Organisations

Reject a request

A new diagram is deleted (refused under a legal hold), a new version is dropped, or no link is made.

POST/orgs/{org}/approvals/{id}/reject

TL;DR

Question	Answer
What does it do?	Reject a request.
What does it take?	A JSON body of type `DecideApprovalBody`.
What does it return?	Status 200 with a body of type `ApprovalRequest`.
What can go wrong?	`400` the body is not valid; `401` not signed in; `403` the caller does not approve, or asked for it themselves (orgs.forbidden); a share the plan has no room for (hosting.quota_exceeded); or the request came from an origin that may not make changes; `404` no such organisation or pending request, or the request is about a diagram in a folder the caller may not use; `409` another approver decided it a moment ago, or the organisation is on legal hold (orgs.legal_hold); `429` too many requests; `503` organisations are not set up on this server. Every failure uses the one error envelope.

What it does

A new diagram is deleted (refused under a legal hold), a new version is dropped, or no link is made. An optional comment is emailed to the publisher. Another approver than the one who asked.

Path parameters

Field	Type	Required	Description
`org`	`string`	yes	The organisation's id or its slug.
`id`	`string`	yes

Request body

The body has the type DecideApprovalBody.

Field	Type	Required	Description
`comment`	`string \| null`	no	An optional comment for the publisher, at most 500 characters. It is emailed to them and kept in the organisation's audit log. at least 1 character; at most 500 characters.

Responses

Status	Meaning	Body
200	The request as decided.	`ApprovalRequest`
400	The body is not valid.	`ErrorResponse`
401	Not signed in.	`ErrorResponse`
403	The caller does not approve, or asked for it themselves (orgs.forbidden); a share the plan has no room for (hosting.quota_exceeded); or the request came from an origin that may not make changes.	`ErrorResponse`
404	No such organisation or pending request, or the request is about a diagram in a folder the caller may not use.	`ErrorResponse`
409	Another approver decided it a moment ago, or the organisation is on legal hold (orgs.legal_hold).	`ErrorResponse`
429	Too many requests.	`ErrorResponse`
503	Organisations are not set up on this server.	`ErrorResponse`

Response body

A 200 answer has the type ApprovalRequest.

Field	Type	Required	Description
`id`	`string`	yes
`kind`	`"publish" \| "change" \| "share"`	yes
`status`	`"pending" \| "approved" \| "rejected" \| "expired"`	yes
`diagram`	`object \| null`	yes	The diagram as the library has it now, or null once it is gone (a rejected new diagram).
`diagram.id`	`string`	yes
`diagram.name`	`string \| null`	yes
`diagram.folder`	`string \| null`	yes
`diagram.classification`	`Classification`	yes	A diagram's classification label: `public`, `internal` (the default, and what a diagram published before labels reads as) or `confidential`. Confidential is never shared publicly; under "Share only diagrams labelled Public" only public is.
`diagram.theme`	`"light" \| "dark" \| "auto"`	yes
`requestedBy`	`object \| null`	yes	Who asked, or null for an organisation key and once the account is gone.
`requestedBy.userId`	`string`	yes
`requestedBy.email`	`string`	yes
`requestedAt`	`integer`	yes
`expiresAt`	`integer`	yes
`secretFindings`	`integer`	yes	How many things that look like a secret the scan found when the request was made, under the organisation's scanning options. minimum 0.
`reviewedBy`	`object \| null`	yes
`reviewedBy.userId`	`string`	yes
`reviewedBy.email`	`string`	yes
`reviewedAt`	`integer \| null`	yes
`comment`	`string \| null`	yes	The approver's comment, when they gave one.

Doc	Why
API reference	Every endpoint, and the error envelope
Schemas	Every request and response type
Tool reference	The operations as callable tools