---
title: "List a workspace's guardrail approvals: the API-key approvals its approvers decide, or with kind=SELF your own"
method: GET
path: "/workspaces/{workspace_id}/guardrails/approvals"
tags: ["Guardrail"]
---

# List a workspace's guardrail approvals: the API-key approvals its approvers decide, or with kind=SELF your own

`GET /workspaces/{workspace_id}/guardrails/approvals`

## Request

- Base URL: `https://api.mabl.com`
- URL: `https://api.mabl.com/workspaces/{workspace_id}/guardrails/approvals`
- Auth: one of:
  - HTTP basic
  - API key in header `Authorization`

Lists the workspace's approvals of one kind, newest first. WORKSPACE approvals are asks from agents acting for an API key, which a workspace owner or editor decides. SELF approvals are asks from agents acting for a person, and only that person's own are listed. Readable by any member of the workspace; API keys and agents are refused.

## Path parameters

- `workspace_id` string, required

## Query parameters

- `kind` 'SELF' | 'WORKSPACE': Who decides a guardrail approval. SELF is decided by the person the agent acts for; WORKSPACE, for an agent acting for an API key, by a workspace owner or editor.
- `state` 'PENDING' | 'APPROVED' | 'DENIED' | 'EXPIRED' | 'CANCELLED'
- `limit` integer

## Response `200`

The workspace's approvals of that kind, newest first.

- GuardrailApprovalList: Guardrail approvals, newest first.
  - `approvals` GuardrailApproval[]: The approvals.
    - `id` string, required: The approval's id, which the agent sends back in the X-Mabl-Approval header.
    - `workspace_id` string, required: The id of the workspace the request was made in.
    - `state` 'PENDING' | 'APPROVED' | 'DENIED' | 'EXPIRED' | 'CANCELLED', required: Where a guardrail approval stands. PENDING awaits a decision and expires undecided after 24 hours; APPROVED lets the agent repeat the request, as often as it does, for 20 minutes; DENIED refuses the same request for 20 minutes after the decision, after which asking again opens a new approval; CANCELLED means a person withdrew it while pending or revoked it while approved. EXPIRED and CANCELLED are final.
    - `kind` 'SELF' | 'WORKSPACE', required: Who decides a guardrail approval. SELF is decided by the person the agent acts for; WORKSPACE, for an agent acting for an API key, by a workspace owner or editor.
    - `action` string: The action the request asks for, e.g. Delete::Branch.
    - `operation_id` string: The API operation the request called.
    - `resource_type` string: The kind of entity the action acts on, e.g. Branch.
    - `resource_id` string: The id of the entity the request names, when it names one.
    - `branch` string: The branch the request names, when it names one.
    - `request_fields` object: The fields of the request body shown to the approver, as the agent sent them, keyed by property, e.g. name. Some, such as a merge's from and to, also bind the approval. Absent when the operation names none or the body has none. Each value is a string; a long one is shown cut short but bound in full.
    - `agent_type` string: The type of agent that made the request.
    - `agent_session_id` string: The agent session that made the request; absent for an external agent, which has none.
    - `root_session_id` string: The root of that agent session's tree, when there is a session.
    - `root_user_id` string: For a SELF approval, the person the agent acts for, who alone decides it.
    - `root_api_key_id` string: For a WORKSPACE approval, the API key the agent acts for.
    - `client_kind` string: For an external agent, the kind of client it connected through, e.g. mcp.
    - `policy_ids` string[]: The ids of the policies that asked for approval.
    - `reason` string: Why the deciding policy asks for approval, as its author wrote it.
    - `summary` string: What the agent asked to do, written by mabl from the request.
    - `decision_id` string: The id of the guardrail decision that asked for approval, in the decision log.
    - `created_by_id` string: The id of the person or API key the agent acts for.
    - `created_time` integer: When the agent asked.
    - `request_expires_time` integer: When a pending approval expires undecided.
    - `decided_by_id` string: The id of the person who approved or denied it.
    - `decided_time` integer: When it was approved, denied or cancelled.
    - `decision_note` string: The note the deciding person left.
    - `use_expires_time` integer: Until when the agent may repeat the approved request, as often as it does.
    - `last_updated_by_id` string: The id of whoever last changed the approval.
    - `last_updated_time` integer: When the approval last changed.
    - `url` string: The mabl app page where the approval is reviewed.

## Other responses

- `401`: The request carries no valid credential.
- `403`: The caller is not a member of the workspace, or is an API key or agent.
- `default`: Unknown error

## Changes

- **2026-10-19** `b602223aa51f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/mabl/apis/mabl-api/changes/workspaces/:workspace_id/guardrails/approvals/get.md)

---

[API](https://skmtc.dev/mabl/apis/mabl-api.md) · [All operations](https://skmtc.dev/mabl/apis/mabl-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mabl/apis/mabl-api/revisions/b602223aa51f?raw)