Skip to content
Trusty Sweep Developers

Authorize a plan (action + commercial authorization)

POST
/v1/plans/{id}/authorize
curl --request POST \
  --url https://api.trustysweep.com/v1/plans/example/authorize \
  --header 'Content-Type: application/json' \
  --cookie sweep_session=<sweep_session> \
  --data '{ "human_confirmed": false, "approval_token": "example" }'

Returns authorized, step_up_required (with an approval URL the delegating user must complete) or denied. Authorization binds to the plan hash.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string
/^pln_[0-9A-HJKMNP-TV-Z]{26}$/

Header Parameters

Section titled “Header Parameters”
Idempotency-Key
string
<= 255 characters

Unique key per logical operation. Same key + same body within 24h replays the original response with Idempotent-Replayed: true; same key + different body → 409 idempotency_key_reused.

Request Body

Section titled “Request Body”
Media typeapplication/json
object
human_confirmed

Set by the consumer UI after an explicit confirmation step.

boolean
approval_token

Token returned after a step-up approval completes.

string

Responses

Section titled “Responses”

200

Section titled “200”

OK

Media typeapplication/json
object
plan_id
required

Prefixed ULID (pln_…)

string
/^pln_[0-9A-HJKMNP-TV-Z]{26}$/
status
required
string
Allowed values: authorized step_up_required denied
plan_hash
required
string
policy
required
object
policyVersion
required
string
decision
required
string
Allowed values: allow deny step_up_required
reasons
required
Array<string>
requiredApprovals
Array<string>
Allowed values: human_user developer_owner ceiling_increase scope_step_up
decisionId
string
commercial
One of:
object
authorized
required
boolean
authorization_id
One of:
string
reason
string
approval_url
One of:
string format: uri
approval_expires_at
One of:
string format: date-time
Example
{
  "plan_id": "pln_01J8Z3K9M2Q4R6S8T0V2W4X6Y8",
  "status": "authorized",
  "policy": {
    "decision": "allow",
    "requiredApprovals": [
      "human_user"
    ]
  }
}

Headers

Section titled “Headers”
RateLimit-Limit
integer

Requests allowed in the current window.

RateLimit-Remaining
integer

Requests remaining in the current window.

RateLimit-Reset
integer

Seconds until the window resets.

400

Section titled “400”

Validation failed

Media typeapplication/problem+json

RFC 9457 problem details.

object
type
required

Https://developers.trustysweep.com/errors/

string format: uri
title
required
string
status
required
integer
detail
string
code
required

Machine-readable error code from errors.json

string
request_id
required
string
errors
Array<object>
object
path
required
string
message
required
string
Examplegenerated
{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "code": "example",
  "request_id": "example",
  "errors": [
    {
      "path": "example",
      "message": "example"
    }
  ]
}

401

Section titled “401”

Unauthenticated

Media typeapplication/problem+json

RFC 9457 problem details.

object
type
required

Https://developers.trustysweep.com/errors/

string format: uri
title
required
string
status
required
integer
detail
string
code
required

Machine-readable error code from errors.json

string
request_id
required
string
errors
Array<object>
object
path
required
string
message
required
string
Examplegenerated
{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "code": "example",
  "request_id": "example",
  "errors": [
    {
      "path": "example",
      "message": "example"
    }
  ]
}

403

Section titled “403”

Forbidden / action denied / step-up required

Media typeapplication/problem+json

RFC 9457 problem details.

object
type
required

Https://developers.trustysweep.com/errors/

string format: uri
title
required
string
status
required
integer
detail
string
code
required

Machine-readable error code from errors.json

string
request_id
required
string
errors
Array<object>
object
path
required
string
message
required
string
Examplegenerated
{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "code": "example",
  "request_id": "example",
  "errors": [
    {
      "path": "example",
      "message": "example"
    }
  ]
}

404

Section titled “404”

Not found

Media typeapplication/problem+json

RFC 9457 problem details.

object
type
required

Https://developers.trustysweep.com/errors/

string format: uri
title
required
string
status
required
integer
detail
string
code
required

Machine-readable error code from errors.json

string
request_id
required
string
errors
Array<object>
object
path
required
string
message
required
string
Examplegenerated
{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "code": "example",
  "request_id": "example",
  "errors": [
    {
      "path": "example",
      "message": "example"
    }
  ]
}

409

Section titled “409”

Conflict (state, stale plan, idempotency key reuse)

Media typeapplication/problem+json

RFC 9457 problem details.

object
type
required

Https://developers.trustysweep.com/errors/

string format: uri
title
required
string
status
required
integer
detail
string
code
required

Machine-readable error code from errors.json

string
request_id
required
string
errors
Array<object>
object
path
required
string
message
required
string
Examplegenerated
{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "code": "example",
  "request_id": "example",
  "errors": [
    {
      "path": "example",
      "message": "example"
    }
  ]
}

429

Section titled “429”

Rate limited

Media typeapplication/problem+json

RFC 9457 problem details.

object
type
required

Https://developers.trustysweep.com/errors/

string format: uri
title
required
string
status
required
integer
detail
string
code
required

Machine-readable error code from errors.json

string
request_id
required
string
errors
Array<object>
object
path
required
string
message
required
string
Examplegenerated
{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "code": "example",
  "request_id": "example",
  "errors": [
    {
      "path": "example",
      "message": "example"
    }
  ]
}

Headers

Section titled “Headers”
Retry-After
integer

Seconds to wait before retrying.

RateLimit-Limit
integer

Requests allowed in the current window.

RateLimit-Remaining
integer

Requests remaining in the current window.

RateLimit-Reset
integer

Seconds until the window resets.

500

Section titled “500”

Internal error

Media typeapplication/problem+json

RFC 9457 problem details.

object
type
required

Https://developers.trustysweep.com/errors/

string format: uri
title
required
string
status
required
integer
detail
string
code
required

Machine-readable error code from errors.json

string
request_id
required
string
errors
Array<object>
object
path
required
string
message
required
string
Examplegenerated
{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "code": "example",
  "request_id": "example",
  "errors": [
    {
      "path": "example",
      "message": "example"
    }
  ]
}