Governance operations
Transition an approval to its next status (approve, reject, submit, cancel)
Publishes an eventType against an approval and returns its updated status.
Each eventType is only valid from specific current statuses — calling it from the wrong status is rejected, so check the approval’s current status first:
| From status | eventType | Resulting status |
|---|---|---|
PendingSubmission | RequestSubmitted | PendingReview |
PendingReview | RequestApproved | Approved |
PendingReview | RequestConditionalApproved | ConditionallyApproved |
PendingReview | RequestCancelled | PendingSubmission |
ConditionallyApproved | RequestApproved / FindingsApproved | Approved |
ConditionallyApproved | RequestRejected / RequestCancelled | PendingSubmission |
Approved | RequestRejected | PendingSubmission |
Approved | RevalidationRequired | PendingExpiration |
PendingExpiration | RequestApproved | Approved |
PendingExpiration | RequestRejected | PendingSubmission |
PendingExpiration | RevalidationExpired | Expired |
Expired | RequestSubmitted | PendingReview |
Expired | RequestApproved | Approved |
Expired | RequestRejected | PendingSubmission |
Calling an eventType that isn’t valid for the approval’s current status currently returns a generic 500 with a message like "invalid event RequestApproved for approval status PendingSubmission" — check status via GET /bundles/{id}/approvals first to avoid this. | ||
approvalId comes from GET /bundles/{id}/approvals. If omitted, stageApprovalId is used to resolve it instead. stageApprovalId identifies the approval slot defined by the policy; each bundle that has the policy applied gets its own Approval instance for that slot, and stageApprovalId resolves to that bundle-specific approvalId. Get it from GET /policy-versions/{id} (stages[].approvals[].id), using the bundle’s actual policyVersionId from GET /bundles/{id}/approvals. | ||
meta shape depends on eventType: | ||
| eventType | meta shape | |
| --- | --- | |
RequestApproved | {"result"?: {"evidenceId": string, "content": {...}}} — optionally submit the final evidence in the same call as approving | |
RequestConditionalApproved | {"result"?: {...same as above...}, "requiredFindings": string[]} — requiredFindings (finding IDs) is required | |
| all other event types | no defined fields — send {} | |
| Related: |
- GET /bundles//approvals (get the current status before choosing an eventType)
- POST /rpc/submit-result-to-policy (submit the evidence this approval depends on)
- POST /rpc/update-approval (change who is assigned to approve, not the approval’s status)
POST
Transition an approval to its next status (approve, reject, submit, cancel)
Body
application/json
Request for publishing an approval event
Available options:
RequestSubmitted, RequestCancelled, RequestApproved, RequestConditionalApproved, RequestRejected, FindingsApproved, PolicyReactivated, RevalidationRequired, RevalidationExpired, PolicyVersionUpgraded Response
OK
Available options:
PendingSubmission, PendingReview, Approved, ConditionallyApproved, PendingExpiration, Expired Last modified on September 3, 2026