---
title: "The gate verb: a human authorizes or rejects an agent-originated spec. Cookie-session only by design — an agent can never authorize its own proposal."
method: POST
path: "/api/v1/intents/{id}/authorization"
tags: ["intents"]
---

# The gate verb: a human authorizes or rejects an agent-originated spec. Cookie-session only by design — an agent can never authorize its own proposal.

`POST /api/v1/intents/{id}/authorization`

Human-only by construction: the route never inspects the Authorization header, so agents cannot clear their own gate. Only meaningful for origin='agent' intents. Repository-authority verdicts are bound to the supplied repoBodyRevision in one transaction; any later material body revision clears the current verdict while preserving immutable history. Also stamps reviewed_at when unset (authorizing implies having seen). Agent-facing surfaces reflect the state: intents responses carry origin + authorization ('pending'/'authorized'/'rejected'; null for human-authored), the agent prompt opens with a DO-NOT-IMPLEMENT banner while pending or rejected, and intent.md frontmatter carries authorization. Emits agent_spec_authorized / agent_spec_rejected server-side.

## Path parameters

- `id` string, required

## Request body

- object
  - `action` string, required — 'authorize' or 'reject'.
  - `note` string — Optional reason (max 500 chars), most useful on rejection — agents read it on their next pull.

## Response `200`

Verdict recorded — returns { intentId, authorizationStatus, authorizedAt }

- object

## Other responses

- `400` — Invalid action/note; OR the intent is not agent-originated (human-authored specs are implicitly authorized by authorship)
- `401` — No valid Supabase session cookie — pm_live_ API keys are rejected by design
- `403` — Session user is not an owner/admin/editor of the intent's workspace
- `404` — Intent not found
- `409` — The repository body moved before the verdict settled; re-read and judge the current revision
- `428` — expectedRepoBodyRevision is required for a repository-authority intent
- `500` — DB error recording the verdict or unexpected internal error

## Changes

- **2026-09-01** `a660c0d36148` — 2 info
  - added the non-success response with the status `409`
  - added the non-success response with the status `428`
- **2026-08-23** `155c812b368b` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/pathmode/apis/pathmode-api/changes/api/v1/intents/:id/authorization/post.md)

---

[API](https://skmtc.dev/pathmode/apis/pathmode-api.md) · [All operations](https://skmtc.dev/pathmode/apis/pathmode-api/llms.txt) · [OpenAPI document](https://skmtc.dev/pathmode/apis/pathmode-api/revisions/35441fda7ae7?raw)