---
title: "Approve a hosted gateway sign-on into one of the customer's workspaces"
method: POST
path: "/v1/hosted-gateway/authorizations/approve"
---

# Approve a hosted gateway sign-on into one of the customer's workspaces

`POST /v1/hosted-gateway/authorizations/approve`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/hosted-gateway/authorizations/approve`
- Auth: API key in cookie `decionis_account_session`

From the page itself: the request must carry `Sec-Fetch-Site:
same-origin` (`same-site` is refused: the session cookie reaches every
subdomain) or, without it, an `Origin` that is the web application's
own (the web proxy forwards the browser's headers), and a JSON body
(415 JSON_CONTENT_TYPE_REQUIRED otherwise, so no form can send it).
The session must come from a sign-in that proved its email (an email
code, a password, Accounts, or an OAuth provider that asserted the
address verified; otherwise 403 VERIFIED_EMAIL_REQUIRED, sign in
again), that email must equal the request's owner email
(case-insensitive), and the user must be ADMIN or above in `org_id`, a
workspace on a paid plan (`org_entitlements.plan_code`; a Stripe
subscription in `trialing` counts as its plan) whose entitlement
Accounts holds active, all read at approval. On success the session
is bound to `org_id` (a new account-session cookie is set when it was
bound elsewhere), so the console's key list and billing show the
workspace that now holds the gateway's key.

## Request body

- HostedGatewayApproveRequest
  - `user_code` string, required
  - `org_id` string, uuid, required

## Response `200`

Approved; the operator's next poll receives the key

- HostedGatewayApproval
  - `status` 'approved', required
  - `authorization_id` string, uuid, required
  - `org_id` string, uuid, required
  - `org_name` string, required
  - `tenant_label` string, required
  - `tenant_host` string, required
  - `approved_at` string, date-time, required
  - `session_org_id` string, uuid, required
  - `session_rebound` boolean, required: True when a new account-session cookie bound to `org_id` was set.

## Other responses

- `400`: Structured API error
- `401`: Structured API error
- `402`: HOSTED_GATEWAY_PAID_PLAN_REQUIRED, with `plan_code` and `pricing_url`
- `403`: SAME_SITE_REQUEST_REQUIRED, VERIFIED_EMAIL_REQUIRED, HOSTED_GATEWAY_OWNER_MISMATCH, HOSTED_GATEWAY_ADMIN_REQUIRED or HOSTED_GATEWAY_ENTITLEMENT_INACTIVE (no API access, or Accounts does not hold the plan active; every gateway evaluation would be refused)
- `404`: Structured API error
- `409`: HOSTED_GATEWAY_AUTHORIZATION_NOT_PENDING, with its `status`
- `410`: HOSTED_GATEWAY_AUTHORIZATION_EXPIRED
- `415`: JSON_CONTENT_TYPE_REQUIRED
- `429`: Structured API error
- `503`: ACCOUNT_AUTHORITY_UNAVAILABLE or HOSTED_GATEWAY_RATE_LIMIT_UNAVAILABLE

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)