---
title: "Approve — the human's passkey signature over the exact terms"
method: POST
path: "/approvals/a/{approvalId}/approve"
tags: ["approvals"]
---

# Approve — the human's passkey signature over the exact terms

`POST /approvals/a/{approvalId}/approve`

## Request

- Base URL: `https://api.bubblio.dev`
- URL: `https://api.bubblio.dev/approvals/a/{approvalId}/approve`
- Auth: none declared

Verifies the WebAuthn response against the terms-derived challenge and flips the
approval (winner-only). `mandate: true` additionally mints the offered standing
mandate — the ceremony and the grant are ONE signature, indivisible. Idempotent:
re-approving an approved approval answers `{ ok, status: approved, already: true }`.

## Path parameters

- `approvalId` string, required

## Request body

- object
  - `mode` 'auth' | 'register', required
  - `credential` object, required: The WebAuthn registration/authentication response JSON.
  - `mandate` boolean: Also mint the offered standing mandate (#37).

## Response `200`

Approved (or already approved).

- object
  - `ok` boolean
  - `status` string
  - `already` boolean

## Other responses

- `400`: One calm sentence naming the malformed field.
- `404`: UNIFORM: unknown, malformed, foreign, and lagged approvals all read the same.
- `409`: Decided/expired, or the connect gate refused (`code: not_connected`).
- `429`: Per-IP ceiling tripped.

---

[API](https://skmtc.dev/bubblio/apis/bubblio-agent-door-api.md) · [All operations](https://skmtc.dev/bubblio/apis/bubblio-agent-door-api/llms.txt) · [OpenAPI document](https://skmtc.dev/bubblio/apis/bubblio-agent-door-api/revisions/d858aff9c01d?raw)