---
title: "Decide Agent Approval"
method: POST
path: "/agent/approvals/{approval_id}/decide"
tags: ["Agent"]
---

# Decide Agent Approval

`POST /agent/approvals/{approval_id}/decide`

## Request

- Base URL: `https://be.graph8.com/api/v1`
- URL: `https://be.graph8.com/api/v1/agent/approvals/{approval_id}/decide`
- Auth: HTTP bearer

Approve, reject, or edit-and-approve a pending approval.

Use `{decision, edit_payload}` for the existing decision mode, or exclusively
`{use_human_authorization: true}` to relay a short-lived decision previously
reviewed in the browser by the same personal-key owner. The relay accepts
no caller-authored decision or edit fields. There is no client
version to pass: double-decide is settled server-side by `WHERE decided_at
IS NULL`, so exactly one caller wins and the loser gets 409 rather than
overwriting the first decision.

`DecideRequest` does not forbid unknown keys, so a misspelled `edit_payload`
is dropped in silence and an `edit_and_approve` decides as a plain approve.
This docstring is the operation description in the published contract, so
getting it wrong here ships the wrong shape to every integrator generating a
client from the spec, which is exactly how the earlier `expected_version` /
`edited_payload` error nearly shipped.

## Path parameters

- `approval_id` string, uuid, required: Approval ID

## Headers

- `Authorization` string, nullable
- `X-Target-Org-Id` string, nullable

## Request body

- union: Decide directly, or relay a stored human authorization exclusively. There is no client-supplied version to pass. Double-decide is settled server-side by `WHERE decided_at IS NULL`, so exactly one caller wins and the loser gets 409 rather than overwriting the first decision.
  - object
    - `decision` 'approve' | 'reject' | 'edit_and_approve', required
    - `use_human_authorization` false
    - `edit_payload` object, nullable: The redirected step, for 'edit_and_approve'. Ignored for the other decisions.
  - object
    - `use_human_authorization` true, required
    - `decision` 'approve' | 'reject' | 'edit_and_approve', nullable
    - `edit_payload` object, nullable: The redirected step, for 'edit_and_approve'. Ignored for the other decisions.

## Response `200`

Successful Response

- ApiResponseAgentApprovalResponse
  - `data` AgentApprovalResponse, required: One approval: the loop asking permission before a consequential step.
    - `id` string, required
    - `work_item_id` string, required
    - `step_id` string, required
    - `risk_level` string, required
    - `action_class` string, required
    - `summary` string, required
    - `detail` object, nullable
    - `requested_at` string, nullable
    - `decided_at` string, nullable
    - `decided_by` string, nullable
    - `decision` string, nullable
    - `decision_payload` object, nullable
    - `plan_digest` string, nullable: The plan this approval was bound to. Compare it to the run's current plan to tell an approval that still describes the work from one that has drifted.
    - `expires_at` string, nullable
    - `is_expired` boolean
    - `snapshot_digest` string, nullable
  - `pagination` PaginationMeta
    - `page` integer, required: Current page number (1-indexed)
    - `limit` integer, required: Items per page
    - `total` integer, required: Total number of items
    - `has_next` boolean, required: Whether there are more pages
    - `next_cursor` string, nullable: Opaque cursor for the next page; null when there are no more items. Pass it back as the `cursor` query param to fetch the following page without computing page numbers.
    - `total_available` integer, nullable: Search endpoints only: how many records really match, when known. Can be larger than `total`, which is capped at the 10,000 results that can be paged. For company search this is a distinct-company estimate. Null when unknown; absent outside search.
    - `total_is_lower_bound` boolean, nullable: Search endpoints only: true when more records match than `total` shows (the result set is larger than the 10,000 results that can be paged). Absent outside search.
    - `notes` string[], nullable: Search endpoints only: plain-language notes about the result, e.g. that more records match than can be paged, or that a reversed `between` range was put in order.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/graph8/apis/graph8-developer-api.md) · [All operations](https://skmtc.dev/graph8/apis/graph8-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/graph8/apis/graph8-developer-api/revisions/2e7cfa0ca921?raw)