Skip to main content
POST
Approve Action Request
Dashboard session only — outside the API key scope catalog, so an API key gets 403 API_KEY_SCOPE_DENIED. Deciding a request is a human call, including when an agent connected through MCP asked for it.
Requires members:manage and the permission the action maps to (see the table on Create Action Request).
There’s no body on this endpoint — it re-runs the real domain service using the params persisted at creation time, with the approver’s identity and permission, never the requester’s. This closes two holes at once: nobody can retarget the action by sending a different resource_id on approve, and the action never executes under a lesser-privileged identity than the one that actually authorized it.
If the underlying domain action fails (e.g. the app is already gone), the request stays pending — it doesn’t flip to approved or rejected — so it can be retried until it succeeds or expires. Only a successful domain call decides the outcome.

Path

string
required
Workspace ID.
string
required
Action request ID.

Response

Same shape as a List Action Requests row, status: "approved".

Errors