---
title: "Transition an administrator MFA approval using revision CAS"
method: POST
path: "/organizations/{organizationId}/admin-mfa-approval/approvals/{approvalId}/approve"
tags: ["Organizations"]
---

# Transition an administrator MFA approval using revision CAS

`POST /organizations/{organizationId}/admin-mfa-approval/approvals/{approvalId}/approve`

## Request

- Base URL: `https://api.xfa.tech`
- URL: `https://api.xfa.tech/organizations/{organizationId}/admin-mfa-approval/approvals/{approvalId}/approve`
- Auth: HTTP bearer

## Path parameters

- `organizationId` string, required
- `approvalId` string, required

## Request body

- AdminMfaApprovalTransition
  - `expected_revision` integer, required
  - `reason` string

## Response `200`

Updated approval

- AdminMfaApproval
  - `requester_email` string, email: Verified sign-in email of the applicant. Omitted when not yet recorded; never inferred from the device owner.
  - `approval_id` string, required
  - `canonical_user_id` string, required
  - `device_id` string, required
  - `status` 'PENDING' | 'APPROVED' | 'REJECTED', required
  - `revision` integer, required
  - `application` AdminMfaApprovalApplication, required
    - `application_id` string, required
    - `application_name` string
  - `requested_at` string, date-time
  - `updated_at` string, date-time, required: Last change, including a sign-in that refreshes the request context.
  - `decided_at` string, date-time: When an admin (or turning approval off) last decided; absent while never decided.
  - `rejection_reason` string: The reason of the latest rejection, only for REJECTED approvals. It is the text the user sees on sign-in; who decided stays out of the list.
  - `resolution_source` 'MANAGED_DEVICE' | 'ADMIN' | 'POLICY_OFF': What resolved the approval: automatic approval of a managed device, an administrator, or turning approval off. Absent while never decided.
  - `setting_version` integer, required
  - `grandfathered` boolean, required
  - `created_at` string, date-time, required
  - `decision` AdminMfaApprovalDecision
    - `actor_id` string, required: Stable namespaced authenticated principal, never an email address.
    - `reason` string
    - `at` string, date-time, required
  - `last_rejection` AdminMfaApprovalDecision
    - `actor_id` string, required: Stable namespaced authenticated principal, never an email address.
    - `reason` string
    - `at` string, date-time, required

## Other responses

- `400`: Invalid transition or missing decline reason
- `404`: Approval not found in this organization or capability unavailable
- `409`: Stale expected revision

---

[API](https://skmtc.dev/xfa/apis/xfa-api.md) · [All operations](https://skmtc.dev/xfa/apis/xfa-api/llms.txt) · [OpenAPI document](https://skmtc.dev/xfa/apis/xfa-api/revisions/1a1be0e8972b?raw)