You need a running Shellius, a user without a second factor for this walkthrough, and curl and jq.

export SHELLIUS=https://shellius.example.com

1. Sign in

export SHELLIUS_TOKEN=$(curl -s -X POST "$SHELLIUS/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{ "email": "[email protected]", "password": "…" }' | jq -r .data.accessToken)

The token lasts 15 minutes by default. See Authentication for refreshing it.

2. Check who you are

curl -s "$SHELLIUS/api/auth/me" -H "Authorization: Bearer $SHELLIUS_TOKEN" | jq .data

3. List servers

curl -s "$SHELLIUS/api/servers" -H "Authorization: Bearer $SHELLIUS_TOKEN" | jq .

You see the servers your role and scope allow, exactly as in the portal. Pick one that is not tagged prod for the next step and note its id.

4. Request access

curl -s -X POST "$SHELLIUS/api/access-requests" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "serverId": "<server id>",
    "protocol": "SSH",
    "requestedDuration": 3600,
    "reason": "Trying the API against a staging host"
  }' | jq .data.status

requestedDuration is in seconds — between one minute and seven days — and reason needs at least 10 characters.

With a matching auto-approve policy the status is APPROVED straight away. For a production server it is PENDING until an approver acts — the API follows the same rules as the portal, and there is no parameter that skips them. The exact body fields are listed under Submit access request.

5. See what that left behind

With audit.view:

curl -s "$SHELLIUS/api/audit?limit=5" -H "Authorization: Bearer $SHELLIUS_TOKEN" | jq '.data.items[] | {action, createdAt}'

Your request, and the certificate issued for it, are already there.

Next steps

Access requestsReview, revoke and fetch credentials.ServersCreate and update inventory from your own tooling.ErrorsHandle refusals properly.