---
title: "Approve or reject a paused workflow run"
method: POST
path: "/v1/workflows/runs/{run_id}/resume"
tags: ["workflows"]
---

# Approve or reject a paused workflow run

`POST /v1/workflows/runs/{run_id}/resume`

## Request

- Base URL: `https://coasty.ai`
- URL: `https://coasty.ai/v1/workflows/runs/{run_id}/resume`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer
- TypeScript: <https://skmtc.dev/coasty/apis/coasty-public-api/docs/v1/workflows/runs/:run_id/resume/post.ts> (a function with typed inputs; its response is checked against the schema)

Scope: `workflows:write`. Free. Approves (continues) or rejects (fails) a run paused on a `human_approval` step.

## Request body

- ResumeWorkflowRunRequest
  - `approved` boolean: Approve (continue) or reject (fail) the pending human_approval step.
  - `note` string, nullable

## Response `200`

The resumed workflow run.

- WorkflowRunResponse
  - `id` string, required
  - `object` 'workflow.run', required
  - `status` 'queued' | 'running' | 'awaiting_human' | 'succeeded' | 'failed' | 'cancelled' | 'timed_out', required
  - `workflow_id` string, nullable
  - `workflow_version` integer, nullable
  - `machine_id` string, nullable
  - `inputs` object
  - `output` object, nullable
  - `error` object, nullable
  - `awaiting_human_reason` string, nullable
  - `awaiting_step_id` string, nullable
  - `iterations_used` integer
  - `spent_cents` integer
  - `budget_cents` integer, nullable
  - `llm` RunLlmInfo: Credential-free BYOK attribution returned by agent runs and workflow runs. Only these allowlisted fields are public.
    - `provider` 'anthropic' | 'openai', required
    - `model` string, required
    - `key_fingerprint` string, required
    - `key_source` 'header' | 'stored', required
    - `key_scrubbed` boolean, required
  - `webhook_url` string, nullable: Workflow lifecycle callback destination. Workflow callbacks are best-effort in-process notifications (up to 3 attempts), have no durable delivery UUID/outbox, and can be missed if the worker fails. Reconcile with GET /v1/workflows/runs/{run_id}.
  - `webhook_secret` string, nullable: Returned by create and its exact bounded Idempotency-Key replay; null on get/list. The pinned per-run secret is encrypted at rest through delivery/replay recovery and later scrubbed.
  - `metadata` object, nullable
  - `created_at` string, nullable
  - `started_at` string, nullable
  - `finished_at` string, nullable
  - `request_id` string, nullable

## Other responses

- `400`: Invalid request body or parameters.
- `401`: Missing, invalid, or revoked API key. Pass `X-API-Key: sk-coasty-live-...` (or test).
- `403`: API key lacks the required scope or tier-feature is unavailable on the caller's plan.
- `404`: Resource not found in this key's namespace.
- `409`: The resource state conflicts with this operation.
- `413`: The request body exceeds the endpoint limit.
- `422`: The JSON shape is valid but one or more values violate the endpoint contract.
- `429`: Rate or concurrency limit exceeded.
- `500`: Unexpected server error. Retry with exponential backoff.
- `502`: An upstream dependency returned an invalid response.
- `503`: A required service is temporarily unavailable.
- `504`: An upstream dependency timed out.

---

[API](https://skmtc.dev/coasty/apis/coasty-public-api.md) - [All operations](https://skmtc.dev/coasty/apis/coasty-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/coasty/apis/coasty-public-api/revisions/f50d93b0d8a1?raw)