---
title: "POST /v1/workspaces/{workspaceId}/qa/approvals/{approvalId}/decision"
method: POST
path: "/v1/workspaces/{workspaceId}/qa/approvals/{approvalId}/decision"
---

# POST /v1/workspaces/{workspaceId}/qa/approvals/{approvalId}/decision

`POST /v1/workspaces/{workspaceId}/qa/approvals/{approvalId}/decision`

## Request

- Base URL: `https://api.bangermail.com`
- URL: `https://api.bangermail.com/v1/workspaces/{workspaceId}/qa/approvals/{approvalId}/decision`
- Auth: HTTP bearer

Explicit automated approval, never human review. Only the reserved production QA owner session in its isolated test workspace can decide the exact managed publication, Journey activation or dispatcher email within a single bounded daily run. Customer approvals and launcher approval rules are unchanged. A repeated or changed decision is refused.

## Request body

- object
  - `run_id` string, required
  - `occurrence` string, required: The normal consumed daily-full occurrence in America/Sao_Paulo.
  - `started_at` string, date-time, required
  - `deadline` string, date-time, required: At most 55 minutes after the immutable run start
  - `domain` string, required: Exact server-derived run domain under send.qa.snappile.com.
  - `decision` 'approved', required
  - `operation_key` string, required
  - `expected_payload_sha256` string, required
  - `recipients` string[], required

## Response `200`

Explicit automation provenance and the existing execution job or resumed enrollment.

- object
  - `data` ApprovalRequest
    - `id` string, uuid, required
    - `requested_by_actor_id` string, required
    - `action_kind` string, required
    - `summary` string, required
    - `capability_scopes` string[], required
    - `resource_scope` object, required
    - `payload` object, required
    - `payload_sha256` string, required
    - `status` 'pending' | 'approved' | 'rejected' | 'cancelled' | 'expired', required
    - `missed` boolean, required
    - `expires_at` string, date-time, required
    - `qa_automation` object, nullable: Server-recorded dedicated QA automation provenance; never evidence of a human payload review. The run and global authorization are rechecked at execution.
      - `kind` 'dedicated_qa_automation'
      - `authorization_reference` string
      - `run_id` string
      - `operation_key` string
      - `recipients` string[]
      - `approval_sha256` string
      - `resource_sha256` string
    - `decided_by_actor_id` string, nullable
    - `decision_reason` string, nullable
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
    - `decided_at` string, date-time, nullable
    - `execution_job_id` string, uuid
    - `review` object
      - `disposition` 'automatic' | 'human_required', required
      - `recipient_count` integer, nullable, required
      - `reasons` string[], required
      - `checks` string[], required

## Other responses

- `403`: Identity
- `409`: The operation was already consumed or its binding changed.

---

[API](https://skmtc.dev/bangermail/apis/banger-api.md) · [All operations](https://skmtc.dev/bangermail/apis/banger-api/llms.txt) · [OpenAPI document](https://skmtc.dev/bangermail/apis/banger-api/revisions/a149909267f9?raw)