> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corebasehq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Approve or decline an action

> Records a decision on a held action.

This does not run anything by itself: the held call executes on the
conversation's next completion, which is also where the assistant reports
what happened. Send the conversation another request afterwards — with no
new user message if you have nothing to add. Requires the `mcp_query`
permission.

Records a decision on an action a guardrail rule is holding.

This endpoint does not run anything by itself. Approving marks the held call as
allowed **once**; it executes on the conversation's next completion, which is
also where the assistant explains what happened. So after deciding, send that
conversation another request — with no new user message if you have nothing to
add:

```bash theme={null}
curl https://api.corebasehq.com/api/v1/chat/completions \
  -H "Authorization: Bearer $COREBASE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "conversation_id": "conv_...",
    "messages": [],
    "stream": false
  }'
```

Declining is final: the call never runs, and the assistant is told not to retry
it or attempt it another way.

A decision can only be made once, and only within 24 hours of the request. A
second attempt returns `409`.


## OpenAPI

````yaml api-reference/openapi.json POST /api/v1/approvals/{approval_id}
openapi: 3.1.0
info:
  title: CoreBase Developer API
  summary: Build on CoreBase with a cb_live_ token.
  description: >-
    Call CoreBase from your own apps with a `cb_live_` API token. The chat
    endpoint is OpenAI-compatible, so any OpenAI client works by pointing its
    base URL at this API. Create a token in the panel under API Tokens.


    Authenticate every request with `Authorization: Bearer cb_live_...`.
    Responses are JSON, except the chat endpoint, which streams Server-Sent
    Events.
  version: 0.0.1
  contact:
    name: CoreBase
    url: https://corebasehq.com
servers:
  - url: https://api.corebasehq.com
    description: Production
security:
  - bearerAuth: []
tags:
  - name: chat
    description: OpenAI-compatible chat completions over your connected data.
  - name: sources
    description: Data sources the agent can query.
  - name: agents
    description: Governed agent flows and their runs.
  - name: account
    description: Subscription plan and end-user usage for your organization.
paths:
  /api/v1/approvals/{approval_id}:
    post:
      tags:
        - approvals
      summary: Approve or decline an action
      description: >-
        Records a decision on a held action.


        This does not run anything by itself: the held call executes on the

        conversation's next completion, which is also where the assistant
        reports

        what happened. Send the conversation another request afterwards — with
        no

        new user message if you have nothing to add. Requires the `mcp_query`

        permission.
      operationId: decideApproval
      parameters:
        - name: approval_id
          in: path
          required: true
          schema:
            type: string
            title: Approval Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApprovalDecision'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '401':
          description: Missing or invalid API token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '403':
          description: The token lacks the permission this endpoint requires.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '404':
          description: No pending approval with that id.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '409':
          description: The approval was already decided or has expired.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
        '429':
          description: >-
            Rate limit exceeded. Back off and retry after the interval in the
            `Retry-After` response header.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      security:
        - bearerAuth: []
components:
  schemas:
    ApprovalDecision:
      properties:
        decision:
          type: string
          enum:
            - approve
            - reject
          title: Decision
          description: '`approve` runs the held call; `reject` refuses it for good.'
      type: object
      required:
        - decision
      title: ApprovalDecision
      description: Approve or decline a held action.
    ApiError:
      properties:
        detail:
          anyOf:
            - type: string
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Detail
          description: Error message, or an object with a stable `error` code and context.
      additionalProperties: true
      type: object
      title: ApiError
      description: |-
        A structured error. `detail` is a human-readable message, or an object
        carrying a stable `error` code plus context.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: A `cb_live_` API token, created in the panel under API Tokens.

````