Work with approvals
An organisation can set a policy that some actions need a second person's approval. When a request meets the policy, the API does not run it. It answers 202 with a body whose status is pending_approval, and the action waits for a decision.
HTTP/1.1 202 Accepted
content-type: application/json
{
"id": "trf_...",
"status": "pending_approval"
}
Treat 202 as accepted, not done. Nothing has moved yet. Keep the id from the response.
Read approvals
GET /v1/approvals lists approvals, newest first, filtered with status or object_id. GET /v1/approvals/{id} returns one. The API is read-only for approvals: it shows them and never decides them.
Decisions happen in the console
An approver approves or rejects in the console, after step-up authentication. There is no API call that decides an approval, so an API key cannot approve its own request. The person who made the request (the maker) cannot approve it either: a second person must.
Follow the outcome
The approval.requested, approval.approved and approval.rejected webhooks tell you what happened, as described in the webhooks guide. On approval the action runs and its object continues through its usual states. On rejection it is canceled and nothing is paid.