Must be a signed-in person. An API key is refused here even though it is accepted everywhere else on this API: a key approving its own agent's action is the agent approving itself with extra steps, and the whole value of the feature is that a human looked.

A decision is final, and an expired approval cannot be approved.

{
  "approval": {
    "findings": [
      {
        "path": "body.customer.email"
      }
    ]
  }
}