Approvals
3 operations. {prefix} is the route prefix passed to
MapAgentPrism; the template uses /agentprism.
GET {prefix}/api/approvals/{id}
Section titled “GET {prefix}/api/approvals/{id}”Operation ID: AgentPrismGetPendingApproval
Returns a single pending approval request.
Unlike the list, this reads a request in any state, so it is how a client polls the outcome after deciding: the response then carries who decided, when, and which way. The request holds the tool call’s arguments as recorded, which is what an approver reviews before deciding. An unknown id returns 404.
Authorization: bearer authentication; Operator role policy when that policy is registered; RunsRead API-key scope.
| Parameter | In | Required | Type | Description and rules |
|---|---|---|---|---|
id |
path | yes | string (uuid) |
— |
| Response | Body | Headers |
|---|---|---|
| 200 OK | application/json → PendingApproval |
— |
POST {prefix}/api/approvals/{id}/decide
Section titled “POST {prefix}/api/approvals/{id}/decide”Operation ID: AgentPrismDecideApproval
Decides a pending approval request.
The decision enqueues a NEW run (same sessionId, new RunId); the old run stays AwaitingApproval. A second decision on the same request gets 409.
Authorization: bearer authentication; Operator role policy when that policy is registered; RunsWrite API-key scope.
| Parameter | In | Required | Type | Description and rules |
|---|---|---|---|---|
id |
path | yes | string (uuid) |
— |
Request body (required):
application/json→ApprovalDecisionRequest
| Response | Body | Headers |
|---|---|---|
| 200 OK | application/json → PendingApproval |
— |
GET {prefix}/api/approvals/pending
Section titled “GET {prefix}/api/approvals/pending”Operation ID: AgentPrismListPendingApprovals
Lists the tenant’s pending approval requests.
Only requests still awaiting a decision are returned; a decided request leaves the list and stays readable by id. A request appears here when a queued run (‘Prefer: respond-async’) stops on a tool call that needs approval — a run driven synchronously carries its approval in the response stream instead and never reaches this mailbox. Each entry carries an expiry, which is an absolute point in the future rather than an elapsed duration.
Authorization: bearer authentication; Operator role policy when that policy is registered; RunsRead API-key scope.
| Response | Body | Headers |
|---|---|---|
| 200 OK | application/json → array of PendingApproval |
— |