Authentication
Send an API key as a bearer token. This endpoint does not state a specific permission in the specification, so give your key the least it needs and check the response rather than assuming.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X POST https://api.zinndigital.com/v1/ai/proposals/{proposalId}/decision \
-H "Authorization: Bearer zdk_live_…" \
-H "Content-Type: application/json" \
-d '{ "decision": <string<approve, reject>> }'Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
Approving APPLIES the action, **under the approver's own permissions**. The caller must hold the permission the action itself requires, in the proposal's own organization — so approving can never reach further than the approver could reach by hand. A caller without it gets a `404`, never a `403`: answering "forbidden" would confirm the proposal exists. ⛔ Not idempotent and not retryable. A second approval of an already-decided proposal is a `422`, which is the correct answer — a retry that applied the change twice would be a second cache purge or a second policy write nobody asked for.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
proposalId (path) | Uuid | Yes | — |
Request body
| Name | Type | Required | What it is |
|---|---|---|---|
decision | string<approve, reject> | Yes | — |
reason | string | No | — |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
id | Uuid | Yes | UUIDv7 identifier — sortable by creation time (docs/02 §8). |
action | string | Yes | — |
conversation_id | Uuid | No | The AI conversation this came out of, or `null` for one raised by a scheduled review. ⭐ Lets a chat surface show its own suggestions without a second endpoint, and lets `/ai` sa… |
action_title | string | Yes | — |
target_label | string | No | — |
rationale | string | No | Why, citing the measurement. This is what a person reads before approving. |
state | AgentProposalState | Yes | — |
mode | AgentProposalMode | Yes | How an approved proposal executes — decided by the authority ladder at the moment of approval, never frozen when the proposal was written. `attended` is a person clicking; `cana… |
reversibility | string<automatic, self_healing, manual> | No | Whether this change can be put back, carried on the proposal itself so a client rendering an undo control does not have to join this list against the capability catalogue — a se… |
approval_means | string | No | — |
outcome | string | No | — |
proposed_by | string | No | — |
created_at | string | Yes | — |
decided_at | object | No | — |
applied_at | object | No | — |
reverted | boolean | No | — |
Errors this endpoint can return
401 · 404 · 422 · 429