---
title: "Decide a Trust Model v3 manual-verification submission"
method: POST
path: "/v1/admin/v3/manual-verification-submissions/{submission_id}/decision"
tags: ["Operations"]
---

# Decide a Trust Model v3 manual-verification submission

`POST /v1/admin/v3/manual-verification-submissions/{submission_id}/decision`

## Request

- Base URL: `https://loppee.com`
- URL: `https://loppee.com/v1/admin/v3/manual-verification-submissions/{submission_id}/decision`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-LOPPEE-API-Key`

Approves or rejects one current private entity/license submission. A human needs fresh AAL2 and complete_manual_verification; an external back-office agent needs that exact action on its active key. The submitter and current business owners cannot approve. Rejection should include a controlled owner_reason_code and always carries a separate private audited reason; for backward compatibility only, an omitted rejection code maps to the controlled generic other copy. Approval forbids owner_reason_code. Every official_source_manual decision requires the exact nonempty authority name and valid HTTPS source URL; document_review cannot carry an external source. official_record_not_found is additionally limited to a rejected official_source_manual review. Approval requires method-specific checks, reviewer-supplied validity within the factor/method ceiling, exact non-wildcard taxonomy scope for a licence, and exact type-to-confirm. The Loppee service writes the receipt and derives class; the caller cannot set either.

## Path parameters

- `submission_id` string, required

## Request body

- object
  - `outcome` 'approved' | 'rejected', required
  - `verification_method` 'official_source_manual' | 'document_review', required
  - `source_authority` string: Exact official authority name. Required for every official_source_manual decision; document_review cannot carry an external authority.
  - `source_url` string, uri: Exact HTTPS official source URL. Required for every official_source_manual decision and forbidden for document_review.
  - `reason` string, required
  - `owner_reason_code` 'wrong_document_type' | 'identifier_mismatch' | 'holder_mismatch' | 'inactive_or_expired' | 'official_record_not_found' | 'qa_synthetic_fixture' | 'other': Controlled owner-visible rejection reason. New clients should always send it for rejection; omission maps to other only for legacy compatibility. official_record_not_found requires outcome=rejected, verification_method=official_source_manual, and valid official source fields.
  - `observed_at` string, date-time
  - `valid_until` string, date-time
  - `credential_expires_at` string, date: Expiration date printed on the license. Required for an approved license submission and kept separate from Loppee's internal recheck valid_until.
  - `verified_service_scope` string[]
  - `identifier_match` boolean
  - `holder_name_match` boolean
  - `active_or_good_standing` boolean
  - `confirmation` 'APPROVE VERIFICATION' | 'REJECT VERIFICATION', required

## Response `200`

Decide a Trust Model v3 manual-verification submission response

- object: Immutable audited manual-verification decision receipt.

## Other responses

- `400`: ErrorResponse
- `401`: ErrorResponse
- `403`: ErrorResponse
- `404`: ErrorResponse
- `409`: ErrorResponse
- `413`: ErrorResponse
- `429`: RateLimitError
- `default`: ErrorResponse

---

[API](https://skmtc.dev/loppee/apis/loppee-business-registry-api-for-external-agents.md) · [All operations](https://skmtc.dev/loppee/apis/loppee-business-registry-api-for-external-agents/llms.txt) · [OpenAPI document](https://skmtc.dev/loppee/apis/loppee-business-registry-api-for-external-agents/revisions/37285f7cddcd?raw)