---
title: "Operator agent: ask the operator to run one of the console’s acts"
method: POST
path: "/api/operator/proposals"
tags: ["Operator agent"]
---

# Operator agent: ask the operator to run one of the console’s acts

`POST /api/operator/proposals`

## Request

- Base URL: `https://tre-app.com`
- URL: `https://tre-app.com/api/operator/proposals`
- Auth: HTTP bearer

For the operator's agent credential (a personal token flagged by the installation's operator, see cloud/docs/ops-contract.md); every other caller receives 404 NOT_FOUND. Writes a proposal and nothing else: the operator approves or rejects it at the console (`consoleUrl`), and only an approval runs the act. One open proposal per act and target: a repeat supersedes the earlier one (`supersededId`). 400 for a body the act does not take, a missing target id, or an act that cannot apply to the target as it is (a credential already revoked, a request already past `new` or already `new`, a person with no live session, a workspace already in or out of suspension, a suspension date the act would refuse), naming the reason; 404 for a target that does not exist. Accepts `Idempotency-Key`.

## Headers

- `Idempotency-Key` string

## Request body

- OpsPropose
  - `action` 'access_request.invited' | 'access_request.declined' | 'access_request.reopened' | 'token.revoked' | 'grant.revoked' | 'sessions.revoked' | 'workspace.suspended' | 'workspace.suspension_lifted', required
  - `accountId` string, uuid
  - `subjectUserId` string, uuid
  - `targetId` string, uuid
  - `reasonCode` 'customer_request' | 'data_subject_request' | 'security_incident' | 'acceptable_use' | 'payment_dispute' | 'housekeeping', required
  - `reference` string
  - `rationale` string, required
  - `payload` object
  - `expiresInDays` integer

## Response `201`

Success

- OpsAgentProposeResult
  - `proposalId` string, uuid, required
  - `status` 'open' | 'approved' | 'rejected' | 'expired' | 'superseded', required
  - `supersededId` string, uuid, nullable, required
  - `consoleUrl` string, required

## Other responses

- `400`: Invalid request
- `401`: Unauthenticated
- `403`: Forbidden: insufficient role or token scope; scope denials name the held scope and the operation
- `404`: Not found
- `409`: Conflict
- `422`: Idempotency-Key reused with a different request body (IDEMPOTENCY_KEY_REUSED)
- `429`: Rate limited
- `500`: Internal server error
- `503`: Temporarily unavailable

---

[API](https://skmtc.dev/tre-app/apis/tre-rest-api.md) · [All operations](https://skmtc.dev/tre-app/apis/tre-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tre-app/apis/tre-rest-api/revisions/26a7187a05fc?raw)