---
title: "Approve or deny. Needs a person: never an API key, a connected app or a service account."
method: POST
path: "/v1/approvals/{id}/decision"
tags: ["approvals"]
---

# Approve or deny. Needs a person: never an API key, a connected app or a service account.

`POST /v1/approvals/{id}/decision`

## Request

- Base URL: `https://api.50heads.com`
- URL: `https://api.50heads.com/v1/approvals/{id}/decision`
- Auth: HTTP bearer

An approver on a browser session with a fresh proof in `x-50h-reauth` (spent by the decision), or in the app with a `confirmationId`. The typed `reason` goes to the agent and the audit trail. 403 `separation_of_duties` when the approver's own key made the ask (unless the policy allows it under an amount), 403 `not_an_approver`, 403 `confirm_required` (the app has not confirmed it is them, or the confirmation was used or is too old), 409 `approval_decided` or `approval_expired`. Approving the last approval a policy needs makes the question live; denying releases the held credits.

## Path parameters

- `id` string, required

## Request body

- ApprovalDecideRequest
  - `decision` 'approve' | 'deny', required
  - `reason` string
  - `confirmationId` string

## Response `200`

OK

- ApprovalDecideResponse
  - `approval` object, required
    - `id` string, required
    - `state` 'pending' | 'approved' | 'denied' | 'expired' | 'canceled', required
    - `organizationId` string, required
    - `organizationName` string, required
    - `workspaceId` string, required
    - `workspaceName` string, required
    - `questionId` string, required
    - `question` object, required
      - `text` string, required
      - `type` string, required
      - `options` object[], required
        - `label` string, required
        - `imageUrl` string, nullable, required
      - `context` string, nullable, required
    - `amountPence` integer, required
    - `heads` integer, required
    - `tier` integer, required
    - `etaMinutes` integer, nullable, required
    - `reasons` string[], required
    - `requester` object, required
      - `kind` 'key' | 'app' | 'service_account' | 'person', required
      - `name` string, required
      - `keyTail` string, nullable, required
    - `projectId` string, nullable, required
    - `projectName` string, nullable, required
    - `quorum` union, required
      - 1
      - 2
    - `approvedCount` integer, required
    - `approverRoles` string[], required
    - `approverCount` integer, required
    - `votes` object[], required
      - `userId` string, nullable, required
      - `name` string, nullable, required
      - `role` string, required
      - `decision` 'approve' | 'deny', required
      - `reason` string, nullable, required
      - `channel` 'app' | 'web', required
      - `at` string, required
    - `expiresAt` string, required
    - `createdAt` string, required
    - `decidedAt` string, nullable, required
    - `canDecide` boolean, required
    - `blocked` 'own_ask' | 'not_approver' | 'already_voted' | 'decided' | 'expired', nullable, required
    - `heldPence` integer, required
    - `confirmRequired` boolean, required
    - `approveUrl` string, required
  - `outcome` 'approved' | 'denied' | 'recorded', required

## Other responses

- `400`: The request is not valid; `error.details.validation` lists the fixes.
- `401`: No key or token, or it expired or was revoked.
- `403`: The key or token lacks the scope (`insufficient_scope`), or the action is not allowed.
- `404`: No such question, endpoint or delivery on this account.
- `429`: Too many requests; wait for Retry-After.

---

[API](https://skmtc.dev/50heads/apis/50heads-api.md) · [All operations](https://skmtc.dev/50heads/apis/50heads-api/llms.txt) · [OpenAPI document](https://skmtc.dev/50heads/apis/50heads-api/revisions/edbfecb1e360?raw)