Skip to content
SupaCloud Docs
Select themeSelect language

`GET /api/tool-approvals/pending` — the interactive approvals `pending` across the caller's active workspace (the `X-Workspace-Id` header, else the default joined workspace), newest first, REDACTED for delivery. Read-only; the decision flows through `decide` below. The service authz's the caller's membership of the resolved workspace.

GET
/api/tool-approvals/pending
curl --request GET \
  --url https://example.com/api/tool-approvals/pending

Responses

Section titled “Responses”

200

Section titled “200”
Media typeapplication/json
Array<object>

A pending approval as the chat/web pending-list surfaces it — the compact, REDACTED projection (pending_tool_approvals port / the dashboard view), so no surface re-redacts. payload is already redacted for chat delivery.

object
created_at
required
string format: date-time
deadline_at
string | null format: date-time
id
required
string format: uuid
image_urls
required
Array<string>
kind
required
string
payload
required
task_id
required
string format: uuid
timeout_policy
required
string
workspace_id
required
string format: uuid
Examplegenerated
[
  {
    "created_at": "2026-04-15T12:00:00Z",
    "deadline_at": "2026-04-15T12:00:00Z",
    "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "image_urls": [
      "example"
    ],
    "kind": "example",
    "payload": "example",
    "task_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "timeout_policy": "example",
    "workspace_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
  }
]

401

Section titled “401”

Authentication required

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

403

Section titled “403”

Permission denied

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

500

Section titled “500”

Structured server error

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}