Akter

Approvals

A person's approval of one dangerous operation by an API key (ADR 0023). The key asks, Akter emails a code to the person who created the key, and the code the person hands back buys a single-use approval token.

Request⁠

POSThttps://api.akter.dev/v1/organizations/{organization}/approvals
approvals.requestBearer token

Ask the key's creator to approve one operation on one target. They get a 6-digit code by email that works for 15 minutes. Asking is limited per client address.

Path parameters

  • organizationstringrequired

    An organization's name, unique across Akter Cloud. 1 to 63 characters: a lowercase letter, then lowercase letters, digits or single hyphens, ending in a letter or digit.

Request bodyRequestApproval

  • operation"account.delete" | "actors.erase" | "apiKeys.revoke" | "apiKeys.update" | "apps.delete" | "billing.cancel" | "billing.setCap" | "domains.delete" | "environments.delete" | "environments.promote" | "members.remove" | "organizations.delete" | "secrets.delete" | "snapshots.delete"required

    An operation an API key may run only with a person's approval, named as group.operation like the CLI command and MCP tool.

  • targetstringrequired

    What the operation acts on: its path's values after the organization, joined with /, such as the app's name for apps.delete or shop/prod/DB_URL for secrets.delete; the organization's name for organizations.delete; account for account.delete.

Response 202ApprovalRequested

  • expiresAtstringrequired
  • idstringrequired

    An opaque id that starts with apr_.

  • operation"account.delete" | "actors.erase" | "apiKeys.revoke" | "apiKeys.update" | "apps.delete" | "billing.cancel" | "billing.setCap" | "domains.delete" | "environments.delete" | "environments.promote" | "members.remove" | "organizations.delete" | "secrets.delete" | "snapshots.delete"required

    An operation an API key may run only with a person's approval, named as group.operation like the CLI command and MCP tool.

  • sentTostringrequired

    The person asked to approve: the key's creator.

  • targetstringrequired

    What the operation acts on: its path's values after the organization, joined with /, such as the app's name for apps.delete or shop/prod/DB_URL for secrets.delete; the organization's name for organizations.delete; account for account.delete.

Errors

  • 401UnauthorizedError
  • 403ForbiddenError
  • 404NotFoundError | FeatureNotEnabledError
  • 429RateLimitedError
  • 503ActorUnavailableError | AuthUnavailableError | BillingUnavailableError | BuildStorageUnavailableError | ExecUnavailableError

Confirm⁠

POSThttps://api.akter.dev/v1/organizations/{organization}/approvals/{request}/tokens
approvals.confirmBearer token

Turn the emailed approval code into the approval token, as the key that asked. Three wrong codes end the approval.

Path parameters

  • organizationstringrequired

    An organization's name, unique across Akter Cloud. 1 to 63 characters: a lowercase letter, then lowercase letters, digits or single hyphens, ending in a letter or digit.

  • requeststringrequired

    An opaque id that starts with apr_.

Request bodyConfirmApproval

  • codestringrequired

    The 6-digit code from the approval email.

Response 201ApprovalToken

  • expiresAtstringrequired
  • tokenstringrequired

    Send it once as the akter-approval header of the approved operation on the approved target. It works once and only for the key that asked.

Errors

  • 401CodeRejectedError | UnauthorizedError
  • 403ForbiddenError
  • 404NotFoundError | FeatureNotEnabledError
  • 503ActorUnavailableError | AuthUnavailableError | BillingUnavailableError | BuildStorageUnavailableError | ExecUnavailableError