List pending approvals (WCP plane)

List workflow steps currently awaiting human approval for the caller's tenant (all planes). Cross-reference the MAP-plane equivalent at /api/v1/plans/approvals/pending, which scopes to MAP-backed workflows and populates plan_id on every entry.

Reachable on Evaluation and above. Listing is a read over entries that already exist, so it follows the resolve rule rather than the creation entitlement: CREATING an approval entry requires Professional, Enterprise or Enterprise Plus, but a deployment that already holds entries can always list, approve and reject them. Community has no approval queue to list.

A tier that may not list gets 404, not 403. This route is REGISTERED conditionally (RegisterEnterpriseRoutes, or the community branch gated on the resolve entitlement), so on a deployment that is not entitled the path is not on the router at all. The 403 below is therefore NOT a tier refusal — it described one until issue #3948, and that description was of a status this operation cannot produce for that reason. It is the agent-gateway proxy-auth refusal, which this handler raises itself, before it looks at tenancy.

Every refusal THIS HANDLER produces carries the triplet {error, code, message} envelope — this plane's writer. Its MAP counterpart uses the flat envelope throughout for the same reason in reverse, and the two are documented as they are rather than converged, because converging either is a wire change on that plane.

One refusal a client can receive is NOT this handler's and is not the triplet: a request that does not reach the orchestrator through the agent gateway is stopped by the deployment-wide internal-service gate before any route matches, and that answers the FLAT envelope. It applies identically to every operation in this document and is therefore described here rather than repeated on each one.