cloudforbots-com Approval Rules API
The approval-rules API from cloudforbots-com — 6 operation(s) for approval-rules.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/cloudforbots-com:cloudforbots-com-approval-rules-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Cloud for Bots Approval Rules API
version: 1.0.0
description: 'One API for every Cloud for Bots tool: loop detection, run memory (checkpoint/resume), run budgets, approval rules and scheduled wake-ups for AI agents. **Auth:** `Authorization: Bearer `. Any one of your keys works for every tool. Free keys: https://cloudforbots.com/offer
**Retries:** read actions retry automatically on 502/503/504. Send `Idempotency-Key` to make writes safe to retry. **Limits:** 20 requests/second per key (429 + `Retry-After`). **Webhooks:** signed with `cfb-signature: t=,v1=`, where v1 = HMAC-SHA256(secret, t + "." + raw body). Retries: 1m, 5m, 30m, 2h, 6h. **MCP:** https://cloudforbots.com/mcp (Streamable HTTP). **Status:** https://cloudforbots.com/status
**SDKs:** TypeScript/JS (types) · Python
# Quickstart
Get a free key at cloudforbots.com/offer (one email, keys show right away). Any one of your keys works for every tool. Keep it in an environment variable:
```bash
export CLOUDFORBOTS_API_KEY=mb_your_key_here
```
## TypeScript / JavaScript
No install needed: the SDK is one zero-dependency ES module (Node 18+, Deno, Bun, browsers). ```bash
curl -o cloudforbots.mjs https://cloudforbots.com/sdk/cloudforbots.mjs
curl -o cloudforbots.d.ts https://cloudforbots.com/sdk/cloudforbots.d.ts # types for TypeScript
```
```ts
import { CloudForBots, CloudForBotsError } from "./cloudforbots.mjs";
const cfb = new CloudForBots(); // reads CLOUDFORBOTS_API_KEY
// 1. After each agent step, ask Loop Breaker if the run is stuck
const step = await cfb.loop.checkStep({ run_id: "invoice-run-42", tool: "search_crm", args: { customer: 4471 }, error: "timeout after 30s" });
if (step.halt) throw new Error("Loop detected: " + step.outcome);
// 2. Save progress so a crashed run can resume
await cfb.memory.saveCheckpoint({ run_id: "invoice-run-42", step: "invoice-312", state: { done: 312 } }, { idempotencyKey: "invoice-run-42:312" });
const resume = await cfb.memory.resume({ run_id: "invoice-run-42" });
// 3. Errors carry the HTTP status, type and request id
try { await cfb.approve.checkAction({ action: "delete 40 customer records" }); }
catch (e) { if (e instanceof CloudForBotsError) console.error(e.status, e.type, e.requestId); }
```
## Python
Standard library only (Python 3.8+). ```bash
curl -o cloudforbots.py https://cloudforbots.com/sdk/cloudforbots.py
```
```python
from cloudforbots import CloudForBots, CloudForBotsError
cfb = CloudForBots() # reads CLOUDFORBOTS_API_KEY
step = cfb.loop.check_step(run_id="invoice-run-42", tool="search_crm", args={"customer": 4471}, error="timeout after 30s")
if step.get("halt"):
raise SystemExit("Loop detected: " + step["outcome"])
cfb.memory.save_checkpoint(run_id="invoice-run-42", step="invoice-312", state={"done": 312}, idempotency_key="invoice-run-42:312")
print(cfb.memory.resume(run_id="invoice-run-42"))
try:
cfb.approve.check_action(action="delete 40 customer records")
except CloudForBotsError as e:
print(e.status, e.type, e.request_id)
```
## Webhooks
```python
from cloudforbots import verify_webhook
# Flask example: raw bytes, exactly as received
ok = verify_webhook(WEBHOOK_SECRET, request.headers["cfb-signature"], request.get_data())
```
Register an endpoint with `cfb.webhooks_add("https://you.example/hook", ["loop.halted", "budget.stopped"])` (Python) or `cfb.webhooks.add(url, events)` (JS). The secret is returned once. Rotate it with `cfb.webhooks_rotate(url)`: the old secret keeps working for 24 hours, and during that window `cfb-signature` carries two `v1=` values (`verify_webhook` accepts either). See failed deliveries with `cfb.webhooks_deliveries("failed")` and resend one with `cfb.webhooks_redeliver(id)`. Events: `loop.halted`, `budget.stopped`, `approval.held`, `call.failed`, `key.cap_warning`, `key.cap_reached`, `key.expiring`, `key.expired`. ## MCP
Point any MCP client at `https://cloudforbots.com/mcp` with header `Authorization: Bearer $CLOUDFORBOTS_API_KEY`.'
servers:
- url: https://cloudforbots.com
security:
- bearer: []
tags:
- name: approval-rules
paths:
/api/v1/approval-rules/check_action:
post:
operationId: approval_rules__check_action
tags:
- approval-rules
summary: check action
description: 'Before a consequential action, ask whether the user''s rules auto-approve it. Returns auto_approve, needs_approval (with a plain-English approval card and a link the user can tap) or deny. Free plan is watch-only: it reports what it WOULD decide and logs it for the weekly report, but nothing counts as approved, so ask your user as you normally would.'
parameters:
- name: Idempotency-Key
in: header
required: false
schema:
type: string
maxLength: 128
description: Makes the call safe to retry; the same key returns the stored reply for 24h.
- name: X-Request-Id
in: header
required: false
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
action:
type: object
description: The action your agent wants to take.
properties:
type:
type: string
description: 'Short verb: read, search, draft, send_email, send_message, post, purchase, payment, delete, deploy, change_settings, ...'
summary:
type: string
description: One plain sentence of what will happen, e.g. "Buy a $3.99 domain renewal for example.com".
amount_usd:
type: number
description: Money involved, if any.
target:
type: string
description: 'Who or what it touches: a recipient email, domain, file, repo.'
reversible:
type: boolean
description: Can it be undone easily?
required:
- type
- summary
required:
- action
responses:
'200':
description: Tool result (always includes request_id).
headers:
x-request-id:
schema:
type: string
x-ratelimit-remaining:
schema:
type: integer
content:
application/json:
schema:
type: object
additionalProperties: true
'400':
description: Bad JSON
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
const: false
error:
type: object
properties:
type:
type: string
message:
type: string
request_id:
type: string
'401':
description: Missing or bad key
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
const: false
error:
type: object
properties:
type:
type: string
message:
type: string
request_id:
type: string
'403':
description: Key limits (scopes) do not allow this tool or action
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
const: false
error:
type: object
properties:
type:
type: string
message:
type: string
request_id:
type: string
'409':
description: Same Idempotency-Key still running
'422':
description: Idempotency-Key reused on another route
'429':
description: Over 20 requests/second for this key, or free daily limit
headers:
retry-after:
schema:
type: integer
'504':
description: Tool did not answer in time; retry with the same Idempotency-Key
/api/v1/approval-rules/get_decision:
post:
operationId: approval_rules__get_decision
tags:
- approval-rules
summary: get decision
description: Check whether the user approved or rejected an approval card (by card_id and card_token). Only act when status is approved.
parameters:
- name: Idempotency-Key
in: header
required: false
schema:
type: string
maxLength: 128
description: Makes the call safe to retry; the same key returns the stored reply for 24h.
- name: X-Request-Id
in: header
required: false
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
card_id:
type: string
card_token:
type: string
required:
- card_id
- card_token
responses:
'200':
description: Tool result (always includes request_id).
headers:
x-request-id:
schema:
type: string
x-ratelimit-remaining:
schema:
type: integer
content:
application/json:
schema:
type: object
additionalProperties: true
'400':
description: Bad JSON
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
const: false
error:
type: object
properties:
type:
type: string
message:
type: string
request_id:
type: string
'401':
description: Missing or bad key
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
const: false
error:
type: object
properties:
type:
type: string
message:
type: string
request_id:
type: string
'403':
description: Key limits (scopes) do not allow this tool or action
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
const: false
error:
type: object
properties:
type:
type: string
message:
type: string
request_id:
type: string
'409':
description: Same Idempotency-Key still running
'422':
description: Idempotency-Key reused on another route
'429':
description: Over 20 requests/second for this key, or free daily limit
headers:
retry-after:
schema:
type: integer
'504':
description: Tool did not answer in time; retry with the same Idempotency-Key
/api/v1/approval-rules/set_rules:
post:
operationId: approval_rules__set_rules
tags:
- approval-rules
summary: set rules
description: 'Save the user''s rules (needs an API key so they stay yours). Each rule: {name, when:{type:[...], max_usd, min_usd, reversible, target_ends_with:[...]}, verdict:"auto"|"ask"|"deny"}. First matching rule wins; anything unmatched needs approval. Call once without confirm to preview, then with confirm=true.'
parameters:
- name: Idempotency-Key
in: header
required: false
schema:
type: string
maxLength: 128
description: Makes the call safe to retry; the same key returns the stored reply for 24h.
- name: X-Request-Id
in: header
required: false
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
rules:
type: array
items:
type: object
confirm:
type: boolean
required:
- rules
responses:
'200':
description: Tool result (always includes request_id).
headers:
x-request-id:
schema:
type: string
x-ratelimit-remaining:
schema:
type: integer
content:
application/json:
schema:
type: object
additionalProperties: true
'400':
description: Bad JSON
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
const: false
error:
type: object
properties:
type:
type: string
message:
type: string
request_id:
type: string
'401':
description: Missing or bad key
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
const: false
error:
type: object
properties:
type:
type: string
message:
type: string
request_id:
type: string
'403':
description: Key limits (scopes) do not allow this tool or action
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
const: false
error:
type: object
properties:
type:
type: string
message:
type: string
request_id:
type: string
'409':
description: Same Idempotency-Key still running
'422':
description: Idempotency-Key reused on another route
'429':
description: Over 20 requests/second for this key, or free daily limit
headers:
retry-after:
schema:
type: integer
'504':
description: Tool did not answer in time; retry with the same Idempotency-Key
/api/v1/approval-rules/get_rules:
post:
operationId: approval_rules__get_rules
tags:
- approval-rules
summary: get rules
description: Show the rules in effect for your key (or the default starter rules).
parameters:
- name: Idempotency-Key
in: header
required: false
schema:
type: string
maxLength: 128
description: Makes the call safe to retry; the same key returns the stored reply for 24h.
- name: X-Request-Id
in: header
required: false
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
properties: {}
responses:
'200':
description: Tool result (always includes request_id).
headers:
x-request-id:
schema:
type: string
x-ratelimit-remaining:
schema:
type: integer
content:
application/json:
schema:
type: object
additionalProperties: true
'400':
description: Bad JSON
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
const: false
error:
type: object
properties:
type:
type: string
message:
type: string
request_id:
type: string
'401':
description: Missing or bad key
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
const: false
error:
type: object
properties:
type:
type: string
message:
type: string
request_id:
type: string
'403':
description: Key limits (scopes) do not allow this tool or action
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
const: false
error:
type: object
properties:
type:
type: string
message:
type: string
request_id:
type: string
'409':
description: Same Idempotency-Key still running
'422':
description: Idempotency-Key reused on another route
'429':
description: Over 20 requests/second for this key, or free daily limit
headers:
retry-after:
schema:
type: integer
'504':
description: Tool did not answer in time; retry with the same Idempotency-Key
/api/v1/approval-rules/weekly_report:
post:
operationId: approval_rules__weekly_report
tags:
- approval-rules
summary: weekly report
description: 'Draft a plain-English report of the last 7 days: actions checked, how many your rules would auto-approve, how many needed you, top kinds of asks, and rule suggestions. Read-only; sends nothing.'
parameters:
- name: Idempotency-Key
in: header
required: false
schema:
type: string
maxLength: 128
description: Makes the call safe to retry; the same key returns the stored reply for 24h.
- name: X-Request-Id
in: header
required: false
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
properties: {}
responses:
'200':
description: Tool result (always includes request_id).
headers:
x-request-id:
schema:
type: string
x-ratelimit-remaining:
schema:
type: integer
content:
application/json:
schema:
type: object
additionalProperties: true
'400':
description: Bad JSON
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
const: false
error:
type: object
properties:
type:
type: string
message:
type: string
request_id:
type: string
'401':
description: Missing or bad key
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
const: false
error:
type: object
properties:
type:
type: string
message:
type: string
request_id:
type: string
'403':
description: Key limits (scopes) do not allow this tool or action
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
const: false
error:
type: object
properties:
type:
type: string
message:
type: string
request_id:
type: string
'409':
description: Same Idempotency-Key still running
'422':
description: Idempotency-Key reused on another route
'429':
description: Over 20 requests/second for this key, or free daily limit
headers:
retry-after:
schema:
type: integer
'504':
description: Tool did not answer in time; retry with the same Idempotency-Key
/api/v1/approval-rules/usage_and_upgrade:
post:
operationId: approval_rules__usage_and_upgrade
tags:
- approval-rules
summary: usage and upgrade
description: 'Show today''s usage for your key or IP and the $49/month All Access upgrade link (cloudforbots.com/offer). Free tier: 200 calls/day. Not metered.'
parameters:
- name: Idempotency-Key
in: header
required: false
schema:
type: string
maxLength: 128
description: Makes the call safe to retry; the same key returns the stored reply for 24h.
- name: X-Request-Id
in: header
required: false
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
properties: {}
responses:
'200':
description: Tool result (always includes request_id).
headers:
x-request-id:
schema:
type: string
x-ratelimit-remaining:
schema:
type: integer
content:
application/json:
schema:
type: object
additionalProperties: true
'400':
description: Bad JSON
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
const: false
error:
type: object
properties:
type:
type: string
message:
type: string
request_id:
type: string
'401':
description: Missing or bad key
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
const: false
error:
type: object
properties:
type:
type: string
message:
type: string
request_id:
type: string
'403':
description: Key limits (scopes) do not allow this tool or action
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
const: false
error:
type: object
properties:
type:
type: string
message:
type: string
request_id:
type: string
'409':
description: Same Idempotency-Key still running
'422':
description: Idempotency-Key reused on another route
'429':
description: Over 20 requests/second for this key, or free daily limit
headers:
retry-after:
schema:
type: integer
'504':
description: Tool did not answer in time; retry with the same Idempotency-Key
components:
securitySchemes:
bearer:
type: http
scheme: bearer