> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corgea.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Approve a triage request

> Everyone sees their own requests. Reviewers with the Can approve or reject triage requests permission (`heeler.approve_triage_request`) also see other requests, subject to access to every project when project access control applies. Requests outside this view return 404. The reviewer must differ from the requester and have the Can approve or reject triage requests permission, status-change permissions for every finding type, and access to every project in the request. An optional comment (up to 10,000 characters) is sent to the requester. Approval applies the decision even after intervening triage changes, skipping findings fixed or deleted since submission. On 409, fetch the request again before retrying.



## OpenAPI

````yaml /api-reference/openapi.json post /triage/approvals/{action_id}/approve
openapi: 3.0.0
info:
  title: Corgea API
  version: 1.0.0
  description: >-
    API for interacting with Corgea's scanning and vulnerability management
    features
servers:
  - url: https://www.corgea.app/api/v1
    description: Production server
  - url: https://eu.corgea.app/api/v1
    description: EU production server
security:
  - CorgeaToken: []
  - BearerAuth: []
paths:
  /triage/approvals/{action_id}/approve:
    post:
      tags:
        - Triage
      summary: Approve a triage request
      description: >-
        Everyone sees their own requests. Reviewers with the Can approve or
        reject triage requests permission (`heeler.approve_triage_request`) also
        see other requests, subject to access to every project when project
        access control applies. Requests outside this view return 404. The
        reviewer must differ from the requester and have the Can approve or
        reject triage requests permission, status-change permissions for every
        finding type, and access to every project in the request. An optional
        comment (up to 10,000 characters) is sent to the requester. Approval
        applies the decision even after intervening triage changes, skipping
        findings fixed or deleted since submission. On 409, fetch the request
        again before retrying.
      operationId: approveTriageApproval
      parameters:
        - name: action_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              additionalProperties: false
              properties:
                comment:
                  type: string
                  maxLength: 10000
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: string
                    enum:
                      - ok
                  approval:
                    $ref: '#/components/schemas/TriageApproval'
        '400':
          description: Invalid request
        '401':
          description: Missing or invalid token
        '403':
          description: Insufficient permissions or plan access
        '404':
          description: Request not found or outside your access
        '405':
          description: Unsupported HTTP method
        '409':
          description: Request no longer pending or currently being reviewed
components:
  schemas:
    TriageApproval:
      type: object
      properties:
        id:
          type: string
          format: uuid
        status:
          type: string
        source:
          type: string
        target_status:
          type: string
        justification:
          type: string
        accepted_risk_expiry_date:
          type: string
          format: date-time
          nullable: true
        rule:
          type: object
        source_metadata:
          type: object
        requires_approval:
          type: boolean
        requested_by:
          type: integer
          nullable: true
        approved_by:
          type: integer
          nullable: true
        rejected_by:
          type: integer
          nullable: true
        created_at:
          type: string
          format: date-time
        reviewed_at:
          type: string
          format: date-time
          nullable: true
        applied_at:
          type: string
          format: date-time
          nullable: true
        counts:
          type: object
          properties:
            matched:
              type: integer
            unmatched:
              type: integer
            ambiguous:
              type: integer
            applied:
              type: integer
            conflicts:
              type: integer
        decision_label:
          type: string
        requester:
          type: object
          properties:
            id:
              type: integer
              nullable: true
            name:
              type: string
              nullable: true
        review_comment:
          type: string
          nullable: true
        finding_total:
          type: integer
        finding_previews:
          type: array
          maxItems: 3
          items:
            type: object
            properties:
              kind:
                type: string
                enum:
                  - sast
                  - sca
              id:
                type: string
              title:
                type: string
              severity:
                type: string
              location:
                type: string
        project_names:
          type: array
          items:
            type: string
        skip_count:
          type: integer
        closed_by_rescan:
          type: boolean
        can_review:
          type: boolean
        is_requester:
          type: boolean
        suggestion:
          type: object
          nullable: true
        investigation:
          type: object
          nullable: true
  securitySchemes:
    CorgeaToken:
      type: apiKey
      in: header
      name: CORGEA-TOKEN
      description: >-
        API key for authentication API tokens belonging to inactive users are
        rejected.
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth2 access token (JWT) in the Authorization header

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.