GEgetaxonflow
HITL

Create HITL approval request

Route a high-risk AI decision for human review. EU AI Act Article 14 requires human oversight for high-risk AI systems.

Requires both X-Org-ID and X-Tenant-ID headers (stamped by the auth middleware) — 400 when either is missing.

Enterprise only — community builds expose only GET /api/v1/hitl/status.

post/api/v1/hitl/queue

Request

Headers

Authorizationstring required
Example:Basic bXktb3JnOkFYT04tVjIteHh4

OAuth2-style Basic authentication header. Format: Basic base64(clientId:clientSecret)

  • clientId: Your organization identifier (required)
  • clientSecret: Authentication credential (optional for community mode)

Not required when DEPLOYMENT_MODE=community.

Idempotency-Keystring
Example:n8n-exec-abc123-node-Approve

Optional per-request dedup token. When supplied on POST /api/v1/mcp/check-input, POST /api/v1/audit/tool-call, or POST /api/v1/hitl/queue, the platform caches the original response for 24h and returns it byte-for-byte on subsequent requests carrying the same key + same authenticated tenant + same endpoint.

Format: 1-256 chars, ^[A-Za-z0-9_.:\-/]+$. Workflow IDs from n8n, ADK, or generic SDKs all fall inside this set. A malformed key returns 400 before the handler runs.

Cache rules: 2xx + 4xx responses are cached; 5xx is NOT cached so the caller's retry can hit a fresh attempt. A cache hit returns the original response plus an Idempotent-Replayed: true response header.

Cross-tenant collisions are impossible: tenant_id participates in the primary key + an RLS policy on the storage table. Two tenants using the same key value get distinct rows.

Request body

client_idstring required
user_idstring
original_querystring required

The query/action awaiting human review

request_typestring required

Request classification (e.g. mcp_query, llm_chat)

request_contextobject
triggered_policy_idstring required
triggered_policy_namestring required
trigger_reasonstring required
severity'low' | 'medium' | 'high' | 'critical'
eu_ai_act_articlestring
compliance_frameworkstring
risk_classificationstring
expires_in_secondsinteger

TTL before the request auto-expires

notify_urlstring uri

Optional outbound webhook URL fired asynchronously after the request transitions to a terminal state (approved / rejected / overridden / expired). Must use https:// or http://. The platform signs the envelope with HMAC-SHA256 over the body keyed by the deployment's AXONFLOW_HITL_WEBHOOK_SIGNING_KEY, sent as X-AxonFlow-Signature: sha256=<hex>. See the HITLWebhookEnvelope schema and docs.getaxonflow.com/docs/governance/hitl for the full shape + verification recipe.

Response

Approval request created

successboolean

Changes

No recorded changes to this operation across all 1 revision of this API.