---
title: "The gate verb: a human authorizes or rejects an agent-originated spec. Cookie-session only by design — an agent can never authorize its own proposal."
method: POST
path: "/api/v1/intents/{id}/authorization"
tags: ["intents"]
---

# The gate verb: a human authorizes or rejects an agent-originated spec. Cookie-session only by design — an agent can never authorize its own proposal.

`POST /api/v1/intents/{id}/authorization`

Human-only by construction: the route never inspects the Authorization header, so agents cannot clear their own gate. Only meaningful for origin='agent' intents. Also stamps reviewed_at when unset (authorizing implies having seen). A verdict can be changed by issuing the other verb; the latest human call stands. Agent-facing surfaces reflect the state: intents responses carry origin + authorization ('pending'/'authorized'/'rejected'; null for human-authored), the agent prompt opens with a DO-NOT-IMPLEMENT banner while pending or rejected, intent.md frontmatter carries authorization, and the create response includes a notice instructing the agent to wait. Emits agent_spec_authorized / agent_spec_rejected server-side.

## Path parameters

- `id` string, required

## Request body

- object
  - `action` string, required — 'authorize' or 'reject'.
  - `note` string — Optional reason (max 500 chars), most useful on rejection — agents read it on their next pull.

## Response `200`

Verdict recorded — returns { intentId, authorizationStatus, authorizedAt }

- object

## Other responses

- `400` — Invalid action/note; OR the intent is not agent-originated (human-authored specs are implicitly authorized by authorship)
- `401` — No valid Supabase session cookie — pm_live_ API keys are rejected by design
- `403` — Session user is not an owner/admin/editor of the intent's workspace
- `404` — Intent not found
- `500` — DB error recording the verdict or unexpected internal error

## Changes

- **2026-08-23** `155c812b368b` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/pathmode/apis/pathmode-api/changes/api/v1/intents/:id/authorization/post.md)

---

[API](https://skmtc.dev/pathmode/apis/pathmode-api.md) · [All operations](https://skmtc.dev/pathmode/apis/pathmode-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/pathmode/pathmode-api/revisions/e419abb0a327/schema)