---
title: "List everything awaiting a human decision"
method: GET
path: "/v1/approvals"
tags: ["approvals"]
---

# List everything awaiting a human decision

`GET /v1/approvals`

## Request

- Base URL: `https://api.patricia.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.patricia.app/v1/approvals`
- Auth: HTTP bearer

One cursor-paginated feed over both approval kinds, newest first: tool-approval requests (kind=tool) and skill share requests (kind=skill_share). Each caller sees only the rows they are in the audience of: their own tool-approval audience, plus share requests they can decide (skills:edit) or raised themselves. Tool-argument values are sanitized and visible only to callers who can decide requests (runs:execute); read-only callers receive a value-free input_summary instead.

## Query parameters

- `q` string, nullable: ANTLR filter expression
- `limit` integer, nullable: Page size
- `sort_by` string, nullable: Sort expression (e.g. created_at:desc)
- `fields` string, nullable: Field projection (e.g. id,name)
- `pq` string, nullable: Pagination cursor query
- `from_prev` boolean: Backward pagination flag

## Headers

- `X-Tenant-Id` string, nullable

## Response `200`

Successful Response

- QueriesApprovalsFeedApprovalsFeedQuerySearchValidator: Typed cursor-paginated response envelope for the unified approvals feed.
  - `items` ApprovalsFeedRow[], required
    - `kind` string, nullable
    - `id` string, uuid, nullable
    - `status_code` string, nullable
    - `created_at` string, date-time, nullable
    - `resolved_at` string, date-time, nullable
    - `run_id` string, uuid, nullable
    - `tool_name` string, nullable
    - `risk_tier_code` string, nullable
    - `input` object, nullable: Tool arguments, sanitized. Present only on kind=tool rows, and only for callers holding runs:execute (the authority that can decide the request); null for read-only callers, which receive input_summary instead.
    - `input_summary` ArgSummaryEntry[], nullable: Value-free per-argument summary, populated in place of input for callers without runs:execute.
      - `key` string, required: Argument name (schema-level, never customer data).
      - `type` string, required: JSON type of the hidden value: string, number, boolean, object, array, or null.
      - `size` integer, nullable: Size of the hidden value: characters for a string, item count for an array, key count for an object. Null for other scalars, and always null for a credential-named argument.
    - `repeat_coverage_announced` boolean, nullable
    - `task_offer_manifest` object, nullable
    - `task_offer_manifest_digest` string, nullable
    - `delivery_ref` string, nullable
    - `expires_at` string, date-time, nullable
    - `snapshot_title` string, nullable
    - `snapshot_tool_label` string, nullable
    - `snapshot_body` string, nullable
    - `snapshot_link_kind` string, nullable
    - `snapshot_link_value` string, nullable
    - `asked_because` string, nullable: One sentence naming which rule asked for this approval, for example a workspace setting on the connected account or an action that reaches an audience. Null when the request records no cause.
    - `installation_id` string, uuid, nullable
    - `skill_id` string, uuid, nullable
    - `skill_slug` string, nullable
    - `skill_title` string, nullable
    - `skill_summary` string, nullable
    - `requester_name` string, nullable
    - `requester_actor_id` string, uuid, nullable
    - `requested_by_viewer` boolean, nullable: True when the caller is the person whose run raised this request, false when somebody else did or nobody did (a proactive run). Resolved server-side because the browser holds no actor id to compare against. Null on a skill-share row, which the server does not yet resolve it for.
    - `connection_label` string, nullable: One sentence naming the connection this action would run on, already filtered for what the caller may know: a personal connection they do not own is described without naming its owner. Null when the request binds no connection.
  - `first` string, nullable
  - `next` string, nullable
  - `previous` string, nullable

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden. Inspect response body `code` for the specific reason (for example: PERMISSION_DENIED, EMAIL_NOT_VERIFIED, TENANT_ACCESS_REQUIRED, ROLE_UNRESOLVED)
- `422`: Validation error

---

[API](https://skmtc.dev/patricia/apis/patricia-api.md) · [All operations](https://skmtc.dev/patricia/apis/patricia-api/llms.txt) · [OpenAPI document](https://skmtc.dev/patricia/apis/patricia-api/revisions/0dfb44495ea1?raw)