Skip to main content
POST
​
string
required
Approval request name (e.g., approval-payment-service-oom-kill-1773933600-plan-1)
​
string
Kubernetes namespace. When omitted, every namespace is searched (first match).
​
string
required
Name of the person approving, recorded next to the identity of the API key. An empty value returns 400.
​
string
Optional justification
The call records one decision on a Pending request, the same way the platform.chatcli.io/approve annotation does: it appends an entry to status.decisions with the approver, the reason and a timestamp. It never sets status.state itself. The ApprovalReconciler then evaluates the decisions against the rule: once the required approvals are in (one for manual, requiredApprovers distinct approvers for quorum) and the change window is open, the request becomes Approved and the RemediationPlan waiting on it moves to Executing. The response is returned right after the decision is recorded, so it usually still shows Pending, with the new entry in decisions and in approvedBy. The item is returned in spec and status alike, plus resourceMeta.
  • Approver identity. The approver is stored as <approver> (api-key: <identity>), where the identity is the name of the API key entry, else its description, else a key-<hash> fingerprint (dev-mode in dev mode). The typed name is trimmed, control characters are dropped, and it is cut at 128 characters.
  • Quorum counts API keys. Two approvals made with the same key count once, whatever names are typed, and the same key cannot decide twice on a request. A shared key, or dev mode, cannot satisfy requiredApprovers: 2: give each approver their own key.
  • 409 when the request is no longer Pending (already approved, rejected or expired), or when the same key already recorded a decision on it.
  • Change window. An approval recorded outside the rule’s window is kept; the request turns Approved when the window opens and does not expire while it waits. See Approval Workflow.

Authorizations

​
X-API-Key
string
header
required

API key sent in the X-API-Key header. Keys are read from the Secret chatcli-operator-secrets, key api-keys (fallback: ConfigMap chatcli-operator-config, key api-keys) in the operator namespace, as a YAML list of {key, role, name, description} (name is the identity recorded on approval decisions); the operator chart creates it only with apiKeys.create: true. Roles: viewer < operator < admin — any other role string is denied everywhere. Changes are picked up within about 30 seconds; deleting both the Secret and the ConfigMap revokes every key. With no keys configured every /api/ call returns 401, unless CHATCLI_OPERATOR_DEV_MODE=true, which grants admin without a key (development only).

Path Parameters

​
name
string
required

ApprovalRequest name.

Example:

"payment-oom-plan-1-approval"

Query Parameters

​
namespace
string

Namespace of the object. When omitted, all namespaces are searched and the first object with this name is used.

Body

application/json
​
approver
string
required

Name of the person deciding, recorded next to the identity of the API key. Required (400 when empty); control characters are dropped and it is cut at 128 characters.

Example:

"sre-oncall"

​
reason
string

Why.

Response

Decision recorded

​
apiVersion
string
Example:

"v1"

​
kind
string
Example:

"ApprovalRequest"

​
spec
object
​
status
object

The same approval object as spec.

​
resourceMeta
object