---
title: "Tool calls waiting for approval"
method: GET
path: "/client/mcp/approvals"
tags: ["Tool gateway"]
---

# Tool calls waiting for approval

`GET /client/mcp/approvals`

## Request

- Base URL: `https://api.roar-ai.com`
- URL: `https://api.roar-ai.com/client/mcp/approvals`
- Auth: HTTP bearer

Calls to tools that change things, from agents whose grant says “ask”: the waiting ones first, then recent history. You see requests from the keys you can see; the masked arguments only if you may decide. Requires `mcp:read`.

## Response `200`

Requests

- McpApprovalList
  - `data` McpApproval[], required
    - `id` string, uuid, required
    - `ref` string, required: The short reference the agent was given
    - `status` 'pending' | 'approved' | 'denied' | 'expired' | 'used', required
    - `toolId` string, uuid, required
    - `toolName` string, required: What agents call the tool: `<server>__<tool>`
    - `apiKeyId` string, uuid, required
    - `keyName` string, nullable, required
    - `keyPrefix` string, required
    - `requestedAt` string, date-time, required
    - `expiresAt` string, date-time, required: Waiting: when it lapses (24 hours). Decided: until when the decision answers the agent’s retry (15 minutes)
    - `decidedAt` string, date-time, nullable, required
    - `decidedByName` string, nullable, required: Who decided, when it was one of your own people
    - `usedAt` string, date-time, nullable, required: When the approval was used: the agent’s retry was sent on to the tool. Not whether the tool then succeeded
    - `arguments` object, nullable, required: Always null for an API key. In the console, a signed-in owner or admin sees `{ preview, truncated }` — the call’s arguments masked by your privacy detectors — while it waits; they are deleted once anyone decides
  - `canDecide` boolean, required: Whether you may approve or decline: a signed-in owner or admin. Never a key
  - `argumentsWithheld` object, nullable, required: Set when your data stays in one country: no call’s arguments are stored for approval, so `arguments` is null for every request and the approver sees the tool and the key only
    - `country` string, nullable, required: Two-letter country code, lower case

---

[API](https://skmtc.dev/roar-ai/apis/roar-ai-api.md) · [All operations](https://skmtc.dev/roar-ai/apis/roar-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/roar-ai/apis/roar-ai-api/revisions/37e4d0d5a7fe?raw)