Skip to content
SupaCloud Docs
Select themeSelect language

`GET /api/tool-approvals/board` — the #691 §E server-paginated pending-approvals board: filtered+paged REDACTED rows + total + (optional) kind facets.

GET
/api/tool-approvals/board
curl --request GET \
  --url https://example.com/api/tool-approvals/board

Parameters

Section titled “Parameters”

Query Parameters

Section titled “Query Parameters”
limit
integer format: int64
offset
integer format: int64
kind
string

Exact kind (tool | question | visual) — the facet/select.

q
string

Free-text search over the payload tool-name / prompt.

sort
string

Whitelisted sort key: created_at | kind.

dir
string

Sort direction asc | desc (default desc).

include_facets
boolean

Recompute the workspace kind facets (default true).

Responses

Section titled “Responses”

200

Section titled “200”
Media typeapplication/json

One page of the pending-approvals board: the REDACTED rows, the filtered total (for the pager), and — only when requested — the workspace kind facets.

object
facets
One of:
null
items
required
Array<object>

A pending approval as the chat/web pending-list surfaces it — the compact, REDACTED projection (pending_tool_approvals port / the dashboard view), so no surface re-redacts. payload is already redacted for chat delivery.

object
created_at
required
string format: date-time
deadline_at
string | null format: date-time
id
required
string format: uuid
image_urls
required
Array<string>
kind
required
string
payload
required
task_id
required
string format: uuid
timeout_policy
required
string
workspace_id
required
string format: uuid
total
required
integer format: int64
Examplegenerated
{
  "facets": {
    "kinds": [
      {
        "count": 1,
        "value": "example"
      }
    ]
  },
  "items": [
    {
      "created_at": "2026-04-15T12:00:00Z",
      "deadline_at": "2026-04-15T12:00:00Z",
      "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "image_urls": [
        "example"
      ],
      "kind": "example",
      "payload": "example",
      "task_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "timeout_policy": "example",
      "workspace_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
    }
  ],
  "total": 1
}

401

Section titled “401”

Authentication required

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

403

Section titled “403”

Permission denied

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

500

Section titled “500”

Structured server error

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}