---
title: "Respond To Confirmation"
method: POST
path: "/v1/agents/sessions/{session_id}/confirmations/{confirmation_id}"
tags: ["Agent Sessions"]
---

# Respond To Confirmation

`POST /v1/agents/sessions/{session_id}/confirmations/{confirmation_id}`

## Request

- Base URL: `https://api.mixpeek.com`
- URL: `https://api.mixpeek.com/v1/agents/sessions/{session_id}/confirmations/{confirmation_id}`
- Auth: HTTP bearer and API key in header `X-Namespace`

Respond to a pending confirmation for a write operation.

When the agent requests a write operation (create, update, delete),
the stream pauses and emits a `confirmation_required` event. The user
must call this endpoint to approve or deny the action.

After responding, this endpoint returns a new SSE stream that continues
the agent's execution from where it paused.

## Confirmation Workflow

1. User sends message via POST /sessions/{id}/messages
2. Agent proposes a write operation
3. Stream emits `confirmation_required` event with `confirmation_id`
4. User calls this endpoint with `approved: true/false`
5. This endpoint returns SSE stream continuing the agent's work
6. If approved, agent executes the tool and continues
7. If denied, agent acknowledges and continues without executing

## Confirmation Expiration

Confirmations expire after 5 minutes. Attempting to respond to an
expired confirmation returns a 400 error.

Args:
    request: FastAPI request with tenant context
    session_id: Session identifier
    confirmation_id: Confirmation identifier from `confirmation_required` event
    payload: Approval/denial decision

Returns:
    StreamingResponse with SSE events (continuation of agent execution)

Raises:
    NotFoundError: If session or confirmation not found
    ValidationError: If confirmation already processed or expired

Example:
    ```bash
    # Approve a pending action
    curl -N -X POST http://localhost:8000/v1/agents/sessions/ses_abc/confirmations/conf_xyz \
      -H "Authorization: Bearer {api_key}" \
      -H "X-Namespace: {namespace_id}" \
      -H "Content-Type: application/json" \
      -d '{"approved": true}'

    # SSE Output (continuation):
    event: tool_result
    data: {"tool_name": "delete_collection", "success": true, "result": {...}}

    event: token
    data: {"content": "I've deleted the collection as requested."}

    event: done
    data: {}
    ```

## Path parameters

- `session_id` string, required: Session ID
- `confirmation_id` string, required: Confirmation ID

## Request body

- ConfirmationRequest: Request to approve or deny a pending confirmation.
  - `approved` boolean, required: True to approve, False to deny the action

## Response `200`

Successful Response

- unknown

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `422`: Unprocessable Entity
- `429`: Too Many Requests
- `500`: Internal Server Error
- `503`: Service Unavailable

## Changes

- **2026-10-09** `61a175e8eb9a`: 1 warning, 5 info
  - removed the optional property `detail` from the response with the `422` status
  - added the non-success response with the status `429`
  - added the non-success response with the status `503`
  - added the optional property `success` to the response with the `422` status
  - …2 more
- **2026-08-09** `5d4c905106b4`: 1 info
  - the endpoint scheme security `BearerAuth AND NamespaceHeader` was added to the API

[Operation history](https://skmtc.dev/mixpeek/apis/mixpeek-api/changes/v1/agents/sessions/:session_id/confirmations/:confirmation_id/post.md)

---

[API](https://skmtc.dev/mixpeek/apis/mixpeek-api.md) - [All operations](https://skmtc.dev/mixpeek/apis/mixpeek-api/llms.txt) - [OpenAPI document](https://skmtc.dev/mixpeek/apis/mixpeek-api/revisions/790bc16455f6?raw)