Resolve an approval

Answers a tool call the agent’s security document held for approval. A denial can carry a message that steers the model.

POST/v1/sessions/{session_id}/approvals/{call_id}

Authorization

AuthorizationBearer token · headerrequired

Path parameters

session_idstring<uuid>required

Session id

call_idstringrequired

The call_id the `approval_requested` event named

Header parameters

Idempotency-Keystring

Retry the same operation with this key to return its saved receipt. Scoped by the operation's authenticated caller or resource. A different input under the same key returns 409. Receipts are retained for at least 7 days after completion, then removed by an hourly sweep. After removal the key can execute again. Fresh-only secrets are never included in a replay.

min length 1 · max length 255

Request body

requiredapplication/json

One of:

object

decisionstringrequired

Allowed:allow

object

decisionstringrequired

Allowed:deny

messagestring | null

Responses

200Decided, and recorded in the log. The broker holding the call reads the decision on its next tick and answers the engine in line; past the hold, the run's requeue re-fires the call instead.

seqinteger<int64>required

400Malformed body or path parameter.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

401Missing, malformed, or invalid bearer token.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

403A workspace credential lacking session.manage. A session token carries no permissions and never lands here.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

404No such session, the caller cannot see it, or a session token authenticates for another one; or no approval is pending for this call.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

409Idempotency-Key was already used for a different request. The approval is already settled.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer tokenRemember on this deviceInclude my values in samples

Parameters

Idempotency-KeyheaderRetry the same operation with this key to return its saved receipt. Scoped by the operation's authenticated caller or resource. A different input under the same key returns 409. Receipts are retained for at least 7 days after completion, then removed by an hourly sweep. After removal the key can execute again. Fresh-only secrets are never included in a replay.session_idpath*Session idcall_idpath*The call_id the `approval_requested` event named

Bodyapplication/json

Request body

Request

curl -X POST "https://api.us.cloud.subako.ai/v1/sessions/497f6eca-6276-4993-bfeb-53cbbbba6f08/approvals/string" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "decision": "allow"
}'

const response = await fetch("https://api.us.cloud.subako.ai/v1/sessions/497f6eca-6276-4993-bfeb-53cbbbba6f08/approvals/string", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type": "application/json"
  },
  body: "{\n  \"decision\": \"allow\"\n}"
});

import requests

response = requests.post(
    "https://api.us.cloud.subako.ai/v1/sessions/497f6eca-6276-4993-bfeb-53cbbbba6f08/approvals/string",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Content-Type": "application/json"
    },
    data="{\n  \"decision\": \"allow\"\n}",
)

Response

{
  "agent_id": "string",
  "agent_version_id": "string",
  "type": "session_created",
  "seq": 0
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}