---
title: "Approve or reject"
method: POST
path: "/v1/approvals/{approval_id}/decide"
tags: ["Approvals"]
---

# Approve or reject

`POST /v1/approvals/{approval_id}/decide`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/approvals/{approval_id}/decide`
- Auth: HTTP bearer

Submit a decision (approve or reject) for a pending approval.
Human-only. The approval must be in `pending` status.
For `card_order` approvals, approving auto-executes the x402 payment;
rejecting marks the card as `rejected`.
Risk tier 2+ approvals require step-up authentication via
`X-Auth-Confirm` (account password or `rat_` re-auth token from
`POST /v1/auth/reauth/begin` + `complete`). Risk tier 3 requires
passkey or TOTP re-auth token.

## Path parameters

- `approval_id` string, uuid, required

## Request body

- DecideApprovalRequest
  - `decision` 'approve' | 'reject', required
  - `reason` string: Optional human-readable reason for the decision

## Response `200`

Decision recorded

- ApprovalResponse
  - `id` string, uuid, required
  - `org_id` string, uuid, required
  - `user_id` string, uuid, required
  - `agent_id` string, uuid, nullable
  - `action` string, required
  - `target_type` string, required
  - `target_id` string, required
  - `risk_tier` integer, required: The tier actually enforced. Authoritative.
  - `declared_risk_tier` integer, nullable: What the caller asked for, when it asked for anything.
  - `declared_below_floor` boolean: The caller asked for a lower tier than policy required.
  - `human_summary` string, nullable: Plain-language line sent to SMS, push and email.
  - `payload` object: What the action will do, as submitted.
  - `status` 'pending' | 'approved' | 'rejected' | 'expired' | 'cancelled', required
  - `summary` object, required: Structured summary of the action requiring approval
  - `reason` string, nullable
  - `decision_reason` string, nullable
  - `decided_by` string, uuid, nullable
  - `decided_at` string, date-time, nullable
  - `expires_at` string, date-time, nullable
  - `created_at` string, date-time, required

## Other responses

- `400`: Invalid request
- `404`: Resource not found
- `409`: Resource already exists or conflict

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)