---
title: "Approve or deny a credential request (operator)"
method: POST
path: "/v1/credentials/approve"
tags: ["credentials"]
---

# Approve or deny a credential request (operator)

`POST /v1/credentials/approve`

## Request

- Base URL: `https://agentlair.dev`
- URL: `https://agentlair.dev/v1/credentials/approve`
- Auth: HTTP bearer

The operator approves or denies a pending credential request. Requires `vault_key` (the vault slot to store the credential) and `operator_email` (must match the account's registered email for binding). If `approved` is `true`, `credential_value` must also be provided — this is the actual secret that will be one-time-delivered to the agent on next poll. If `approved` is `false`, the agent will receive a `denied` status on next poll.

## Request body

- object
  - `user_code` string, required: The user code shown by the agent (format: XXXX-XXXX)
  - `approved` boolean, required: Whether to approve (true) or deny (false) the request
  - `vault_key` string, required: The vault key name where the credential will be stored. Pre-populated from the agent's request — the operator may change it.
  - `operator_email` string, email, required: The operator's email address. Must match the account's registered `operator_email` for binding/security validation.
  - `credential_value` string: The actual credential value to deliver to the agent. Required when `approved` is true.

## Response `200`

Request approved or denied

- object
  - `status` 'approved' | 'denied'
  - `message` string

## Other responses

- `400`: Invalid request body or expired/already-processed code
- `401`: Authentication required
- `429`: Max approval attempts exceeded for this code

---

[API](https://skmtc.dev/agentlair/apis/agentlair-api.md) · [All operations](https://skmtc.dev/agentlair/apis/agentlair-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agentlair/apis/agentlair-api/revisions/fac95ff4995d?raw)