Approve an approver change

POST

approval-issuers

changes

{id}

approve

Approve an approver change

curl --request POST \
  --url https://parmana-api-real.vercel.app/approval-issuers/changes/{id}/approve \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "stepUpAuthorization": {
    "payload": {
      "version": 1,
      "nonce": "0b6081da-cd57-4519-ae36-71eb1bb62432",
      "pendingPolicyChangeId": "ba7c5827-5844-4069-94fc-9b438ef08f78",
      "action": "approve",
      "authorizedAt": "2026-09-28T19:05:59.733Z",
      "expiresAt": "2026-09-28T19:07:59.733Z"
    },
    "signature": "Nv94Q62/g4IQ0zFxDqF621Stz+JBy/4KOvLJ9+RfJO8xMw6hw06X4gzdDNEh2DxJt9xmL7VTF9TxDd9s9qmkCg==",
    "keyId": "human-checker-step-up-key",
    "algorithm": "ed25519"
  }
}
'

import requests

url = "https://parmana-api-real.vercel.app/approval-issuers/changes/{id}/approve"

payload = { "stepUpAuthorization": {
        "payload": {
            "version": 1,
            "nonce": "0b6081da-cd57-4519-ae36-71eb1bb62432",
            "pendingPolicyChangeId": "ba7c5827-5844-4069-94fc-9b438ef08f78",
            "action": "approve",
            "authorizedAt": "2026-09-28T19:05:59.733Z",
            "expiresAt": "2026-09-28T19:07:59.733Z"
        },
        "signature": "Nv94Q62/g4IQ0zFxDqF621Stz+JBy/4KOvLJ9+RfJO8xMw6hw06X4gzdDNEh2DxJt9xmL7VTF9TxDd9s9qmkCg==",
        "keyId": "human-checker-step-up-key",
        "algorithm": "ed25519"
    } }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    stepUpAuthorization: {
      payload: {
        version: 1,
        nonce: '0b6081da-cd57-4519-ae36-71eb1bb62432',
        pendingPolicyChangeId: 'ba7c5827-5844-4069-94fc-9b438ef08f78',
        action: 'approve',
        authorizedAt: '2026-09-28T19:05:59.733Z',
        expiresAt: '2026-09-28T19:07:59.733Z'
      },
      signature: 'Nv94Q62/g4IQ0zFxDqF621Stz+JBy/4KOvLJ9+RfJO8xMw6hw06X4gzdDNEh2DxJt9xmL7VTF9TxDd9s9qmkCg==',
      keyId: 'human-checker-step-up-key',
      algorithm: 'ed25519'
    }
  })
};

fetch('https://parmana-api-real.vercel.app/approval-issuers/changes/{id}/approve', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://parmana-api-real.vercel.app/approval-issuers/changes/{id}/approve",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'stepUpAuthorization' => [
        'payload' => [
                'version' => 1,
                'nonce' => '0b6081da-cd57-4519-ae36-71eb1bb62432',
                'pendingPolicyChangeId' => 'ba7c5827-5844-4069-94fc-9b438ef08f78',
                'action' => 'approve',
                'authorizedAt' => '2026-09-28T19:05:59.733Z',
                'expiresAt' => '2026-09-28T19:07:59.733Z'
        ],
        'signature' => 'Nv94Q62/g4IQ0zFxDqF621Stz+JBy/4KOvLJ9+RfJO8xMw6hw06X4gzdDNEh2DxJt9xmL7VTF9TxDd9s9qmkCg==',
        'keyId' => 'human-checker-step-up-key',
        'algorithm' => 'ed25519'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://parmana-api-real.vercel.app/approval-issuers/changes/{id}/approve"

	payload := strings.NewReader("{\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"0b6081da-cd57-4519-ae36-71eb1bb62432\",\n      \"pendingPolicyChangeId\": \"ba7c5827-5844-4069-94fc-9b438ef08f78\",\n      \"action\": \"approve\",\n      \"authorizedAt\": \"2026-09-28T19:05:59.733Z\",\n      \"expiresAt\": \"2026-09-28T19:07:59.733Z\"\n    },\n    \"signature\": \"Nv94Q62/g4IQ0zFxDqF621Stz+JBy/4KOvLJ9+RfJO8xMw6hw06X4gzdDNEh2DxJt9xmL7VTF9TxDd9s9qmkCg==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://parmana-api-real.vercel.app/approval-issuers/changes/{id}/approve")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"0b6081da-cd57-4519-ae36-71eb1bb62432\",\n      \"pendingPolicyChangeId\": \"ba7c5827-5844-4069-94fc-9b438ef08f78\",\n      \"action\": \"approve\",\n      \"authorizedAt\": \"2026-09-28T19:05:59.733Z\",\n      \"expiresAt\": \"2026-09-28T19:07:59.733Z\"\n    },\n    \"signature\": \"Nv94Q62/g4IQ0zFxDqF621Stz+JBy/4KOvLJ9+RfJO8xMw6hw06X4gzdDNEh2DxJt9xmL7VTF9TxDd9s9qmkCg==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://parmana-api-real.vercel.app/approval-issuers/changes/{id}/approve")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"0b6081da-cd57-4519-ae36-71eb1bb62432\",\n      \"pendingPolicyChangeId\": \"ba7c5827-5844-4069-94fc-9b438ef08f78\",\n      \"action\": \"approve\",\n      \"authorizedAt\": \"2026-09-28T19:05:59.733Z\",\n      \"expiresAt\": \"2026-09-28T19:07:59.733Z\"\n    },\n    \"signature\": \"Nv94Q62/g4IQ0zFxDqF621Stz+JBy/4KOvLJ9+RfJO8xMw6hw06X4gzdDNEh2DxJt9xmL7VTF9TxDd9s9qmkCg==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "changeId": "ba7c5827-5844-4069-94fc-9b438ef08f78",
  "action": "add",
  "approverId": "manager-priya",
  "keyId": "manager-priya-key-1",
  "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAEDuWHf+bbRY7J/Mr0RVmAKYHH5CDijTWhdnISXWLD6Y=\n-----END PUBLIC KEY-----\n",
  "reason": "Priya approves refunds for the West region from October.",
  "proposedBy": "human-maker",
  "proposedAt": "2026-09-28T19:05:59.726Z",
  "status": "APPROVED",
  "resolvedBy": "human-checker",
  "resolvedAt": "2026-09-28T19:05:59.738Z"
}

Authorizations

Authorization

string

header

required

Caller API key issued by scripts/generate-api-key.ts. Sent as Authorization: Bearer . Verified against a stored SHA-256 hash in constant time by packages/api/src/auth/StaticKeyAuthenticator.ts. Required on every route not listed as exempt in this document's top-level description. See /api-reference/authentication.

Path Parameters

string

required

The changeId.

Body

application/json

Request body for POST /policies/pending-changes/{id}/approve.

stepUpAuthorization

Policy Change Step-Up Authorization · object

required

Signed envelope proving a checker's explicit, fresh intent to approve or reject one specific Pending Policy Change (Policy Governance, Layer 4). Produced by PolicyChangeStepUpAuthorizationSigner (@parmana/crypto) using the checker's own step-up private key, never the bearer API key. Verified server-side against: the checker's registered stepUpPublicKey, payload.pendingPolicyChangeId matching the URL's {id}, payload.action matching the endpoint (approve vs reject), payload.expiresAt not yet passed, and payload.nonce not previously seen (single-use, replay-rejected on a second attempt with the same envelope).

Show child attributes

Example:

{
  "payload": {
    "version": 1,
    "nonce": "343ee454-92c6-4ef9-9cfe-e98329e51f53",
    "pendingPolicyChangeId": "6f4e4020-adf5-4449-938d-27aab58f66b7",
    "action": "approve",
    "authorizedAt": "2026-09-15T03:47:51.939Z",
    "expiresAt": "2026-09-15T03:49:51.939Z"
  },
  "signature": "keOXnzUk8KcGrQTkpXC4Ki8ps3GTvMANwqq96b+toxba07gjkcmpyL/vaPZ7+pPZ1HAOJOOy3rj5XfhcwOTnAw==",
  "keyId": "human-checker-step-up-key",
  "algorithm": "ed25519"
}

Response

Approved and applied.

A proposal to add an approver key, or to revoke one added this way, and its resolution. One person proposes it; a different person approves or rejects it with a step up authorization. Only an approved change affects which approvals verify.

changeId

string

required

Unique id of the change, a UUID. The step up authorization for approve or reject names it in payload.pendingPolicyChangeId.

action

enum<string>

required

add trusts a new key; revoke stops trusting a key added this way, and every approval it ever signed.

Available options:

add,

revoke

approverId

string

required

The approver, as named in the payload.issuer.approverId of the approvals they sign.

Pattern: ^[A-Za-z0-9._-]{1,128}$

keyId

string

required

The approver's key, as named in payload.issuer.keyId. A key id is used once: a revoked key id cannot be added again.

Pattern: ^[A-Za-z0-9._-]{1,128}$

reason

string

required

Why, from the proposer.

Maximum string length: 2000

proposedBy

string

required

The proposer's caller id. Always a human credential.

proposedAt

string<date-time>

required

status

enum<string>

required

PENDING_APPROVAL until a second person approves or rejects it; then APPROVED or REJECTED, once.

Available options:

PENDING_APPROVAL,

APPROVED,

REJECTED

publicKeyPem

string

The approver's Ed25519 public key, PEM (SPKI), as the server stored it. Present on add, absent on revoke.

resolvedBy

string

Who approved or rejected it. Never the proposer.

resolvedAt

string<date-time>

rejectionReason

string

Present when REJECTED.

Approve an approver change

curl --request POST \
  --url https://parmana-api-real.vercel.app/approval-issuers/changes/{id}/approve \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "stepUpAuthorization": {
    "payload": {
      "version": 1,
      "nonce": "0b6081da-cd57-4519-ae36-71eb1bb62432",
      "pendingPolicyChangeId": "ba7c5827-5844-4069-94fc-9b438ef08f78",
      "action": "approve",
      "authorizedAt": "2026-09-28T19:05:59.733Z",
      "expiresAt": "2026-09-28T19:07:59.733Z"
    },
    "signature": "Nv94Q62/g4IQ0zFxDqF621Stz+JBy/4KOvLJ9+RfJO8xMw6hw06X4gzdDNEh2DxJt9xmL7VTF9TxDd9s9qmkCg==",
    "keyId": "human-checker-step-up-key",
    "algorithm": "ed25519"
  }
}
'

import requests

url = "https://parmana-api-real.vercel.app/approval-issuers/changes/{id}/approve"

payload = { "stepUpAuthorization": {
        "payload": {
            "version": 1,
            "nonce": "0b6081da-cd57-4519-ae36-71eb1bb62432",
            "pendingPolicyChangeId": "ba7c5827-5844-4069-94fc-9b438ef08f78",
            "action": "approve",
            "authorizedAt": "2026-09-28T19:05:59.733Z",
            "expiresAt": "2026-09-28T19:07:59.733Z"
        },
        "signature": "Nv94Q62/g4IQ0zFxDqF621Stz+JBy/4KOvLJ9+RfJO8xMw6hw06X4gzdDNEh2DxJt9xmL7VTF9TxDd9s9qmkCg==",
        "keyId": "human-checker-step-up-key",
        "algorithm": "ed25519"
    } }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    stepUpAuthorization: {
      payload: {
        version: 1,
        nonce: '0b6081da-cd57-4519-ae36-71eb1bb62432',
        pendingPolicyChangeId: 'ba7c5827-5844-4069-94fc-9b438ef08f78',
        action: 'approve',
        authorizedAt: '2026-09-28T19:05:59.733Z',
        expiresAt: '2026-09-28T19:07:59.733Z'
      },
      signature: 'Nv94Q62/g4IQ0zFxDqF621Stz+JBy/4KOvLJ9+RfJO8xMw6hw06X4gzdDNEh2DxJt9xmL7VTF9TxDd9s9qmkCg==',
      keyId: 'human-checker-step-up-key',
      algorithm: 'ed25519'
    }
  })
};

fetch('https://parmana-api-real.vercel.app/approval-issuers/changes/{id}/approve', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://parmana-api-real.vercel.app/approval-issuers/changes/{id}/approve",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'stepUpAuthorization' => [
        'payload' => [
                'version' => 1,
                'nonce' => '0b6081da-cd57-4519-ae36-71eb1bb62432',
                'pendingPolicyChangeId' => 'ba7c5827-5844-4069-94fc-9b438ef08f78',
                'action' => 'approve',
                'authorizedAt' => '2026-09-28T19:05:59.733Z',
                'expiresAt' => '2026-09-28T19:07:59.733Z'
        ],
        'signature' => 'Nv94Q62/g4IQ0zFxDqF621Stz+JBy/4KOvLJ9+RfJO8xMw6hw06X4gzdDNEh2DxJt9xmL7VTF9TxDd9s9qmkCg==',
        'keyId' => 'human-checker-step-up-key',
        'algorithm' => 'ed25519'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://parmana-api-real.vercel.app/approval-issuers/changes/{id}/approve"

	payload := strings.NewReader("{\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"0b6081da-cd57-4519-ae36-71eb1bb62432\",\n      \"pendingPolicyChangeId\": \"ba7c5827-5844-4069-94fc-9b438ef08f78\",\n      \"action\": \"approve\",\n      \"authorizedAt\": \"2026-09-28T19:05:59.733Z\",\n      \"expiresAt\": \"2026-09-28T19:07:59.733Z\"\n    },\n    \"signature\": \"Nv94Q62/g4IQ0zFxDqF621Stz+JBy/4KOvLJ9+RfJO8xMw6hw06X4gzdDNEh2DxJt9xmL7VTF9TxDd9s9qmkCg==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://parmana-api-real.vercel.app/approval-issuers/changes/{id}/approve")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"0b6081da-cd57-4519-ae36-71eb1bb62432\",\n      \"pendingPolicyChangeId\": \"ba7c5827-5844-4069-94fc-9b438ef08f78\",\n      \"action\": \"approve\",\n      \"authorizedAt\": \"2026-09-28T19:05:59.733Z\",\n      \"expiresAt\": \"2026-09-28T19:07:59.733Z\"\n    },\n    \"signature\": \"Nv94Q62/g4IQ0zFxDqF621Stz+JBy/4KOvLJ9+RfJO8xMw6hw06X4gzdDNEh2DxJt9xmL7VTF9TxDd9s9qmkCg==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://parmana-api-real.vercel.app/approval-issuers/changes/{id}/approve")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"0b6081da-cd57-4519-ae36-71eb1bb62432\",\n      \"pendingPolicyChangeId\": \"ba7c5827-5844-4069-94fc-9b438ef08f78\",\n      \"action\": \"approve\",\n      \"authorizedAt\": \"2026-09-28T19:05:59.733Z\",\n      \"expiresAt\": \"2026-09-28T19:07:59.733Z\"\n    },\n    \"signature\": \"Nv94Q62/g4IQ0zFxDqF621Stz+JBy/4KOvLJ9+RfJO8xMw6hw06X4gzdDNEh2DxJt9xmL7VTF9TxDd9s9qmkCg==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "changeId": "ba7c5827-5844-4069-94fc-9b438ef08f78",
  "action": "add",
  "approverId": "manager-priya",
  "keyId": "manager-priya-key-1",
  "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAEDuWHf+bbRY7J/Mr0RVmAKYHH5CDijTWhdnISXWLD6Y=\n-----END PUBLIC KEY-----\n",
  "reason": "Priya approves refunds for the West region from October.",
  "proposedBy": "human-maker",
  "proposedAt": "2026-09-28T19:05:59.726Z",
  "status": "APPROVED",
  "resolvedBy": "human-checker",
  "resolvedAt": "2026-09-28T19:05:59.738Z"
}

REST API guide

Execution

Transactions

Verification

Receipts

Trust Records

Replay

Policies

Policy Governance

Approvers

Refusal Records

Execution Intents

Audit

System

Handbook

Approve an approver change

Authorizations

Path Parameters

Body

Response