---
title: "POST /v1/workspaces/{workspaceId}/approvals"
method: POST
path: "/v1/workspaces/{workspaceId}/approvals"
---

# POST /v1/workspaces/{workspaceId}/approvals

`POST /v1/workspaces/{workspaceId}/approvals`

## Request

- Base URL: `https://api.bangermail.com`
- URL: `https://api.bangermail.com/v1/workspaces/{workspaceId}/approvals`
- Auth: HTTP bearer

For canonical Banger actions, Banger derives exact scopes, applies the workspace review policy, records an immutable audit request, and automatically queues actions within the configured limit. To publish managed email source, use action_kind managed_email.publish and payload {content_id, expected_version}; Banger binds the source revision/hash and enforces human review when required. Generic approval kinds always remain pending and must provide summary, capabilities, and resources. In mail.draft and transactional.send payloads, to, cc, bcc and reply_to accept any RecipientInput shape and are stored as { email, name } objects.

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `action_kind` string, required
  - `summary` string
  - `capabilities` string[]
  - `resources` object
  - `payload` object, required
  - `expires_in_seconds` integer
  - `approve_as_launcher` boolean: For sequence.activate: a person pressing Turn on approves this exact request when the review policy needs a person. Ignored for API keys and agents, which wait in Approvals.

## Response `201`

Governed request created; it may already be automatically approved and queued.

- object
  - `data` ApprovalRequest, required
    - `id` string, uuid, required
    - `requested_by_actor_id` string, required
    - `action_kind` string, required
    - `summary` string, required
    - `capability_scopes` string[], required
    - `resource_scope` object, required
    - `payload` object, required
    - `payload_sha256` string, required
    - `status` 'pending' | 'approved' | 'rejected' | 'cancelled' | 'expired', required
    - `missed` boolean, required
    - `expires_at` string, date-time, required
    - `qa_automation` object, nullable: Server-recorded dedicated QA automation provenance; never evidence of a human payload review. The run and global authorization are rechecked at execution.
      - `kind` 'dedicated_qa_automation'
      - `authorization_reference` string
      - `run_id` string
      - `operation_key` string
      - `recipients` string[]
      - `approval_sha256` string
      - `resource_sha256` string
    - `decided_by_actor_id` string, nullable
    - `decision_reason` string, nullable
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
    - `decided_at` string, date-time, nullable
    - `execution_job_id` string, uuid
    - `review` object
      - `disposition` 'automatic' | 'human_required', required
      - `recipient_count` integer, nullable, required
      - `reasons` string[], required
      - `checks` string[], required

---

[API](https://skmtc.dev/bangermail/apis/banger-api.md) · [All operations](https://skmtc.dev/bangermail/apis/banger-api/llms.txt) · [OpenAPI document](https://skmtc.dev/bangermail/apis/banger-api/revisions/a149909267f9?raw)