---
title: "Authorize a spend action"
method: POST
path: "/authorize"
---

# Authorize a spend action

`POST /authorize`

## Request

- Base URL: `https://getsanction.com/api/v1`
- URL: `https://getsanction.com/api/v1/authorize`
- Auth: API key in header `x-api-key`

Check whether an agent is permitted to make a purchase, subscription, or transfer. Always call this before any financial transaction. Returns immediately with approved, denied, or escalated status. Escalated means a human must approve before proceeding; after approval, retry the exact request with grant_id to consume the one-use grant.

## Request body

- AuthorizeRequest
  - `action` 'purchase' | 'subscribe' | 'transfer', required: Type of spend action the agent wants to perform
  - `amount_usd` number, required: Amount in US dollars
  - `merchant` string, required: Vendor or service name
  - `category` string, required: Spend category (e.g. software, services, research, infrastructure)
  - `description` string: Optional description of what this spend is for
  - `tags` object: Optional attribution tags (≤8; e.g. {"channel":"paid-media","play":"d2c-search"}). Stored on the decision and surfaced in the audit feed/CSV for rollups. Never read by policy rules.
  - `settlement` object: Optional settlement metadata: which rail the approved spend will settle on (closed vocabulary). Inert to the decision — never read by policy rules — and stored on the row so the ledger and audit feed/CSV are rail-aware. Sanction authorizes the spend; any rail settles it.
    - `rail` 'card' | 'ach' | 'wire' | 'x402' | 'internal', required
    - `asset` 'usd' | 'usdc' | 'eurc' | 'usdt'
    - `network` 'base' | 'ethereum' | 'solana' | 'polygon' | 'arbitrum' | 'optimism': Only valid with rail "x402"
  - `grant_id` string: Short-lived approval grant returned from GET /authorize/{request_id}. Retry the exact approved request with this field to consume the grant.

## Response `200`

Authorization decision (200 for approved/escalated; 403 for denied)

- AuthorizeResponse
  - `authorized` boolean
  - `approval_status` string: Present when an idempotent replay hits an escalation that a human (or timeout-approve) approved: status only, never permission to execute. Redeem the one-use grant for an attempt. Policy-approved requests replay authorized: true.
  - `status` 'approved' | 'denied' | 'escalated' | 'pending'
  - `reason` string: Human-readable explanation of the decision
  - `code` 'ESCALATION_REQUIRED' | 'ESCALATION_TIMED_OUT' | 'NO_POLICY' | 'CATEGORY_BLOCKED' | 'CATEGORY_NOT_ALLOWED' | 'PER_TXN_LIMIT' | 'DAILY_BUDGET_EXCEEDED' | 'MONTHLY_BUDGET_EXCEEDED' | 'SUBTREE_CAP_EXCEEDED' | 'EXEC_BUDGET_EXCEEDED' | 'GRANT_NOT_FOUND' | 'GRANT_ALREADY_USED' | 'GRANT_EXPIRED' | 'GRANT_MISMATCH' | 'GRANT_UNSUPPORTED' | 'POLICY_DENIED': Stable machine-readable decision code (absent when approved). Branch on this to replan.
  - `remediation` string: Suggested next step for the agent when not approved
  - `limit` object: UX-3: the limit that fired, with live values from the decision's stored evidence.
    - `kind` 'per_transaction' | 'daily_spend_budget' | 'monthly_spend_budget' | 'escalation_band'
    - `limit_usd` number
    - `used_usd` number
    - `remaining_usd` number
    - `requested_usd` number
    - `resets_at` string, date-time
  - `links` object
    - `record` string
    - `evidence` string
  - `access_request` object: Present on hard budget denials: the signed appeal offer (AARP) — POST it to /access/v1/access-request to put the denial in front of a human.
    - `endpoint` string
    - `expires_at` string, date-time
    - `binding_token` string
  - `request_id` string
  - `agent` string
  - `amount_usd` number
  - `merchant` string
  - `grant_id` string: Grant issued by a human approval for this request
  - `grant_status` 'active' | 'consumed' | 'expired' | 'revoked'
  - `grant_consumed_at` string, date-time
  - `grant_expires_at` string, date-time

## Other responses

- `401`: Invalid API key
- `403`: Denied by policy

---

[API](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api.md) · [All operations](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/revisions/c645a9e4b72d?raw)