Sign in
Provider Authority

Approve or deny an exact provider request

Requires an eligible human session with recent MFA.

post/v2/provider-actions/{id}/approval

Headers

X-Steward-Request-Timestampstring

Unix seconds, Unix milliseconds, or HTTP/ISO timestamp. Sensitive mutating routes require this or X-Steward-Request-Expires-At when request-expiry or request signatures are enforced.

X-Steward-Request-Expires-Atstring

Unix seconds, Unix milliseconds, or HTTP/ISO expiry time. Sensitive mutating routes require this or X-Steward-Request-Timestamp when request-expiry or request signatures are enforced.

X-Steward-Signaturestring

Authorization signature for sensitive mutating routes when STEWARD_REQUIRE_AUTH_SIGNATURE=true or production enforcement is enabled. Use v1=<hmac-sha256> or p256=<signature>.

X-Steward-Signing-Key-Idstring

Tenant request-signing key id used to select a managed HMAC signing key. Required when signing with a managed tenant key; omit only for static or app-client signing secrets.

Idempotency-Keystring

Required for signed sensitive requests and recommended for all sensitive mutating requests. Replays are scoped to authenticated or explicitly signed contexts.

Request body

decision'approve' | 'deny' required
expectedVersioninteger required
expectedRequestHashstring required
expectedActionDigeststring required
reasonCode'approver_manual_approve' | 'approver_manual_deny' | 'approver_risk_deny' | 'approver_scope_deny' | 'approver_duplicate_deny' | 'approver_other'
reasonstring
idempotencyKeystring required

Response

JSON response

idstring required
status'denied' | 'pending_approval' | 'allowed_stub' | 'stub_succeeded' | 'stub_failed' | 'approved' | 'execution_ready' | 'approval_denied' | 'approval_expired' | 'approval_stale' | 'executing' | 'succeeded' | 'failed' | 'outcome_unknown' required
versioninteger required
requestHashstring required
actionDigeststring required
replayedboolean
resumeAttemptIdstring

Changes

Changed in 1 of the 9 revisions of this API.1