---
title: "Authorize a provisioning action"
method: POST
path: "/authorize/provision"
---

# Authorize a provisioning action

`POST /authorize/provision`

## Request

- Base URL: `https://getsanction.com/api/v1`
- URL: `https://getsanction.com/api/v1/authorize/provision`
- Auth: API key in header `x-api-key`

Check whether an agent is permitted to provision a resource (seats, licenses, infrastructure) — resource + line item + quantity + dollars in one native call. The dollar side shares the wallet's spend ladder and daily budget; the resource side is governed by the wallet's resource block/allow/escalate lists. Escalated means a human must approve; after approval, retry the exact request with grant_id to consume the one-use grant.

## Request body

- ProvisionAuthorizeRequest
  - `resource` string, required: What is being provisioned (e.g. azure.seat, m365.license)
  - `line_item` string, required: The concrete SKU or plan (e.g. Microsoft 365 E3)
  - `quantity` integer, required: Number of units to provision
  - `unit_price_usd` number: Optional per-unit price; when supplied, quantity × unit_price_usd must equal amount_usd
  - `amount_usd` number, required: Total amount in US dollars
  - `category` string, required: Spend category (shares the wallet's category governance and daily budget)
  - `description` string: Optional description of what this provision is for
  - `grant_id` string: Short-lived approval grant minted when a human approves the escalation. Retry the exact approved request with this field to consume the one-use grant.

## Response `200`

Authorization decision (200 for approved/escalated; 403 for denied)

- ProvisionAuthorizeResponse
  - `authorized` boolean
  - `approval_status` string: Present when an idempotent replay hits an escalation that a human (or timeout-approve) approved: status only, never permission to execute. Redeem the one-use grant for an attempt. Policy-approved requests replay authorized: true.
  - `status` 'approved' | 'denied' | 'escalated'
  - `reason` string: Human-readable explanation of the decision
  - `code` 'ESCALATION_REQUIRED' | 'ESCALATION_TIMED_OUT' | 'NO_POLICY' | 'RESOURCE_BLOCKED' | 'RESOURCE_NOT_ALLOWED' | 'CATEGORY_BLOCKED' | 'CATEGORY_NOT_ALLOWED' | 'AMOUNT_MISMATCH' | 'PER_TXN_LIMIT' | 'DAILY_BUDGET_EXCEEDED' | 'MONTHLY_BUDGET_EXCEEDED' | 'SUBTREE_CAP_EXCEEDED' | 'EXEC_BUDGET_EXCEEDED' | 'GRANT_NOT_FOUND' | 'GRANT_ALREADY_USED' | 'GRANT_EXPIRED' | 'GRANT_MISMATCH' | 'GRANT_UNSUPPORTED' | 'POLICY_DENIED': Stable machine-readable decision code (absent when approved). Branch on this to replan.
  - `remediation` string: Suggested next step for the agent when not approved
  - `request_id` string
  - `agent` string
  - `amount_usd` number
  - `resource` string
  - `line_item` string
  - `quantity` integer
  - `unit_price_usd` number
  - `grant_id` string: Grant issued by a human approval for this request
  - `grant_status` 'active' | 'consumed' | 'expired' | 'revoked'
  - `grant_consumed_at` string, date-time
  - `grant_expires_at` string, date-time

## Other responses

- `400`: Malformed request (including quantity × unit_price_usd ≠ amount_usd)
- `401`: Invalid API key
- `403`: Denied by policy

---

[API](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api.md) · [All operations](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/revisions/c645a9e4b72d?raw)