Approvals API

GET/api/approvals/decision-readiness-contract

request access

Approvals decision readiness.

Permissions

HTTP request

GET https://<your-host>/api/approvals/decision-readiness-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/approvals/decision-readiness-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "approvalReadinessMode": "<string>",
  "identityProvider": "<string>",
  "configuredForProduction": false,
  "decisionQueueReadOnly": false,
  "routeCatalogReadOnly": false,
  "evidenceRequired": false,
  "localMockAuthAllowed": false,
  "providerCallsAllowed": false,
  "liveAuthenticationAllowed": false,
  "graphCallsAllowed": false,
  "entraGroupLookupAllowed": false,
  "serviceNowApprovalMutationAllowed": false,
  "approvalExecutionAllowed": false,
  "approvalQueueMutationAllowed": false,
  "approvalDecisionMutationAllowed": false,
  "notificationDispatchAllowed": false,
  "workflowMutationAllowed": false,
  "rawApproverDataAllowed": false,
  "rawApprovalPayloadsAllowed": false,
  "rawRequestPayloadsAllowed": false,
  "rawRecipientDataAllowed": false,
  "rawProviderPayloadsAllowed": false,
  "rawLogContentAllowed": false,
  "rawRowsAllowed": false,
  "tenantIdentifiersAllowed": false,
  "objectIdentifiersAllowed": false,
  "principalIdentifiersAllowed": false,
  "groupIdentifiersAllowed": false,
  "serviceNowIdentifiersAllowed": false,
  "privateNetworkValuesAllowed": false,
  "credentialValuesAllowed": false,
  "tokenValuesAllowed": false,
  "approvalRoutes": [],
  "decisionStates": [],
  "decisionTypes": [],
  "routeStages": [],
  "approvalScopes": [],
  "escalationStates": [],
  "requiredGuards": [],
  "blockedReasons": [],
  "requiredEvidence": [],
  "rules": []
}

GET/api/approvals/pending

approve access

Returns the list of requests pending approval by the calling approver.

A request is "pending my approval" iff ALL hold:

1. status = 'planned' (the only approvable from-state), AND
2. NO current-epoch decision exists for (request_id, role).

NOTE: The approval_route @> containment filter is intentionally NOT applied here. The request lifecycle does not populate approval_route with canonical role constants before the approval step: new requests start with approval_route = [] and the plan transition does not push any role into it. Filtering on approval_route would therefore return nothing for real data. Per-request approver-type routing is a documented follow-up (resolve the display-vs-canonical role-string mismatch and have the lifecycle push canonical roles into approval_route per required-approver-per-type if that model is adopted). Until then, an approver's inbox = all planned requests they have not yet decided.

The role constant $1 IS used in the NOT EXISTS sub-query — that sub-query is correct because the approve/reject handlers write request_approval_decisions rows keyed on the same approval_role_for canonical constant.

CRITICAL AUTHZ NOTE: this is a GET, so the central read middleware admits any "request"/"audit" role holder through (it treats all non-sensitive GETs as ordinary reads). The approve-only requirement MUST be enforced here in the handler — exactly mirroring requests_approve and requests_reject.

Permissions

HTTP request

GET https://<your-host>/api/approvals/pending

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/approvals/pending'