---
title: "Update Access Policy Approval Procedure"
method: PUT
path: "/v2/access-policies/{access_policy_id}/approval-procedures/{id}"
tags: ["Access Policy Approval Procedure API"]
---

# Update Access Policy Approval Procedure

`PUT /v2/access-policies/{access_policy_id}/approval-procedures/{id}`

## Request

- Base URL: `https://public.api.serval.com`
- URL: `https://public.api.serval.com/v2/access-policies/{access_policy_id}/approval-procedures/{id}`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/serval/apis/serval-public-api/docs/v2/access-policies/:access_policy_id/approval-procedures/:id/put.ts> (a function with typed inputs; its response is checked against the schema)

Update an existing approval procedure for an access policy.

## Path parameters

- `access_policy_id` string, required: The ID of the access policy.
- `id` string, required: The ID of the approval procedure.

## Request body

- object
  - `steps` SvflowPubapimodelsApprovalStep[]: The approval steps for the procedure.
    - `id` string: The ID of the approval step.
    - `allowSelfApproval` boolean, nullable: Whether the step can be approved by the requester themselves. optional so server can distinguish "not set" from "explicitly false" (DB defaults to TRUE; proto3 defaults bool to false)
    - `approvers` SvflowPubapimodelsApprover[]: Exactly one of approvers or custom_workflow must be set. Mutual exclusivity validated server-side.
      - union: An approver source with notification preference.
        - object: App-instance owners as approvers. Only valid for access policy approval procedures.
          - `appOwner` SvflowPubapimodelsAppOwnerApprover, required: The owners of the app instance the requested role belongs to. Only valid for access policy approval procedures.
          - `notify` boolean: Whether to notify this approver when the step is pending.
        - object: A Serval group as approvers.
          - `group` SvflowPubapimodelsGroupApprover, required: A Serval group as an approver.
            - `groupId` string: The ID of the Serval group.
          - `notify` boolean: Whether to notify this approver when the step is pending.
        - object: The requester's manager as an approver.
          - `manager` SvflowPubapimodelsManagerApprover, required: The requester's manager as an approver.
          - `notify` boolean: Whether to notify this approver when the step is pending.
        - object: Resource owners as approvers. Only valid for access policy approval procedures.
          - `resourceOwner` SvflowPubapimodelsResourceOwnerApprover, required: The owners of the resource the requested role belongs to. Only valid for access policy approval procedures.
          - `notify` boolean: Whether to notify this approver when the step is pending.
        - object: Role (entitlement) owners as approvers. Only valid for access policy approval procedures.
          - `roleOwner` SvflowPubapimodelsRoleOwnerApprover, required: The owners of the requested role (entitlement) itself. Only valid for access policy approval procedures.
          - `notify` boolean: Whether to notify this approver when the step is pending.
        - object: Team owners as approvers. Only valid for access policy approval procedures.
          - `teamOwner` SvflowPubapimodelsTeamOwnerApprover, required: The owners of the team that owns the requested role's app instance. Only valid for access policy approval procedures.
          - `notify` boolean: Whether to notify this approver when the step is pending.
        - object: A specific user as an approver.
          - `user` SvflowPubapimodelsUserApprover, required: A specific user as an approver.
            - `userId` string: The ID of the user.
          - `notify` boolean: Whether to notify this approver when the step is pending.
    - `customWorkflow` SvflowPubapimodelsCustomWorkflowConfig: Configuration for a custom workflow that determines approvers or auto-approves.
      - `workflowId` string: The ID of the workflow to execute.
    - `approverJustificationMode` string: Controls whether approvers are asked for a justification when deciding this step. Valid values: "not_requested", "optional", "required", "required_for_approval", "required_for_denial". Empty defaults to "not_requested". The "_for_approval" and "_for_denial" variants make the justification mandatory only when approving or denying, respectively.
  - `timeoutSeconds` integer, nullable: How long each step waits for a human decision before timing out (in seconds). Omit / zero means "keep the existing value". Non-zero values must be within [5 minutes, 90 days].

## Response `200`

Success

- SvflowPublicapiUpdateAccessPolicyApprovalProcedureResponse
  - `data` SvflowPubapimodelsAccessPolicyApprovalProcedure
    - `id` string: The ID of the access policy approval procedure.
    - `accessPolicyId` string: The ID of the access policy this approval procedure belongs to.
    - `steps` SvflowPubapimodelsApprovalStep[]: The steps in the approval procedure.
      - `id` string: The ID of the approval step.
      - `allowSelfApproval` boolean, nullable: Whether the step can be approved by the requester themselves. optional so server can distinguish "not set" from "explicitly false" (DB defaults to TRUE; proto3 defaults bool to false)
      - `approvers` SvflowPubapimodelsApprover[]: Exactly one of approvers or custom_workflow must be set. Mutual exclusivity validated server-side.
        - union: An approver source with notification preference.
          - object: App-instance owners as approvers. Only valid for access policy approval procedures.
            - `appOwner` SvflowPubapimodelsAppOwnerApprover, required: The owners of the app instance the requested role belongs to. Only valid for access policy approval procedures.
            - `notify` boolean: Whether to notify this approver when the step is pending.
          - object: A Serval group as approvers.
            - `group` SvflowPubapimodelsGroupApprover, required: A Serval group as an approver.
              - …
            - `notify` boolean: Whether to notify this approver when the step is pending.
          - object: The requester's manager as an approver.
            - `manager` SvflowPubapimodelsManagerApprover, required: The requester's manager as an approver.
            - `notify` boolean: Whether to notify this approver when the step is pending.
          - object: Resource owners as approvers. Only valid for access policy approval procedures.
            - `resourceOwner` SvflowPubapimodelsResourceOwnerApprover, required: The owners of the resource the requested role belongs to. Only valid for access policy approval procedures.
            - `notify` boolean: Whether to notify this approver when the step is pending.
          - object: Role (entitlement) owners as approvers. Only valid for access policy approval procedures.
            - `roleOwner` SvflowPubapimodelsRoleOwnerApprover, required: The owners of the requested role (entitlement) itself. Only valid for access policy approval procedures.
            - `notify` boolean: Whether to notify this approver when the step is pending.
          - object: Team owners as approvers. Only valid for access policy approval procedures.
            - `teamOwner` SvflowPubapimodelsTeamOwnerApprover, required: The owners of the team that owns the requested role's app instance. Only valid for access policy approval procedures.
            - `notify` boolean: Whether to notify this approver when the step is pending.
          - object: A specific user as an approver.
            - `user` SvflowPubapimodelsUserApprover, required: A specific user as an approver.
              - …
            - `notify` boolean: Whether to notify this approver when the step is pending.
      - `customWorkflow` SvflowPubapimodelsCustomWorkflowConfig: Configuration for a custom workflow that determines approvers or auto-approves.
        - `workflowId` string: The ID of the workflow to execute.
      - `approverJustificationMode` string: Controls whether approvers are asked for a justification when deciding this step. Valid values: "not_requested", "optional", "required", "required_for_approval", "required_for_denial". Empty defaults to "not_requested". The "_for_approval" and "_for_denial" variants make the justification mandatory only when approving or denying, respectively.
    - `timeoutSeconds` integer: How long each step waits for a human decision before timing out (in seconds).

## Other responses

- `default`: Error

---

[API](https://skmtc.dev/serval/apis/serval-public-api.md) - [All operations](https://skmtc.dev/serval/apis/serval-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/serval/apis/serval-public-api/revisions/0549515e9384?raw)