---
title: "Approve a prepared full audit"
method: POST
path: "/v1/code-audit/scans/{scanId}/quote/approve"
tags: ["Code Audit"]
---

# Approve a prepared full audit

`POST /v1/code-audit/scans/{scanId}/quote/approve`

## Request

- Base URL: `https://api.inth.com`
- URL: `https://api.inth.com/v1/code-audit/scans/{scanId}/quote/approve`
- Auth: HTTP bearer

Requires user-delegated code-audit.write and organization admin/owner. Strict JSON body requires exact quoteId, candidatePlanChecksum, maxCredits and requestId UUIDv4. All query parameters are rejected. The stored quote is locked and revalidated at the shared credit reservation boundary; its fixed settlement cannot exceed maxCredits. Changed quotes or an exceeded cap return409 CONFLICT with reason and requiredCredits. Reuse the exact request ID for uncertain retries. pending means delivery awaits acknowledgment. API-owned workflows continue; older Dashboard-owned workflows return requires_dashboard before reserving credits. Enforced after authorization by rollout-agent-access-writes default off, allow-public-agent-writes and allow-audit-starts default on. No payment or provider token is accepted.

## Path parameters

- `scanId` string, required

## Request body

- CodeAuditQuoteApprovalInput
  - `organizationId` string
  - `quoteId` string, required
  - `candidatePlanChecksum` string, required
  - `maxCredits` integer, required
  - `requestId` string, required

## Response `200`

Success

- object
  - `success` true, required
  - `data` union, required
    - object
      - `status` 'started' | 'already_started' | 'pending' | 'expired', required
    - object
      - `status` 'insufficient_credits', required
      - `remaining` union, required
        - number
        - 'Infinity' | '-Infinity' | 'NaN'
      - `requiredAmount` integer, required
    - object
      - `status` 'requires_dashboard', required
      - `reason` 'legacy_dashboard_workflow', required
      - `dashboardUrl` string, required
    - object
      - `status` 'error', required
      - `message` string, required

## Other responses

- `400`: The request payload or parameters are invalid.
- `401`: Authentication is missing, invalid, or expired.
- `403`: The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.
- `404`: The requested resource was not found.
- `409`: The request conflicts with the current resource state.
- `503`: The capability is temporarily paused by an operator. Retry later.

## Changes

- **2026-10-31** `a3f4100e14c9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/inth/apis/inth-api/changes/v1/code-audit/scans/:scanId/quote/approve/post.md)

---

[API](https://skmtc.dev/inth/apis/inth-api.md) - [All operations](https://skmtc.dev/inth/apis/inth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/inth/apis/inth-api/revisions/8741280c3463?raw)