant_policies` (array of string): For a commitment, the LevelFourSavingsGrant policies still attached to the execution role whose grants have expired. AWS allows 10 managed policies on a role by default, so their stacks are deleted first

#### Errors

- `400`: Bad Request
- `401`: Authentication Error
- `403`: Authorization Error
- `404`: Not Found
- `409`: Conflict
- `422`: Validation Error
- `429`: Rate Limit Exceeded
- `500`: Internal Server Error

Body of `400`, `401`, `403`, `404`, `409`, `422`, `429`, `500`:

- `success` (`false`, required)
- `error` (object, required)
  - `code` (string, required)
  - `message` (string, required)
  - `details` (any)
- `timestamp` (date-time string, required)