---
title: "Approve a public resource into a workspace collection"
method: POST
path: "/workspaces/{slug}/collections/{collection}/items"
---

# Approve a public resource into a workspace collection

`POST /workspaces/{slug}/collections/{collection}/items`

## Request

- Base URL: `https://superskill.sh/api`
- URL: `https://superskill.sh/api/workspaces/{slug}/collections/{collection}/items`
- Auth: HTTP bearer

Shortcut for adding a public marketplace resource to a named workspace collection. Uses the same trust snapshot, exact-release pinning, and failed/missing-scan blocking rules as /workspaces/{slug}/resources/approve.

## Path parameters

- `slug` string, required
- `collection` string, required

## Request body

- object
  - `resourceId` string, required
  - `name` string
  - `note` string
  - `resourceVersion` string: Optional exact semantic version; requires artifactDigest
  - `artifactDigest` string: Optional exact archive SHA-256; requires resourceVersion

## Response `201`

Workspace collection item approved

- object
  - `workspace` Workspace
    - `slug` string, required
    - `name` string, required
    - `type` 'company' | 'community' | 'team' | 'course' | 'agency' | 'chat', required
    - `visibility` 'private' | 'invite_only' | 'gated' | 'public' | 'unlisted', required
    - `plan` 'free' | 'team' | 'enterprise', required
    - `description` string, nullable
    - `avatarUrl` string, nullable
  - `collection` WorkspaceCollection
    - `slug` string, required
    - `title` string, required
    - `summary` string, nullable
    - `visibility` 'workspace' | 'public' | 'unlisted', required
    - `createdAt` string, required
    - `updatedAt` string, required
    - `archivedAt` string, nullable
    - `items` WorkspaceCollectionItem[], required
      - `id` string, required
      - `itemRef` string, required
      - `itemSource` 'public_resource' | 'workspace_resource' | 'native_harness' | 'external_url', required
      - `sourceResourceId` string
      - `pinnedVersion` string, nullable
      - `pinnedArchiveHash` string, nullable
      - `approvalState` 'pending_review' | 'approved' | 'approved_with_warning' | 'blocked' | 'blocked_by_scan' | 'deprecated', required
      - `approvedBy` string, nullable
      - `approvedAt` string, nullable
      - `note` string, nullable
      - `riskSnapshot` object
      - `createdAt` string, required
      - `updatedAt` string, required
  - `item` WorkspaceCollectionItem
    - `id` string, required
    - `itemRef` string, required
    - `itemSource` 'public_resource' | 'workspace_resource' | 'native_harness' | 'external_url', required
    - `sourceResourceId` string
    - `pinnedVersion` string, nullable
    - `pinnedArchiveHash` string, nullable
    - `approvalState` 'pending_review' | 'approved' | 'approved_with_warning' | 'blocked' | 'blocked_by_scan' | 'deprecated', required
    - `approvedBy` string, nullable
    - `approvedAt` string, nullable
    - `note` string, nullable
    - `riskSnapshot` object
    - `createdAt` string, required
    - `updatedAt` string, required
  - `resource` Resource
    - `id` string, required
    - `identity` object, required
    - `sourceCatalogId` string
    - `title` string, required
    - `summary` string, required
    - `summaryOriginal` string
    - `resourceType` 'harness' | 'skill' | 'plugin' | 'workflow' | 'mcp_server' | 'service_endpoint' | 'agent_team' | 'subagent_pack' | 'command_pack' | 'config' | 'guide' | 'framework' | 'agent_runtime' | 'directory', required
    - `sourcePlatform` string, required
    - `canonicalUrl` string, required
    - `mirror` object
      - `platform` 'github'
      - `owner` string
      - `repo` string
      - `fullName` string
      - `url` string
      - `cloneUrl` string
      - `defaultBranch` string
      - `defaultBranchOnly` boolean
      - `fork` boolean
      - `sourceUrl` string
      - `status` 'ready' | 'pending' | 'failed'
      - `syncedAt` string
      - `error` string
    - `upstreamId` string
    - `upstreamOwner` string
    - `upstreamRepo` string
    - `creatorName` string
    - `licenseStatus` 'permissive' | 'copyleft' | 'proprietary' | 'unknown' | 'blocked' | 'manual_review', required
    - `licenseName` string
    - `sourceCheckedAt` string, required: Date upstream existence/activity was checked. This is not product install verification.
    - `sourceCheckMethod` 'github_api' | 'marketplace_api' | 'manual_research'
    - `sourceCheckStatus` 'active' | 'stale' | 'archived' | 'unavailable', required
    - `lastSeenAt` string, required
    - `installability` 'open_only' | 'importable' | 'installable' | 'verified', required
    - `tags` string[], required
    - `worksWith` string[], required
    - `upstreamPopularity` object
    - `onlyHarnessSignals` object
    - `popularityScore` number, required
    - `popularityBreakdown` object
    - `trust` object, required
      - `sourceChecked` boolean
      - `securityScan` 'pass' | 'warn' | 'fail' | 'not_scanned'
      - `installVerifiedAt` string: SuperSkill install verification evidence, when present.
      - `gateVerifiedAt` string
      - `riskTier` string
    - `release` ResourceRelease
      - `version` string, required
      - `artifactDigest` string, required
      - `archiveSize` integer, required
      - `trust` 'unreviewed', required
    - `nativeInstall` NativeHarnessInstall: Exact anonymous native-harness install tuple. It is local catalog evidence, not managed approval or a Verified badge.
      - `kind` 'native_harness', required
      - `resourceId` string, required
      - `ref` string, required
      - `version` string, required
      - `artifactDigest` string, required
      - `snapshot` true, required
      - `totalFileCount` integer, required
      - `archiveTruncated` false, required
      - `securityScan` 'pass', required
      - `scanner` 'static-v2', required
      - `scannedArtifactDigest` string, required
      - `riskTier` string, required
      - `permissions` object, required
      - `license` string, required
      - `managedApproval` false, required
      - `archiveUrl` string, uri, required
      - `commands` object, required
        - `codex` string, required
        - `claudeCode` string, required
    - `workspaceApproval` object
      - `workspaceSlug` string
      - `workspaceName` string
      - `collectionSlug` string
      - `sourceResourceId` string
      - `approvalState` 'pending_review' | 'approved' | 'approved_with_warning' | 'blocked' | 'blocked_by_scan' | 'deprecated'
      - `approvedBy` string
      - `approvedAt` string
      - `note` string
      - `riskSnapshot` object
    - `actions` object[], required
    - `source` object
  - `approvalState` string
  - `verified` false
  - `next` string

## Other responses

- `400`: Bad request
- `401`: Authorization required
- `403`: Authorization was provided but is not allowed for this action
- `404`: Resource not found
- `409`: The requested action conflicts with current product or resource state

---

[API](https://skmtc.dev/superskill/apis/superskill-api.md) · [All operations](https://skmtc.dev/superskill/apis/superskill-api/llms.txt) · [OpenAPI document](https://skmtc.dev/superskill/apis/superskill-api/revisions/ced2d2d1f217?raw)