---
title: "Deploy a tested change to the live site (files and allow-listed options only, never database tables; checked afterwards and rolled back automatically on failure). Owners and admins; confirm is the change id from a dashboard session, else the approval code shown there"
method: POST
path: "/projects/{projectId}/wordpress/changes/{changeId}/approve"
tags: ["WordPress"]
---

# Deploy a tested change to the live site (files and allow-listed options only, never database tables; checked afterwards and rolled back automatically on failure). Owners and admins; confirm is the change id from a dashboard session, else the approval code shown there

`POST /projects/{projectId}/wordpress/changes/{changeId}/approve`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/projects/{projectId}/wordpress/changes/{changeId}/approve`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Path parameters

- `projectId` string, uuid, required
- `changeId` string, uuid, required

## Request body

- object
  - `confirm` string, required: Dashboard: the change id. API keys and AI agents: the approval code a person reads in the dashboard
  - `acceptVisualChanges` boolean: Required when the visual comparison found changes

## Response `200`

Deploying

- object
  - `id` string, uuid, required
  - `projectId` string, uuid, required
  - `kind` 'plugin_update' | 'theme_update' | 'core_update' | 'file_edit' | 'settings', required
  - `title` string, required
  - `status` 'queued' | 'snapshotting' | 'cloning' | 'applying' | 'testing' | 'awaiting_approval' | 'deploying' | 'verifying' | 'deployed' | 'rolling_back' | 'rolled_back' | 'rollback_failed' | 'failed' | 'rejected' | 'canceled', required
  - `stepDetail` string, nullable, required
  - `input` object, required: What was asked (a file edit's text is left out: contentBytes instead)
  - `staging` object, required
    - `state` 'none' | 'creating' | 'ready' | 'deleting' | 'deleted' | 'failed', required
    - `url` string, nullable, required
    - `username` string, nullable, required
    - `deleteAfter` string, nullable, required: ISO-8601 timestamp
  - `report` object, required
    - `changedFiles` object, nullable, required
      - `added` number, required
      - `modified` number, required
      - `deleted` number, required
      - `sample` string[], required
    - `appliedVersion` string, nullable, required: The version staging ended up with (updates)
    - `checks` object[], required
      - `name` string, required
      - `status` 'pass' | 'fail' | 'warn' | 'skipped', required
      - `detail` string, required
    - `visual` object[], required
      - `viewport` 'desktop' | 'mobile', required
      - `liveImageId` string, uuid, nullable, required
      - `stagingImageId` string, uuid, nullable, required
      - `diffImageId` string, uuid, nullable, required
      - `diffRatio` number, nullable, required: Share of pixels that differ (0..1)
      - `status` 'pending' | 'same' | 'changed' | 'unavailable', required
      - `error` string, nullable, required
    - `woocommerce` boolean, required: WooCommerce is active: the live database (orders, customers) is never replaced, not even on rollback
    - `deploy` object, nullable, required
      - `files` number, required
      - `options` string[], required
      - `databaseRestoredOnRollback` boolean, nullable, required
    - `warnings` string[], required
  - `error` object, nullable, required
    - `code` string, required
    - `message` string, required
  - `canApprove` boolean, required: Waiting for approval and every required check passed
  - `approvalCode` string, nullable: Shown only to an owner or admin signed in to the dashboard: what an API key or AI agent must pass as confirm to approve
  - `createdAt` string, required: ISO-8601 timestamp
  - `createdBy` string, uuid, nullable, required
  - `approvedAt` string, nullable, required: ISO-8601 timestamp
  - `approvedBy` string, uuid, nullable, required
  - `finishedAt` string, nullable, required: ISO-8601 timestamp
  - `updatedAt` string, required: ISO-8601 timestamp

## Other responses

- `400`: Invalid request (code invalid_request)
- `401`: Missing or invalid session/token (code unauthorized)
- `402`: A paid add-on (code upgrade_required)
- `403`: Authenticated but not permitted (code forbidden)
- `404`: Not found or not visible to the caller (code not_found)
- `409`: Conflicting state (code conflict)
- `429`: Too many requests (code rate_limited)
- `501`: Not available on this server (code not_configured)
- `503`: The site or the engine did not answer (code provider_unavailable)

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)