---
title: "What an approval link shows (no API key: the link is the credential)"
method: POST
path: "/api/approvals/link"
---

# What an approval link shows (no API key: the link is the credential)

`POST /api/approvals/link`

## Request

- Base URL: `https://postwire.io`
- URL: `https://postwire.io/api/approvals/link`
- Auth: none required

The page at /approve/#t=<token> calls this. Each approver gets their own link: HMAC-signed, expiring (72 hours by default, set per brand) and good for one decision. It never carries key ids.

## Request body

- object
  - `t` string, required: The token from the link's #t= fragment.

## Response `200`

{ approval (with preview), brand, requested_by (masked), you: { role: owner|external|chat, approver }, link: { expires_at, used, expired }, can_decide, post }

## Other responses

- `400`: link_invalid
- `404`: link_invalid
- `410`: link_expired

---

[API](https://skmtc.dev/postwire/apis/postwire-api.md) · [All operations](https://skmtc.dev/postwire/apis/postwire-api/llms.txt) · [OpenAPI document](https://skmtc.dev/postwire/apis/postwire-api/revisions/513a409ab8f7?raw)