---
title: "The app: Face ID or the passcode succeeded on the phone. Returns a one-use confirmation and opens a five-minute window."
method: POST
path: "/v1/approvals/{id}/confirm"
tags: ["approvals"]
---

# The app: Face ID or the passcode succeeded on the phone. Returns a one-use confirmation and opens a five-minute window.

`POST /v1/approvals/{id}/confirm`

## Request

- Base URL: `https://api.50heads.com`
- URL: `https://api.50heads.com/v1/approvals/{id}/confirm`
- Auth: HTTP bearer

App sessions only. Every decision over £100.00 needs its own confirmation (`confirmationId`); smaller ones are covered by a confirm in the last five minutes.

## Path parameters

- `id` string, required

## Request body

- ApprovalConfirmRequest
  - `method` 'biometric' | 'passcode', required

## Response `200`

OK

- ApprovalConfirmResponse
  - `confirmationId` string, required
  - `expiresAt` string, required
  - `windowEndsAt` string, required

## Other responses

- `400`: The request is not valid; `error.details.validation` lists the fixes.
- `401`: No key or token, or it expired or was revoked.
- `403`: The key or token lacks the scope (`insufficient_scope`), or the action is not allowed.
- `404`: No such question, endpoint or delivery on this account.
- `429`: Too many requests; wait for Retry-After.

---

[API](https://skmtc.dev/50heads/apis/50heads-api.md) · [All operations](https://skmtc.dev/50heads/apis/50heads-api/llms.txt) · [OpenAPI document](https://skmtc.dev/50heads/apis/50heads-api/revisions/edbfecb1e360?raw)