---
title: "List approvals"
method: GET
path: "/v1/automation-approvals"
tags: ["Automations"]
---

# List approvals

`GET /v1/automation-approvals`

## Request

- Base URL: `https://api.banksync.io`
- URL: `https://api.banksync.io/v1/automation-approvals`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Approval gates, newest first: of one run, or those still waiting. Deciding one is a person’s act in the app.

## Query parameters

- `automationId` string: Only the approvals of one automation
- `runId` string: Only the approvals of one run
- `status` 'pending' | 'approved' | 'rejected' | 'expired' | 'superseded': Only approvals in this state; `pending` for those waiting for a decision
- `cursor` string: The `nextCursor` of the previous page
- `limit` integer

## Response `200`

The approvals

- object
  - `success` true, required
  - `data` object, required
    - `approvals` object[], required
      - `id` string, required
      - `runId` string, required
      - `automationId` string, required
      - `nodeId` string, required
      - `node` object, nullable, required
        - `ref` string, required
        - `type` string, required
        - `title` string, required
        - `tier` string, required
      - `pass` integer, required
      - `effectHash` string, required
      - `assignees` string[], required
      - `startedBy` string, nullable: The user id of the person who started the run; they cannot decide it (AP-06).
      - `reason` 'sender_untrusted' | 'null', nullable: Why the run paused here without a gate: `sender_untrusted` means it was started by a sender outside the mailbox’s allowlist and the step cannot be undone.
      - `required` integer, required
      - `decisions` object[], required
        - `userId` string, required
        - `decision` 'approved' | 'rejected', required
        - `effectHash` string, required
        - `decidedAt` string, required
      - `status` 'pending' | 'approved' | 'rejected' | 'expired' | 'superseded', required
      - `expiresAt` string, required
      - `createdAt` string, required
    - `nextCursor` string, nullable, required: Send it as `cursor` for the next page; null on the last page.

## Other responses

- `400`: Invalid input, or the draft has blocking findings — `code` names the refusal (`AUTOMATION_BLOCKED_BY_FINDINGS`, `AUTOMATION_SECRET_REFUSED`, …) and `details[]` each finding with its node
- `401`: Unauthorized
- `403`: Forbidden — missing scope, insufficient role, a credential narrowed to some accounts, or a grant the caller does not hold
- `404`: Not found — or automations are not enabled for this workspace
- `409`: Conflict — the draft moved since you read it (`AUTOMATION_VERSION_CONFLICT`), the automation is not published or not active, or a grant does not hold (`AUTOMATION_GRANT_STATE`)
- `429`: The automation’s admission refused the run and does not queue (`AUTOMATION_ADMISSION_REFUSED`, `AUTOMATION_RATE_LIMITED`): `code` names which, and the `Retry-After` header says how many seconds to wait before trying again. A start that queues is a 202, not this.
- `503`: Automations are paused while an incident is worked (`AUTOMATIONS_STOPPED`) or not configured here (`AUTOMATIONS_UNAVAILABLE`): `code` names which, and the `Retry-After` header says how many seconds to wait before retrying

---

[API](https://skmtc.dev/banksync/apis/banksync-api.md) · [All operations](https://skmtc.dev/banksync/apis/banksync-api/llms.txt) · [OpenAPI document](https://skmtc.dev/banksync/apis/banksync-api/revisions/94465f5ee922?raw)