Skip to main content

Approvals

The Approval domain provides a configurable workflow for controlling access to APIs and events. When a team subscribes to an API or event that requires approval, an approval request is created and must be granted before access is provisioned.

Approval Strategies​

When exposing an API or event, the provider chooses one of three approval strategies:

StrategyBehavior
AutoThe subscription is approved immediately without human intervention.
SimpleA single approver from the provider team must grant the request.
FourEyesTwo separate approvers from the provider team must grant the request (dual-control principle).

The strategy is set in the Rover file when defining an API or event exposure:

exposures:
  - type: api
    visibility: ENTERPRISE
    basePath: /checkout/v1
    upstream: https://checkout.internal:8080
    approval: SIMPLE

Approval States​

Each approval moves through a state machine:

StateMeaning
PendingThe request has been created and is waiting for review.
SemiGrantedOne of the two required approvals has been granted (FourEyes only).
GrantedThe request has been fully approved. Access is provisioned.
RejectedThe request has been denied.
SuspendedA previously granted approval has been temporarily suspended.
ExpiredThe approval has expired and is no longer valid.

Requested and Active Scopes​

API, event, and agentic subscriptions distinguish the scopes you request from the scopes already provisioned:

  • Requested scopes reflect your latest subscription configuration.
  • Active scopes reflect the last approved set the subscription controller successfully wrote to the downstream resources. Gateway or event-delivery readiness is reported separately.

For example, if read is active and you request read plus write, active scopes remain read while the change awaits approval. Rejecting that change keeps the previous access. After approval and successful provisioning, active scopes become read and write. Suspending or rejecting the Approval itself causes access resources to be removed and active scopes to be cleared.

The ControlPlane GraphQL API exposes requestedScopes and activeScopes on all three subscription types. In Kubernetes, active scopes are available in status.activeScopes; requested scopes remain in the subscription spec.

Trusted Teams​

API and event providers can designate certain teams as trusted. Subscriptions from trusted teams are approved automatically, regardless of the configured strategy. This is useful for internal services or well-known partners that do not need manual review.

Notifications​

The Approval domain integrates with the Notification domain to keep both parties informed throughout the process:

  • Requester team — Notified when their request is granted, rejected, or suspended
  • Provider team — Notified when a new approval request is created or when an existing approval changes state

Next Steps​