Skip to content
SupaCloud Docs
Select themeSelect language

`GET /api/tool-approvals/decided` — every DECIDED approval across the caller's active workspace (`approved` / `rejected` / `timed_out` / `superseded`), newest decision first, REDACTED. The read-only audit (#1304) that keeps an approved visual object — its signed image links, its stable subject and the durable grant it produced — inspectable after it left the pending board. Read-only: there is no decide verb here. The service authz's the caller's membership of the resolved workspace.

GET
/api/tool-approvals/decided
curl --request GET \
  --url https://example.com/api/tool-approvals/decided

Parameters

Section titled “Parameters”

Query Parameters

Section titled “Query Parameters”
limit
integer format: int64
offset
integer format: int64
kind
string

Exact kind (tool | question | visual | tier_change).

Responses

Section titled “Responses”

200

Section titled “200”
Media typeapplication/json

One page of the read-only “Entschieden” view.

object
items
required
Array<object>

One DECIDED task_tool_approvals row as the read-only “Entschieden” view surfaces it (#1304): the same enrichment as [PendingToolApproval] plus the verdict (status / decided_by / decided_at / decision_text) and the durable-grant representation (grant_signature + granted_scopes). The raw payload never reaches a surface: subject / tool_name / prompt are lifted OUT of the payload after [redact_for_chat], so a secret in a prompt is masked exactly as on the pending path. This is what keeps an approved visual object — its signed image links, its stable subject, and the grant it produced — inspectable after it left the pending board.

object
agent_type
string | null
created_at
required
string format: date-time
decided_at
string | null format: date-time
decided_by
string | null
decision_text
string | null
grant_signature

The durable-grant key this decision maps to (cip::tool_approval::grant_signature), or None when the gate is about one moment (a question / tier change / a visual without a subject).

string | null
granted_scopes

The scopes at which a WORKSPACE grant for grant_signature EXISTS, so the row can say “remembered · workspace”. Empty when none was recorded. A personal grant is never listed here: it is one identity’s, and a signature is a flat global key, so showing it would attribute another identity’s grant to the workspace (review #1304).

Array<string>
id
required
string format: uuid
image_urls
required
Array<string>
kind
required
string
project_name
string | null
prompt
string | null
status
required

The verdict token: approved | rejected | timed_out | superseded.

string
subject

#1199 — the stable key a visual sign-off is about (/dashboard@1440x900).

string | null
task_id
required
string format: uuid
task_title
string | null
tool_name
string | null
workspace_id
required
string format: uuid
total
required
integer format: int64
Examplegenerated
{
  "items": [
    {
      "agent_type": "example",
      "created_at": "2026-04-15T12:00:00Z",
      "decided_at": "2026-04-15T12:00:00Z",
      "decided_by": "example",
      "decision_text": "example",
      "grant_signature": "example",
      "granted_scopes": [
        "example"
      ],
      "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "image_urls": [
        "example"
      ],
      "kind": "example",
      "project_name": "example",
      "prompt": "example",
      "status": "example",
      "subject": "example",
      "task_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "task_title": "example",
      "tool_name": "example",
      "workspace_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
    }
  ],
  "total": 1
}

401

Section titled “401”

Authentication required

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden license_required license_expired bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited too_many_requests quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

403

Section titled “403”

Permission denied

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden license_required license_expired bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited too_many_requests quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

500

Section titled “500”

Structured server error

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden license_required license_expired bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited too_many_requests quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}