Approve or deny
The authenticated principal must have approval authority under the ROOT run's approver set (spec/schema/README.md, Approval authority): the configured approvers, else the root run's originating principal. A descendant's challenge reached through the descendant thread's route is decided under the same root set. Otherwise 403 forbidden and nothing is appended.
Authorization
host Checked by host({authenticate}), which maps the request to a Principal or rejects it.
In: header
Path Parameters
Lowercase UUID string. Writers MUST generate UUIDv7; readers accept any lowercase UUID, so the version is not an admission rule.
^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$Lowercase UUID string. Writers MUST generate UUIDv7; readers accept any lowercase UUID, so the version is not an admission rule.
^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
curl -X POST "https://example.com/v1/threads/string/approvals/string" \ -H "Content-Type: application/json" \ -d '{ "decision": "grant" }'{ "event_id": "string"}