---
title: "Get a guardrail approval"
method: GET
path: "/workspaces/{workspace_id}/guardrails/approvals/{approval_id}"
tags: ["Guardrail"]
---

# Get a guardrail approval

`GET /workspaces/{workspace_id}/guardrails/approvals/{approval_id}`

## Request

- Base URL: `https://api.mabl.com`
- URL: `https://api.mabl.com/workspaces/{workspace_id}/guardrails/approvals/{approval_id}`
- Auth: one of:
  - HTTP basic
  - API key in header `Authorization`

Returns one approval. A SELF approval is readable by the person the agent acts for, while they are a member of its workspace; a WORKSPACE approval by any member of the workspace. The agent the approval is bound to may also read it, to learn when it is decided.

## Path parameters

- `workspace_id` string, required
- `approval_id` string, required

## Response `200`

The approval.

- GuardrailApproval: A request an agent made that a guardrail policy asks a person to approve, bound to that agent and to the request's operation, action, path and query parameters and the operation's declared key fields; other body content is not bound. Timestamps are epoch milliseconds.
  - `id` string, required: The approval's id, which the agent sends back in the X-Mabl-Approval header.
  - `workspace_id` string, required: The id of the workspace the request was made in.
  - `state` 'PENDING' | 'APPROVED' | 'DENIED' | 'EXPIRED' | 'CANCELLED', required: Where a guardrail approval stands. PENDING awaits a decision and expires undecided after 24 hours; APPROVED lets the agent repeat the request, as often as it does, for 20 minutes; DENIED refuses the same request for 20 minutes after the decision, after which asking again opens a new approval; CANCELLED means a person withdrew it while pending or revoked it while approved. EXPIRED and CANCELLED are final.
  - `kind` 'SELF' | 'WORKSPACE', required: Who decides a guardrail approval. SELF is decided by the person the agent acts for; WORKSPACE, for an agent acting for an API key, by a workspace owner or editor.
  - `action` string: The action the request asks for, e.g. Delete::Branch.
  - `operation_id` string: The API operation the request called.
  - `resource_type` string: The kind of entity the action acts on, e.g. Branch.
  - `resource_id` string: The id of the entity the request names, when it names one.
  - `branch` string: The branch the request names, when it names one.
  - `request_fields` object: The fields of the request body shown to the approver, as the agent sent them, keyed by property, e.g. name. Some, such as a merge's from and to, also bind the approval. Absent when the operation names none or the body has none. Each value is a string; a long one is shown cut short but bound in full.
  - `agent_type` string: The type of agent that made the request.
  - `agent_session_id` string: The agent session that made the request; absent for an external agent, which has none.
  - `root_session_id` string: The root of that agent session's tree, when there is a session.
  - `root_user_id` string: For a SELF approval, the person the agent acts for, who alone decides it.
  - `root_api_key_id` string: For a WORKSPACE approval, the API key the agent acts for.
  - `client_kind` string: For an external agent, the kind of client it connected through, e.g. mcp.
  - `policy_ids` string[]: The ids of the policies that asked for approval.
  - `reason` string: Why the deciding policy asks for approval, as its author wrote it.
  - `summary` string: What the agent asked to do, written by mabl from the request.
  - `decision_id` string: The id of the guardrail decision that asked for approval, in the decision log.
  - `created_by_id` string: The id of the person or API key the agent acts for.
  - `created_time` integer: When the agent asked.
  - `request_expires_time` integer: When a pending approval expires undecided.
  - `decided_by_id` string: The id of the person who approved or denied it.
  - `decided_time` integer: When it was approved, denied or cancelled.
  - `decision_note` string: The note the deciding person left.
  - `use_expires_time` integer: Until when the agent may repeat the approved request, as often as it does.
  - `last_updated_by_id` string: The id of whoever last changed the approval.
  - `last_updated_time` integer: When the approval last changed.
  - `url` string: The mabl app page where the approval is reviewed.

## Other responses

- `401`: The request carries no valid credential.
- `403`: The caller may not read the approval.
- `404`: The workspace has no approval with this id.
- `default`: Unknown error

## Changes

- **2026-10-19** `b602223aa51f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/mabl/apis/mabl-api/changes/workspaces/:workspace_id/guardrails/approvals/:approval_id/get.md)

---

[API](https://skmtc.dev/mabl/apis/mabl-api.md) · [All operations](https://skmtc.dev/mabl/apis/mabl-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mabl/apis/mabl-api/revisions/b602223aa51f?raw)