KaiCalls Approval Requests API

openapi: 3.2.0
info:
  title: KaiCalls Public Approval Requests API
  version: '2026-06-05'
  description: Machine-readable surface for KaiCalls external developers and client agents.
servers:
- url: https://www.kaicalls.com/api
security:
- bearerAuth: []
tags:
- name: Approval Requests
paths:
  /v1/approval-requests:
    post:
      summary: Generic approval-channel intake for an external agent control plane…
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/approvalRequestCreate'
      responses:
        '202':
          description: Approval interaction dispatched.
        '400':
          description: Malformed request (missing/invalid field).
        '403':
          description: Missing approvals:write scope, or callback_url not allowlisted.
        '410':
          description: Request already expired.
        '422':
          description: Unsupported required_factors entry for this deployment.
        '501':
          description: channel.type "sms" (SMS-only delivery not yet implemented).
        '502':
          description: Provider dispatch failure.
        '503':
          description: No approval-channel agent configured.
      x-required-scopes: approvals:write
      tags:
      - Approval Requests
      operationId: postV1ApprovalRequests
      x-operation-id-source: derived
components:
  schemas:
    approvalRequestCreate:
      $schema: https://json-schema.org/draft/2020-12/schema
      $id: https://www.kaicalls.com/api/v1/schemas/approvalRequestCreate
      title: Approval Channel Request Create
      description: 'Generic, provider-neutral approval-channel intake — lets an external agent control plane (first consumer: Zehrava Gate) reach a human by voice and get the interaction tracked through the normal call lifecycle.'
      type: object
      additionalProperties: false
      required:
      - source
      - source_request_id
      - principal_id
      - channel
      - summary
      - risk_level
      - expires_at
      - callback_url
      properties:
        source:
          type: string
          description: Lowercase control-plane slug, e.g. "zehrava-gate".
        source_request_id:
          type: string
        source_intent_id:
          type: string
        message_id:
          type: string
        responds_to_hash:
          type: string
          pattern: ^sha256:[a-f0-9]{64}$
        principal_id:
          type: string
        channel:
          type: object
          additionalProperties: false
          required:
          - type
          - address
          properties:
            type:
              type: string
              enum:
              - voice
              - voice_then_sms
              - sms_then_voice
              - sms
              description: Only voice-prefixed types dispatch a live call today; "sms" returns 501.
            address:
              type: string
              description: E.164 phone number.
        summary:
          type: string
          maxLength: 2000
        risk_level:
          type: string
          enum:
          - low
          - medium
          - high
          - critical
        required_factors:
          type: array
          items:
            type: string
        expires_at:
          type: string
          format: date-time
        callback_url:
          type: string
          format: uri
          description: Must be https and host-allowlisted.
        callback_secret_id:
          type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'KaiCalls API key. Per-operation scope requirements are published on each operation as `x-required-scopes` — a scope string, or a nested `{ allOf: [...] }` / `{ anyOf: [...] }` expression. An operation with no `x-required-scopes` requires a valid key but no particular scope.'
      x-scopes:
      - workspaces:read
      - workspaces:write
      - numbers:read
      - numbers:write
      - agents:read
      - agents:write
      - communication-runs:read
      - communication-runs:write
      - calls:read
      - calls:write
      - sms:read
      - sms:write
      - webhooks:read
      - webhooks:write
      - events:read
      - events:replay
      - lifecycle:write
      - leads:read
      - leads:write
      - emails:read
      - emails:write
      - sdr:read
      - sdr:write
      - evals:read
      - evals:write
      - appointments:read
      - appointments:write
      - knowledge:read
      - knowledge:write
      - products:read
      - products:write
      - integrations:write
      - approvals:write
      - concierge:write
      - billing:read
      - billing:write
      - call_evidence:read
      - call_evidence:write
      - support:write
    sessionAuth:
      type: apiKey
      in: cookie
      name: sb-access-token
      description: Authenticated dashboard session cookie. Used by first-party flows that mint or manage API keys.