---
title: "Register an approval key"
method: POST
path: "/management/api_users/{userId}/approval_keys"
tags: ["Approvals (Beta)"]
---

# Register an approval key

`POST /management/api_users/{userId}/approval_keys`

## Request

- Base URL: `https://api.fireblocks.io/v1`
- URL: `https://api.fireblocks.io/v1/management/api_users/{userId}/approval_keys`
- Auth: none declared
- TypeScript: <https://skmtc.dev/fireblocks/apis/fireblocks-api/docs/management/api_users/:userId/approval_keys/post.ts> (a function with typed inputs; its response is checked against the schema)

Register an approval public key for an API user, used to sign approval requests. Up to 2 active keys are supported per API user. Returns the server-generated key ID used for deletion.

The `userId` must be the authenticated API user's own ID. Registering a key for another user is not supported and is rejected.

Registration may require approval. In that case the response carries `ccrIdPendingRegistration`, the key reads as `APPROVAL_API_KEY_STATUS_PENDING_REGISTRATION` and cannot sign until the request is approved. A rejected request removes the key.

Endpoint Permission: Owner, Admin, Non-Signing Admin, Approver, Signer, Security Admin.

## Path parameters

- `userId` string, required

## Headers

- `Idempotency-Key` string

## Request body

- RegisterApprovalApiKeyRequest: The approval API key to register.
  - `name` string, required: A human-readable label for the key.
  - `approvalApiPublicKey` ApprovalApiPublicKey, required: The public key material and its signing algorithm.
    - `algorithm` 'RSA_PS256' | 'ECDSA_SECP256R1' | 'ECDSA_SECP384R1' | 'EDDSA_ED25519', required: The signature algorithm of the public key.
    - `publicKeyPem` string, required: The PEM-encoded public key.

## Response `200`

The approval key was registered.

- RegisterApprovalApiKeyResponse: The result of registering an approval API key.
  - `keyId` string, required: The server-generated ID of the registered key, used for deletion.
  - `ccrIdPendingRegistration` string, required: Always returned. An empty string when the key is active immediately. Otherwise, the ID of the approval request that must be approved before the key becomes active. The request appears in `GET /v1/approvals`.

## Other responses

- `409`: Another approval key request for this API user is already pending approval.
- `default`: Error Response

---

[API](https://skmtc.dev/fireblocks/apis/fireblocks-api.md) - [All operations](https://skmtc.dev/fireblocks/apis/fireblocks-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fireblocks/apis/fireblocks-api/revisions/4eba9965659a?raw)