Skip to content
SupaCloud Docs
Select themeSelect language

`POST /api/tool-approvals/{id}/decide` — approve/reject one interactive approval by id. The SINGLE decide source (`services::tool_approvals::decide_approval`) every surface's Approve/Reject button resolves through: the service binds the workspace-membership authz to the approval row, CAS-resolves it, and resumes the paused agent. A bad verdict token -> 400; an approval the caller can't access -> 403; one that no longer exists / is already decided -> 404 / 400 from the service.

POST
/api/tool-approvals/{approval_id}/decide
curl --request POST \
  --url https://example.com/api/tool-approvals/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/decide \
  --header 'Content-Type: application/json' \
  --data '{ "decision": "example", "text": "example" }'

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
approval_id
required
string format: uuid

Pending tool-approval id

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json

The decide request body: the verdict token (approve/reject) plus an optional free-text note the human attaches (surfaced to the agent in the resume wire).

object
decision
required
string
text
string | null
Examplegenerated
{
  "decision": "example",
  "text": "example"
}

Responses

Section titled “Responses”

200

Section titled “200”

Decision recorded

Media typeapplication/json

{"decided": "<handle>"} — a decision acknowledgement echoing the chosen outcome handle/status (e.g. an approval status or a workflow node decision handle).

object
decided
required

The decided outcome handle/status.

string
Examplegenerated
{
  "decided": "example"
}

400

Section titled “400”

Structured client error

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

401

Section titled “401”

Authentication required

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

403

Section titled “403”

Permission denied

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

404

Section titled “404”

Approval not found / already decided

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

500

Section titled “500”

Structured server error

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}