---
title: "Modify and re-evaluate one reviewed action"
method: POST
path: "/v1/approvals/{id}/modify"
tags: ["Approvals"]
---

# Modify and re-evaluate one reviewed action

`POST /v1/approvals/{id}/modify`

## Request

- Base URL: `https://api.thrd.email`
- URL: `https://api.thrd.email/v1/approvals/{id}/modify`
- Auth: API key in cookie `thrd_approver_session`

Human control-plane mutation. The original approval becomes terminally modified. THRD creates a new action proposal from the supplied arguments, computes a new action hash, and runs the active policy again. Any resulting review is linked to the original approval.

## Path parameters

- `id` string, uuid, required

## Headers

- `x-csrf-token` string, required
- `Idempotency-Key` string, required

## Request body

- object
  - `arguments` object, required: Complete replacement action arguments. The server preserves the original action type and source, then creates a new action hash and policy decision.

## Response `200`

Original approval invalidated and replacement action evaluated

- object
  - `approval_id` string, uuid, required
  - `status` 'modified', required
  - `receipt_id` string, uuid, required
  - `completed_at` string, date-time, required
  - `idempotent_replay` boolean, required
  - `replacement` object, required
    - `action_id` string, required
    - `action_proposal_id` string, uuid, required
    - `decision_id` string, uuid, required
    - `receipt_id` string, uuid, required
    - `action_hash` string, required
    - `policy_hash` string, required
    - `decision_context_hash` string, required
    - `mode` 'shadow' | 'enforce', required
    - `enforcement_applied` boolean, required
    - `decision` 'allow' | 'review' | 'deny'
    - `would_decision` 'allow' | 'review' | 'deny'
    - `reason_codes` string[], required
    - `matched_rule_ids` string[], required
    - `risk_summary` object, required
      - `maximum_severity` 'none' | 'low' | 'medium' | 'high' | 'critical', required
      - `signal_codes` string[], required
    - `trace_id` string, uuid, required
    - `idempotent_replay` boolean, required
    - `approval` union
      - object
        - `status` 'feature_disabled', required
      - object
        - `approval_id` string, uuid, required
        - `status` 'pending', required
        - `expires_at` string, date-time, required
        - `receipt_id` string, uuid, required
      - object
        - `approval_id` string, uuid, required
        - `status` 'approved' | 'denied' | 'modified' | 'expired' | 'canceled' | 'capability_issued' | 'executed' | 'execution_failed', required
        - `expires_at` string, date-time, required
        - `completed_at` string, date-time, required
        - `receipt_id` string, uuid, required
    - `capability` union
      - object
        - `status` 'feature_disabled', required
      - object
        - `capability_id` string, uuid, required
        - `status` 'issued' | 'redeemed' | 'expired' | 'revoked', required
        - `expires_at` string, date-time, required
        - `delivery_count` integer, required
        - `receipt_id` string, uuid

## Other responses

- `400`: Invalid ID, idempotency key or arguments
- `401`: Missing, invalid, expired or rotated human session
- `409`: Expired, already terminal, or conflicting modification attempt
- `413`: Modification request exceeds 65536 bytes
- `429`: Human mutation rate limit exceeded
- `503`: Approval or authorization authority unavailable

---

[API](https://skmtc.dev/thrd/apis/thrd-agent-email-api.md) · [All operations](https://skmtc.dev/thrd/apis/thrd-agent-email-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thrd/apis/thrd-agent-email-api/revisions/d8a88129cd34?raw)