---
title: "Record acceptance of the outbound policy without changing the capabilities selection"
method: POST
path: "/v1/organizations/{organization_id}/capabilities/accept-policy"
---

# Record acceptance of the outbound policy without changing the capabilities selection

`POST /v1/organizations/{organization_id}/capabilities/accept-policy`

## Request

- Base URL: `https://api.skysay.ai`
- URL: `https://api.skysay.ai/v1/organizations/{organization_id}/capabilities/accept-policy`
- Auth: none declared

Stores `policy_version` with the acceptance time and actor and leaves the profiles, channels, destinations, limits and status exactly as they are: it never activates, suspends or queues anything by itself. Use POST /v1/organizations/{organization_id}/capabilities to change what the workspace is authorized for.

## Path parameters

- `organization_id` string, required

## Request body

- CapabilitiesPolicyAcceptance
  - `accepted_by` string
  - `policy_version` string: Required unless the record already carries one.

## Response `200`

The stored record

- Capabilities: The workspace's capabilities record: what it may do outbound. One per workspace, always. `active` authorizes outbound within the listed profiles, channels, destinations and limits; every other status authorizes nothing new.
  - `all_countries` boolean: True: every destination except the sanctioned set is authorized and `countries` is empty. False: `countries` is the explicit allowlist. Activation through verification sets it true; a request chooses.
  - `approved_at` string, nullable
  - `approved_by` string: `self_serve` for a request approved within the catalog, the operator who approved it, or the verification door that activated it.
  - `approved_profiles` string[]
  - `calling_rules` object: The application calling rules an operator recorded on approval; `{}` when none apply.
  - `channels` string[]
  - `compliance_profile_id` string: The verified business profile the record was activated against; empty until verification clears.
  - `countries` string[]: The destination allowlist as ISO 3166-1 alpha-2 codes when `all_countries` is false. A call or text to any other country is held for review.
  - `created_at` string
  - `customer_visible_message` string: Server-composed status sentence for the workspace; display as-is.
  - `destination_restrictions` string[], nullable: Optional customer narrowing, intersected with current capabilities at admission. null means no additional customer restriction.
  - `destination_revision` integer: Revision required when saving optional destination restrictions.
  - `id` string
  - `limits` object: The profile caps projected into the workspace's risk controls at its last activation or approval (per-day/per-minute call and SMS counts, unique destinations, daily voice and wallet spend in minor units). Empty when no profile caps were projected. The caps enforced right now are the workspace's risk controls, which an operator may have changed since; `/v1/dashboard/capabilities` reports those.
  - `metadata` object
  - `organization_id` string
  - `policy_accepted_at` string, nullable
  - `policy_accepted_by` string
  - `policy_version` string
  - `status` 'not_activated' | 'pending_review' | 'active' | 'suspended'
  - `updated_at` string

## Other responses

- `400`: No policy_version supplied and none already stored
- `403`: The credential does not belong to this organization

---

[API](https://skmtc.dev/skysay/apis/skysay-api.md) · [All operations](https://skmtc.dev/skysay/apis/skysay-api/llms.txt) · [OpenAPI document](https://skmtc.dev/skysay/apis/skysay-api/revisions/95b8c66f99aa?raw)