Approve Approval Request
POST/api/approval-requests/:approvalRequest/approve
Approve the current step of a pending approval request. When this completes the last step the request becomes approved and the document moves on (a purchase order opens — and is sent to the supplier if that was requested — a vendor deposit or bill payment is approved). Otherwise the request advances to the next step and its approvers are notified.
purchase-orders:writeGrant this scope to your token under Settings → Developer → Personal Access Tokens.
Authentication: Requires Bearer token with the purchase-orders scope (read for GET, write for POST/PUT/DELETE). You must be eligible for the current step: listed on it, a member of a listed role, listed on a higher tier, or an active delegate of someone eligible.
Body fields:
notes(string, optional, max 1000)
The message tells you whether the request completed (Approved.) or is waiting on the next step.
Error responses carry a machine-readable code next to the human message:
403approval_limit_exceeded— you are not eligible for the current step (over your limit, your own request under separation of duties, or you already decided this step). Other 403 codes:approval_withdraw_forbidden,approval_remind_forbidden,approval_override_forbidden,approval_reroute_forbidden.409approval_state_conflict— the request is no longer pending (already approved, rejected, withdrawn, or superseded by a newer request after the document changed). Re-read it and act on the current request.404— the approval request does not exist.
Request
Responses
- 200
- 401
- 403
- 404
- 409
- 422
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden
Response Headers
Not found — no record with the given identifier (or the route does not exist). Verify the ID before retrying.
Conflict
Response Headers
Validation failed — the body is a field → messages map (Laravel shape) or the platform envelope with a stable machine-readable code. Fix the payload and resubmit.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.