---
title: "Get approval"
method: GET
path: "/approvals/{approvalId}"
tags: ["Approvals"]
---

# Get approval

`GET /approvals/{approvalId}`

Get an approval

## Path parameters

- `approvalId` string, required — Approval ID (apr_*).

## Headers

- `X-Instance-ID` string, nullable

## Response `200`

Successful Response

- object
  - `data` object, required
    - `type` 'approval', required
    - `id` string, required — Approval ID (apr_*).
    - `attributes` object, required
      - `status` 'pending' | 'approved' | 'denied' | 'canceled', required — Approval status.
      - `target` object, required — Operation that needs approval.
        - `type` 'payment' | 'deposit' | 'withdrawal' | 'ach', required — Type of operation under approval.
        - `id` string, required — ID of the operation under approval.
      - `payment` object, nullable, required — Amount of the operation under review. Null when the underlying amount is unavailable.
        - `amount` integer, required — Amount in cents.
        - `currency` string, required — Currency code.
      - `reasons` object[], required — Reasons this approval is under review.
        - `type` 'limitExceeded', required
        - `limitType` 'perTransactionAmount' | 'dailyAmount' | 'monthlyAmount', required — Type of limit that was exceeded.
        - `limitAmount` integer, required — Configured limit amount in cents.
        - `actualAmount` integer, required — Amount that exceeded the limit, in cents.
        - `currency` string, required — Currency code.
      - `customer` object, nullable, required — Customer the agent is spending on behalf of, or null when the approval isn't a delegated payment.
        - `id` string, required — Customer party (pty_*) whose wallet a delegated payment spends from.
        - `name` string, nullable, required — Display name of the customer party, or null when unresolved.
      - `ach` object, nullable, required — ACH-specific review context. Null unless the target is an ACH.
        - `direction` 'debit' | 'credit', required — `debit` pulls funds from the counterparty account; `credit` pushes funds to it.
        - `secCode` 'WEB' | 'PPD' | 'TEL' | 'CCD', required — ACH SEC code the entry is submitted under.
        - `companyEntryDescription` string, required — Company entry description submitted on the ACH entry.
        - `companyName` string, required — Company name submitted on the ACH entry.
        - `expectedAvailableAt` string, nullable, required — Expected availability time, when known.
        - `counterparty` object, nullable, required — Counterparty and masked account, or null when it can no longer be resolved.
          - `externalPartyId` string, required — External party being paid or debited (epty_*).
          - `name` string, required — External party display or legal name.
          - `kind` 'individual' | 'business', required — External party type.
          - `account` object, required — Masked bank account the ACH debits or credits.
            - `id` string, required — External party account (epa_*).
            - `accountType` 'checking' | 'savings', required — Bank account type.
            - `last4` string, required — Last four account number digits.
            - `mask` string, required — Masked account number.
        - `mandate` object, nullable, required — Authorization backing the debit. Null for credits, which need no mandate.
          - `id` string, required — Mandate authorizing the debit (mdt_*).
          - `status` 'active' | 'revoked' | 'expired' | 'superseded' | 'consumed', required — Mandate status.
          - `amountType` 'fixed' | 'variable', required — Whether the mandate authorizes a fixed or capped amount.
          - `fixedAmount` integer, nullable, required — Authorized fixed amount in cents, for fixed mandates.
          - `maximumAmount` integer, nullable, required — Authorized maximum amount in cents, for variable mandates.
          - `currency` string, required — Currency code.
          - `effectiveAt` string, required — When the authorization took effect.
          - `expiresAt` string, nullable, required — When the authorization expires, when bounded.
      - `initiator` object, nullable, required — Who initiated the operation under review, when resolvable.
        - `actorType` 'user' | 'agent' | 'api' | 'service' | 'internalAdmin', required — Kind of actor that initiated the operation under review.
        - `agent` object, nullable, required — Acting agent, or null when a human or API key initiated the operation.
          - `id` string, required — Acting agent (agt_*).
          - `name` string, nullable, required — Agent label, or null when unresolved.
          - `owner` object, nullable, required — Party that operates the agent, or null when unresolved.
            - `partyId` string, required — Party that operates the agent (pty_*).
            - `name` string, required — Display name of the operating party.
      - `denialReason` string, nullable, required — Reason recorded when the approval was denied, when one was given.
      - `createdAt` string, required — When the approval was created.
      - `updatedAt` string, required — When the approval was last updated.
      - `resolvedAt` string, nullable, required — When the approval was resolved.

## Other responses

- `400` — Validation Error
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found. Returned when the resource does not exist, or when it exists but is not accessible to your account. The two cases are intentionally indistinguishable, so that resource IDs cannot be enumerated by probing.
- `409` — Conflict
- `422` — Validation Error
- `428` — Precondition Required
- `429` — Too Many Requests
- `500` — Internal Server Error
- `501` — Not Implemented
- `502` — Bad Gateway
- `503` — Service Unavailable

## Changes

- **2026-08-27** `359d267dca88` — 1 info
  - deleted the `header` request parameter `X-Agent-ID` with deprecation
- **2026-08-27** `feb2ede06539` — 3 info
  - added the required property `data/attributes/ach` to the response with the `200` status
  - added the required property `data/attributes/denialReason` to the response with the `200` status
  - added the required property `data/attributes/initiator` to the response with the `200` status
- **2026-08-23** `b1ad79e918ac` — 1 info
  - `header` request parameter `X-Agent-ID` was deprecated
- **2026-08-11** `089aed4017a8` — 1 warning, 1 info
  - added the new `ach` enum value to the `data/attributes/target/type` response property for the response status `200`
  - removed the `direct_payment` enum value from the `data/attributes/target/type` response property for the response status `200`
- **2026-08-09** `0123533d8361` — 1 warning
  - added the new `direct_payment` enum value to the `data/attributes/target/type` response property for the response status `200`

[Full history](https://skmtc.dev/natural/apis/natural-api/changes/approvals/:approvalId/get.md)

---

[API](https://skmtc.dev/natural/apis/natural-api.md) · [All operations](https://skmtc.dev/natural/apis/natural-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/natural/natural-api/revisions/25b811746e7a/schema)
