sealgate-ai Approvals API

openapi: 3.2.0
info:
  title: Sealgate Ai Approvals API
  x-refined-note:
  - x-source-of-truth differs across the merged source definitions and was not carried
  version: '1.0'
  description: 'Operations tagged Approvals across 3 of this provider''s published API definitions: sealgate-ai-openapi.json, sealgate-ai-dashboard-openapi.json, sealgate-ai-management-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://dashboard.sealgate.ai
  description: SealGate management API - release
- url: https://demo-dashboard.sealgate.ai
  description: SealGate management API - demo
tags:
- name: Approvals
  description: Review and resolve gated (lethal-trifecta and policy) approval requests.
paths:
  /api/v1/approvals:
    get:
      tags:
      - Approvals
      summary: List approval requests
      description: List gated approval requests. USER sees their own; ADMIN and OWNER see their domain.
      operationId: listApprovals
      parameters:
      - $ref: '#/components/parameters/PageParam'
      - name: per_page
        in: query
        required: false
        description: Results per page
        schema:
          type: integer
          minimum: 1
          maximum: 100
          default: 20
      - name: status
        in: query
        required: false
        description: 'Filter by status: pending, approved, denied'
        schema:
          type: string
          enum:
          - pending
          - approved
          - denied
      responses:
        '200':
          description: A page of approval requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApprovalRequestPage'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '422':
          $ref: '#/components/responses/ValidationError'
      security:
      - bearerAuth: []
    servers:
    - url: https://dashboard.sealgate.ai
      description: SealGate management API - release
    - url: https://demo-dashboard.sealgate.ai
      description: SealGate management API - demo
  /api/v1/approvals/{approval_id}/approve:
    parameters:
    - name: approval_id
      in: path
      required: true
      description: Approval request ID
      schema:
        type: integer
    post:
      tags:
      - Approvals
      summary: Approve a gated action
      description: Approve a blocked trifecta or policy action. Requires the admin role.
      operationId: approveRequest
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApproveAction'
      responses:
        '200':
          description: The approved request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApprovalRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/ValidationError'
      security:
      - bearerAuth: []
    servers:
    - url: https://dashboard.sealgate.ai
      description: SealGate management API - release
    - url: https://demo-dashboard.sealgate.ai
      description: SealGate management API - demo
  /api/v1/approvals/{approval_id}/deny:
    parameters:
    - name: approval_id
      in: path
      required: true
      description: Approval request ID
      schema:
        type: integer
    post:
      tags:
      - Approvals
      summary: Deny a gated action
      description: Deny a blocked trifecta or policy action. Requires the admin role.
      operationId: denyRequest
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DenyAction'
      responses:
        '200':
          description: The denied request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApprovalRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/ValidationError'
      security:
      - bearerAuth: []
    servers:
    - url: https://dashboard.sealgate.ai
      description: SealGate management API - release
    - url: https://demo-dashboard.sealgate.ai
      description: SealGate management API - demo
  /api/v1/approvals/action:
    post:
      summary: Approve Or Deny Action
      description: 'Approve or deny a tool/resource/prompt for the current session.


        The v1 equivalent of POST /api/approve_or_deny. Either an authenticated

        caller (dashboard, desktop app - restricted to their own sessions) or a

        single-use action token authorises the request; one with neither is refused.

        Why the token path exists: see the ``action_router`` comment above.'
      operationId: approve_or_deny_action_api_v1_approvals_action_post
      security:
      - HTTPBearer: []
      parameters:
      - name: domain
        in: query
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Domain override (OWNER only)
          title: Domain
        description: Domain override (OWNER only)
      - name: Idempotency-Key
        in: header
        required: false
        description: Optional client-generated key that makes this write operation safe to retry. Reusing the same key returns the original response instead of performing the operation a second time. Keys are scoped to the caller and expire after 24 hours.
        schema:
          type: string
          maxLength: 255
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApproveOrDenyAction'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: string
                title: Response Approve Or Deny Action Api V1 Approvals Action Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError_2'
      tags:
      - Approvals
components:
  schemas:
    RiskInfo:
      type: object
      description: Plain-language risk explanation for a blocked action.
      properties:
        title:
          type: string
        headline:
          type: string
        summary:
          type: string
        legs:
          type:
          - object
          - 'null'
          additionalProperties:
            type: string
          description: Trifecta legs (private/untrusted/external) with their sources
        server_name:
          type: string
        acl_level:
          type: string
        risk_level:
          type:
          - string
          - 'null'
          description: 'Severity: low, medium, high, or critical'
        policy_rule:
          type:
          - string
          - 'null'
        source:
          type: string
          default: template
          description: 'How the summary was produced: template or llm'
    HTTPValidationError:
      type: object
      description: Body returned for a 422 request-validation failure.
      properties:
        detail:
          type: array
          items:
            $ref: '#/components/schemas/ValidationError'
    ApproveAction:
      type: object
      properties:
        note:
          type:
          - string
          - 'null'
          description: Optional note explaining the approval
    ErrorDetail:
      type: object
      description: Application error body carried under `detail`.
      properties:
        error:
          type: string
          description: Human-readable error message
        code:
          type: string
          description: Machine-readable error code
        details:
          type:
          - object
          - 'null'
          description: Additional error details
          additionalProperties: true
      required:
      - error
      - code
    ValidationError:
      type: object
      description: A single request-validation error.
      properties:
        loc:
          type: array
          items:
            type:
            - string
            - integer
          description: Location of the invalid field
        msg:
          type: string
          description: Validation error message
        type:
          type: string
          description: Validation error type
      required:
      - loc
      - msg
      - type
    DenyAction:
      type: object
      properties:
        note:
          type:
          - string
          - 'null'
          description: Optional note explaining the denial
    ApprovalRequestPage:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/ApprovalRequest'
        total:
          type: integer
        page:
          type: integer
        per_page:
          type: integer
        total_pages:
          type: integer
      required:
      - items
      - total
      - page
      - per_page
      - total_pages
    ErrorResponse:
      type: object
      description: Standard error envelope returned on 4xx and 5xx responses.
      properties:
        detail:
          $ref: '#/components/schemas/ErrorDetail'
      required:
      - detail
    ApprovalRequest:
      type: object
      description: A gated approval request derived from a blocked session action.
      properties:
        id:
          type: integer
          description: Approval request ID
        session_id:
          type: string
          description: Session that triggered the approval request
        tool_name:
          type: string
          description: Name of the tool requesting approval
        tool_params:
          type:
          - object
          - 'null'
          additionalProperties: true
          description: Parameters passed to the tool
        user_id:
          type: string
        user_email:
          type:
          - string
          - 'null'
        agent_name:
          type:
          - string
          - 'null'
        trifecta_flags:
          type: array
          items:
            type: string
        risk:
          oneOf:
          - $ref: '#/components/schemas/RiskInfo'
          - type: 'null'
        reason:
          type:
          - string
          - 'null'
          description: 'What held the call: ''trifecta''/''trifecta_prevent'' or ''policy_approval'''
        policy_rule:
          type:
          - string
          - 'null'
        status:
          type: string
          description: 'Approval status: pending, approved, denied'
        created_at:
          type: string
          format: date-time
      required:
      - id
      - session_id
      - tool_name
      - user_id
      - trifecta_flags
      - status
      - created_at
    RiskInfo_2:
      properties:
        title:
          type: string
          title: Title
          description: Short action description, e.g. 'Agent wants to send email'
          default: ''
        headline:
          type: string
          title: Headline
          description: One-line risk headline
          default: ''
        summary:
          type: string
          title: Summary
          description: Plain-language explanation of why this was risky
          default: ''
        legs:
          anyOf:
          - additionalProperties:
              type: string
            type: object
          - type: 'null'
          title: Legs
          description: Trifecta legs (private/untrusted/external) with their sources
        server_name:
          type: string
          title: Server Name
          description: Server the blocked element belongs to
          default: ''
        acl_level:
          type: string
          title: Acl Level
          description: Highest ACL level touched this session
          default: ''
        risk_level:
          anyOf:
          - type: string
          - type: 'null'
          title: Risk Level
          description: 'Severity: low, medium, high, or critical'
        policy_rule:
          anyOf:
          - type: string
          - type: 'null'
          title: Policy Rule
          description: Name of the policy rule that required approval (policy_approval blocks only)
        source:
          type: string
          title: Source
          description: 'How the summary was produced: template or llm'
          default: template
      type: object
      title: RiskInfo
      description: Plain-language risk explanation for a blocked action (matches the SSE risk block).
    ApproveAction_2:
      properties:
        note:
          anyOf:
          - type: string
          - type: 'null'
          title: Note
          description: Optional note explaining the approval
      type: object
      title: ApproveAction
    ValidationError_2:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
    ApproveOrDenyAction:
      properties:
        session_id:
          type: string
          title: Session Id
          description: Session to approve/deny
        kind:
          type: string
          title: Kind
          description: 'Kind of action: tool, resource, or prompt'
        name:
          type: string
          title: Name
          description: Name of the tool/resource/prompt
        command:
          type: string
          title: Command
          description: 'Command: approve, deny, or approve_and_remember'
        action_token:
          anyOf:
          - type: string
          - type: 'null'
          title: Action Token
          description: 'Single-use token minted by the notification dispatcher for one pending approval; it authorises exactly the (session_id, kind, name) it was minted for and is ignored when the caller is already authenticated. Why an unauthenticated caller may send it: the action_router comment in src/api/v1/routes/approvals.py.'
      type: object
      required:
      - session_id
      - kind
      - name
      - command
      title: ApproveOrDenyAction
    PaginatedResponse_ApprovalRequest_:
      properties:
        items:
          items:
            $ref: '#/components/schemas/ApprovalRequest_2'
          type: array
          title: Items
          description: Page of results
        total:
          type: integer
          title: Total
          description: Total number of items across all pages
        page:
          type: integer
          title: Page
          description: Current page number (1-indexed)
        per_page:
          type: integer
          title: Per Page
          description: Number of items per page
        total_pages:
          type: integer
          title: Total Pages
          description: Total number of pages
      type: object
      required:
      - items
      - total
      - page
      - per_page
      - total_pages
      title: PaginatedResponse[ApprovalRequest]
    DenyAction_2:
      properties:
        note:
          anyOf:
          - type: string
          - type: 'null'
          title: Note
          description: Optional note explaining the denial
      type: object
      title: DenyAction
    HTTPValidationError_2:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError_2'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ApprovalRequest_2:
      properties:
        id:
          type: integer
          title: Id
          description: Approval request ID
        session_id:
          type: string
          title: Session Id
          description: Session that triggered the approval request
        tool_name:
          type: string
          title: Tool Name
          description: Name of the tool requesting approval
        tool_params:
          anyOf:
          - additionalProperties: true
            type: object
          - type: 'null'
          title: Tool Params
          description: Parameters passed to the tool
        user_id:
          type: string
          title: User Id
          description: User who initiated the tool call
        user_email:
          anyOf:
          - type: string
          - type: 'null'
          title: User Email
          description: Email of the user who initiated the tool call
        agent_name:
          anyOf:
          - type: string
          - type: 'null'
          title: Agent Name
          description: Name of the agent that made the call
        trifecta_flags:
          items:
            type: string
          type: array
          title: Trifecta Flags
          description: Trifecta flags that triggered the block
        risk:
          anyOf:
          - $ref: '#/components/schemas/RiskInfo_2'
          - type: 'null'
          description: Persisted plain-language risk analysis for this block (the same explanation shown in the user's approval popup); null for older sessions without it
        reason:
          anyOf:
          - type: string
          - type: 'null'
          title: Reason
          description: 'What held the call: ''trifecta''/''trifecta_prevent'' for a lethal-trifecta gate, ''policy_approval'' for a policy rule''s require_approval action'
        policy_rule:
          anyOf:
          - type: string
          - type: 'null'
          title: Policy Rule
          description: Name of the policy rule that required approval, when applicable
        status:
          type: string
          title: Status
          description: 'Approval status: pending, approved, denied'
        created_at:
          type: string
          format: date-time
          title: Created At
          description: When the approval request was created
      type: object
      required:
      - id
      - session_id
      - tool_name
      - user_id
      - status
      - created_at
      title: ApprovalRequest
  responses:
    Forbidden:
      description: The caller's role is not permitted to perform this action
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    ValidationError:
      description: Request validation failed
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/HTTPValidationError'
    Unauthorized:
      description: Missing or invalid API key
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  parameters:
    PageParam:
      name: page
      in: query
      required: false
      description: Page number (1-indexed)
      schema:
        type: integer
        minimum: 1
        default: 1
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: SealGate API key
      description: 'SealGate API key sent as `Authorization: Bearer <your-sealgate-api-key>`.'
    HTTPBearer:
      type: http
      scheme: bearer
    ClientBearer:
      type: http
      description: Opaque ewc_ client installation credential
      scheme: bearer
    ServiceToken:
      type: http
      description: 'A SealGate service token: `sgt_acct_...` (account token) or `sgt_org_...` (org token). Mint an account token in the dashboard.'
      scheme: bearer
    MCPGatewayOAuth:
      type: oauth2
      description: OAuth 2.1 authorization-code flow (PKCE required) against the SealGate MCP gateway's authorization server. Request only the scopes an agent needs; unrequested scopes are not granted.
      flows:
        authorizationCode:
          authorizationUrl: /oauth/authorize
          tokenUrl: /oauth/token
          refreshUrl: /oauth/token
          scopes:
            mcp: Connect to the MCP gateway and call the tools exposed by your enabled servers. Every call is still evaluated by the policy engine.
            offline_access: Issue a refresh token so the client can renew access without a new browser sign-in.
externalDocs:
  description: SealGate product documentation
  url: https://docs.sealgate.ai
x-refined-from:
- sealgate-ai-openapi.json
- sealgate-ai-dashboard-openapi.json
- sealgate-ai-management-openapi.json