---
title: "Create an invoice approval policy"
method: POST
path: "/approval-policies"
tags: ["approvalPolicies"]
---

# Create an invoice approval policy

`POST /approval-policies`

Creates a new invoice approval policy. Partners use this to provision Advanced Approval rules programmatically. Exactly one owner scope field is required: `ottimate_location_id`, `ottimate_company_id`, `group`, or `account`. At least one of `user_approvers` or `role_approvers` is required.

## Headers

- `Authorization` string, required
- `X-Api-Key` string, required
- `X-API-Version` string
- `Idempotency-Key` string

## Request body

- object
  - `name` string, required — Policy display name
  - `applicable_type` 'invoice', required — Must be `invoice` for this resource
  - `min_users_for_approval` integer, required — Minimum distinct approvers required
  - `ottimate_location_id` integer — Scope policy to a single location
  - `ottimate_company_id` integer — Scope policy to a company
  - `group` string — Restaurant group ID
  - `account` string — Account ID (racc_ prefixed)
  - `user_approvers` ApprovalPoliciesPostRequestBodyContentApplicationJsonSchemaUserApproversItems[] — User approver entries ({"user": <id>} or bare user ID)
  - `role_approvers` ApprovalPoliciesPostRequestBodyContentApplicationJsonSchemaRoleApproversItems[] — Role approver entries ({"role": "<role_id>"} or bare role ID string)
  - `conditions` ApprovalPoliciesPostRequestBodyContentApplicationJsonSchemaConditionsItems[] — Policy conditions (subject, operator, value)
  - `auto_approve_rules` string[] — Auto-approve rule types, e.g. ["user_uploaded"]
  - `use_buyer_approver` boolean — Count buyer as an implicit approver (default false)
  - `is_enabled` boolean — Enable on create (default true)

## Response `201`

Policy created

- ApprovalPoliciesPostApprovalPoliciesRootResponse201 — Empty response body

## Other responses

- `400` — Bad request - Invalid parameters or request format
- `401` — Unauthorized - Authentication required or invalid credentials
- `403` — Forbidden - Access denied or insufficient permissions

## Changes

- **2026-08-22** `75aab60eedc9` — 2 breaking, 1 warning
  - for the `header` request parameter `Idempotency-Key`, the minLength was increased from `0` to `1`
  - added the pattern `^[A-Za-z0-9._\-+=/]{1,128}$` to the `header` request parameter `Idempotency-Key`
  - for the `header` request parameter `Idempotency-Key`, the maxLength was set to `128`
- **2026-08-19** `c0b5cf6c7a72` — 1 info
  - endpoint added
- **2026-08-17** `c231509a03cf` — 1 breaking
  - api path removed without deprecation
- **2026-08-13** `1f089f3e34d9` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ottimate/apis/api-reference/changes/approval-policies/post.md)

---

[API](https://skmtc.dev/ottimate/apis/api-reference.md) · [All operations](https://skmtc.dev/ottimate/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ottimate/api-reference/revisions/ba91ff4c6969/schema)