---
title: "Approve or deny a bound agent request"
method: POST
path: "/auth/agent/decision"
---

# Approve or deny a bound agent request

`POST /auth/agent/decision`

## Request

- Base URL: `https://superskill.sh/api`
- URL: `https://superskill.sh/api/auth/agent/decision`
- Auth: one of:
  - API key in cookie `__Host-superskill_agent_bind` and HTTP bearer
  - API key in cookie `__Host-superskill_agent_bind`

Deny requires only the one-time binding cookie. Approve additionally requires a live confirmed Supabase browser bearer and creates managed access only when that scope was explicitly requested.

## Request body

- AgentAuthorizationDecision
  - `request_id` string, required
  - `decision` 'approve' | 'deny', required

## Response `200`

Explicit decision recorded; no credential is returned

## Other responses

- `400`: Bad request
- `401`: Authorization required
- `403`: Authorization was provided but is not allowed for this action
- `409`: The requested action conflicts with current product or resource state
- `410`: Authorization request expired
- `503`: Dependent service unavailable

---

[API](https://skmtc.dev/superskill/apis/superskill-api.md) · [All operations](https://skmtc.dev/superskill/apis/superskill-api/llms.txt) · [OpenAPI document](https://skmtc.dev/superskill/apis/superskill-api/revisions/ced2d2d1f217?raw)