Depot approvals msp

Registers the MSP’s approval and request routes.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET /api/v1/clients/{clientID}/approvals

GETmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

listApprovals lists a client’s approvals, newest first; status and source filter as on the portal, sourceRef narrows to one record (a ticket page’s own approvals).

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
page	query	integer	No	One-based page number. Defaults to 1.
pageSize	query	integer	No	Rows per page, 1 to 200. Defaults to 50.
source	query	string	No
sourceRef	query	string	No
status	query	string	No

Responses

Status	Body	Description
200	application/json, PagedResultApprovalView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
itemsrequired	array of ApprovalView
items[].amountCents	integer or null	int64.
items[].awaitingrequired	array of ApprovalAwaitingView
items[].awaiting[].memberIdrequired	string
items[].awaiting[].namerequired	string
items[].bodyrequired	string
items[].canDeciderequired	boolean
items[].canRespondrequired	boolean
items[].consentTextrequired	string
items[].consentVersionrequired	integer
items[].currency	string or null
items[].dueAt	string (date-time) or null
items[].idrequired	string
items[].kindrequired	string
items[].projectId	string or null
items[].quorumrequired	string
items[].raisedAtrequired	string (date-time)
items[].raisedByrequired	ApprovalActorView	ApprovalActorView is who raised a request.
items[].raisedBy.kindrequired	string
items[].raisedBy.label	string or null
items[].raisedBy.refrequired	string
items[].resolvedAt	string (date-time) or null
items[].responsesrequired	array of ApprovalResponseView
items[].responses[].comment	string or null
items[].responses[].decisionrequired	string
items[].responses[].idrequired	string
items[].responses[].memberIdrequired	string
items[].responses[].memberNamerequired	string
items[].responses[].respondedAtrequired	string (date-time)
items[].responses[].signatureMethodrequired	string
items[].responses[].signerNamerequired	string
items[].routerequired	ApprovalRouteView	ApprovalRouteView is who a request is routed to.
items[].route.kindrequired	string
items[].route.memberIdsrequired	array of string
items[].route.roleId	string or null
items[].sourcerequired	string
items[].sourceError	string or null
items[].sourceLabel	string or null
items[].sourceRef	string or null
items[].statusrequired	string
items[].titlerequired	string
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/clients/<clientID>/approvals?page=0&pageSize=0&source=<source>&sourceRef=<sourceRef>&status=<status>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/approvals?page=0&pageSize=0&source=<source>&sourceRef=<sourceRef>&status=<status>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/approvals"
params = {
    "page": "0",
    "pageSize": "0",
    "source": "<source>",
    "sourceRef": "<sourceRef>",
    "status": "<status>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/clients/<clientID>/approvals?page=0&pageSize=0&source=<source>&sourceRef=<sourceRef>&status=<status>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/clients/<clientID>/approvals");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");
url.searchParams.set("source", "<source>");
url.searchParams.set("sourceRef", "<sourceRef>");
url.searchParams.set("status", "<status>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/clients/<clientID>/approvals?page=0&pageSize=0&source=<source>&sourceRef=<sourceRef>&status=<status>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/clients/{clientID}/approvals

POSTmsp facemsp

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

raiseApproval asks the client to decide something.

It is routed to a portal role (whoever holds it when they answer) or to named active members; the routed members are told (approval.awaiting). One open approval per source record.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
amountCents	integer or null	int64.
bodyrequired	string
currencyrequired	string
dueAt	string (date-time) or null
quorumrequired	string
routerequired	object
route.kindrequired	string
route.memberIdsrequired	array of string
route.roleIdrequired	string
sourcerequired	string
sourceRefrequired	string
titlerequired	string

Responses

Status	Body	Description
201	application/json, ApprovalView	Created.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
403	application/problem+json, ProblemDetails	The identity does not hold the required permission.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

201 response body

Field	Type	Description
amountCents	integer or null	int64.
awaitingrequired	array of ApprovalAwaitingView
awaiting[].memberIdrequired	string
awaiting[].namerequired	string
bodyrequired	string
canDeciderequired	boolean
canRespondrequired	boolean
consentTextrequired	string
consentVersionrequired	integer
currency	string or null
dueAt	string (date-time) or null
idrequired	string
kindrequired	string
projectId	string or null
quorumrequired	string
raisedAtrequired	string (date-time)
raisedByrequired	ApprovalActorView	ApprovalActorView is who raised a request.
raisedBy.kindrequired	string
raisedBy.label	string or null
raisedBy.refrequired	string
resolvedAt	string (date-time) or null
responsesrequired	array of ApprovalResponseView
responses[].comment	string or null
responses[].decisionrequired	string
responses[].idrequired	string
responses[].memberIdrequired	string
responses[].memberNamerequired	string
responses[].respondedAtrequired	string (date-time)
responses[].signatureMethodrequired	string
responses[].signerNamerequired	string
routerequired	ApprovalRouteView	ApprovalRouteView is who a request is routed to.
route.kindrequired	string
route.memberIdsrequired	array of string
route.roleId	string or null
sourcerequired	string
sourceError	string or null
sourceLabel	string or null
sourceRef	string or null
statusrequired	string
titlerequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/clients/<clientID>/approvals' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "amountCents": 0,
  "body": "string",
  "currency": "string",
  "dueAt": "2026-01-01T00:00:00Z",
  "quorum": "string",
  "route": {
    "kind": "string",
    "memberIds": [
      "string"
    ],
    "roleId": "string"
  },
  "source": "string",
  "sourceRef": "string",
  "title": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "amountCents": 0,
  "body": "string",
  "currency": "string",
  "dueAt": "2026-01-01T00:00:00Z",
  "quorum": "string",
  "route": {
    "kind": "string",
    "memberIds": [
      "string"
    ],
    "roleId": "string"
  },
  "source": "string",
  "sourceRef": "string",
  "title": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/approvals' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/approvals"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "amountCents": 0,
    "body": "string",
    "currency": "string",
    "dueAt": "2026-01-01T00:00:00Z",
    "quorum": "string",
    "route": {
        "kind": "string",
        "memberIds": [
            "string",
        ],
        "roleId": "string",
    },
    "source": "string",
    "sourceRef": "string",
    "title": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "amountCents": 0,
  "body": "string",
  "currency": "string",
  "dueAt": "2026-01-01T00:00:00Z",
  "quorum": "string",
  "route": {
    "kind": "string",
    "memberIds": [
      "string"
    ],
    "roleId": "string"
  },
  "source": "string",
  "sourceRef": "string",
  "title": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/clients/<clientID>/approvals", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/approvals";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "amountCents": 0,
    "body": "string",
    "currency": "string",
    "dueAt": "2026-01-01T00:00:00Z",
    "quorum": "string",
    "route": {
      "kind": "string",
      "memberIds": [
        "string"
      ],
      "roleId": "string"
    },
    "source": "string",
    "sourceRef": "string",
    "title": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "amountCents": 0,
  "body": "string",
  "currency": "string",
  "dueAt": "2026-01-01T00:00:00Z",
  "quorum": "string",
  "route": {
    "kind": "string",
    "memberIds": [
      "string"
    ],
    "roleId": "string"
  },
  "source": "string",
  "sourceRef": "string",
  "title": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/clients/<clientID>/approvals");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/clients/{clientID}/approvals/{approvalID}

GETmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

getApproval opens one approval with its signed answers.

Parameters

Name	In	Type	Required	Description
approvalID	path	string	Yes	A uuid.
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, ApprovalView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
amountCents	integer or null	int64.
awaitingrequired	array of ApprovalAwaitingView
awaiting[].memberIdrequired	string
awaiting[].namerequired	string
bodyrequired	string
canDeciderequired	boolean
canRespondrequired	boolean
consentTextrequired	string
consentVersionrequired	integer
currency	string or null
dueAt	string (date-time) or null
idrequired	string
kindrequired	string
projectId	string or null
quorumrequired	string
raisedAtrequired	string (date-time)
raisedByrequired	ApprovalActorView	ApprovalActorView is who raised a request.
raisedBy.kindrequired	string
raisedBy.label	string or null
raisedBy.refrequired	string
resolvedAt	string (date-time) or null
responsesrequired	array of ApprovalResponseView
responses[].comment	string or null
responses[].decisionrequired	string
responses[].idrequired	string
responses[].memberIdrequired	string
responses[].memberNamerequired	string
responses[].respondedAtrequired	string (date-time)
responses[].signatureMethodrequired	string
responses[].signerNamerequired	string
routerequired	ApprovalRouteView	ApprovalRouteView is who a request is routed to.
route.kindrequired	string
route.memberIdsrequired	array of string
route.roleId	string or null
sourcerequired	string
sourceError	string or null
sourceLabel	string or null
sourceRef	string or null
statusrequired	string
titlerequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/clients/<clientID>/approvals/<approvalID>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/approvals/<approvalID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/approvals/<approvalID>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/clients/<clientID>/approvals/<approvalID>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/approvals/<approvalID>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/clients/<clientID>/approvals/<approvalID>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/clients/{clientID}/approvals/{approvalID}/withdraw

POSTmsp facemsp

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

withdrawApproval takes an open approval back; the source gets the note.

Parameters

Name	In	Type	Required	Description
approvalID	path	string	Yes	A uuid.
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, ApprovalView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
403	application/problem+json, ProblemDetails	The identity does not hold the required permission.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
amountCents	integer or null	int64.
awaitingrequired	array of ApprovalAwaitingView
awaiting[].memberIdrequired	string
awaiting[].namerequired	string
bodyrequired	string
canDeciderequired	boolean
canRespondrequired	boolean
consentTextrequired	string
consentVersionrequired	integer
currency	string or null
dueAt	string (date-time) or null
idrequired	string
kindrequired	string
projectId	string or null
quorumrequired	string
raisedAtrequired	string (date-time)
raisedByrequired	ApprovalActorView	ApprovalActorView is who raised a request.
raisedBy.kindrequired	string
raisedBy.label	string or null
raisedBy.refrequired	string
resolvedAt	string (date-time) or null
responsesrequired	array of ApprovalResponseView
responses[].comment	string or null
responses[].decisionrequired	string
responses[].idrequired	string
responses[].memberIdrequired	string
responses[].memberNamerequired	string
responses[].respondedAtrequired	string (date-time)
responses[].signatureMethodrequired	string
responses[].signerNamerequired	string
routerequired	ApprovalRouteView	ApprovalRouteView is who a request is routed to.
route.kindrequired	string
route.memberIdsrequired	array of string
route.roleId	string or null
sourcerequired	string
sourceError	string or null
sourceLabel	string or null
sourceRef	string or null
statusrequired	string
titlerequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/clients/<clientID>/approvals/<approvalID>/withdraw' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/approvals/<approvalID>/withdraw' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/approvals/<approvalID>/withdraw"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.post(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/clients/<clientID>/approvals/<approvalID>/withdraw", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/approvals/<approvalID>/withdraw";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/clients/<clientID>/approvals/<approvalID>/withdraw");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/clients/{clientID}/portal/requests

GETclientportal:readmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

listRequests lists a client’s onboarding and offboarding requests.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
kind	query	string	No
status	query	string	No

Responses

Status	Body	Description
200	application/json, array of PortalRequestView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:read.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
[].accessEndsAt	string (date-time) or null
[].completedAt	string (date-time) or null
[].effectiveAt	string (date-time) or null
[].formrequired	RequestForm	RequestForm is the request's form (contract 15: name, email, start/end date, equipment, notes).
[].form.devices	array of RequestDevice
[].form.devices[].actionrequired	string
[].form.devices[].agentId	string
[].form.devices[].descriptionrequired	string
[].form.emailrequired	string
[].form.endDate	string
[].form.namerequired	string
[].form.notes	string
[].form.startDate	string
[].idrequired	string
[].kindrequired	string
[].rowVersionrequired	integer	int64.
[].statusrequired	string
[].submittedAtrequired	string (date-time)
[].submittedByrequired	ApprovalActorView	ApprovalActorView is who raised a request.
[].submittedBy.kindrequired	string
[].submittedBy.label	string or null
[].submittedBy.refrequired	string
[].targetMemberId	string or null
[].targetNamedUserId	string or null
[].ticketId	string or null

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/clients/<clientID>/portal/requests?kind=<kind>&status=<status>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/requests?kind=<kind>&status=<status>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/requests"
params = {
    "kind": "<kind>",
    "status": "<status>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/clients/<clientID>/portal/requests?kind=<kind>&status=<status>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/clients/<clientID>/portal/requests");
url.searchParams.set("kind", "<kind>");
url.searchParams.set("status", "<status>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/clients/<clientID>/portal/requests?kind=<kind>&status=<status>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/clients/{clientID}/portal/requests/{requestID}

GETclientportal:readmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

getRequest opens one request.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
requestID	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, PortalRequestView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:read.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
accessEndsAt	string (date-time) or null
completedAt	string (date-time) or null
effectiveAt	string (date-time) or null
formrequired	RequestForm	RequestForm is the request's form (contract 15: name, email, start/end date, equipment, notes).
form.devices	array of RequestDevice
form.devices[].actionrequired	string
form.devices[].agentId	string
form.devices[].descriptionrequired	string
form.emailrequired	string
form.endDate	string
form.namerequired	string
form.notes	string
form.startDate	string
idrequired	string
kindrequired	string
rowVersionrequired	integer	int64.
statusrequired	string
submittedAtrequired	string (date-time)
submittedByrequired	ApprovalActorView	ApprovalActorView is who raised a request.
submittedBy.kindrequired	string
submittedBy.label	string or null
submittedBy.refrequired	string
targetMemberId	string or null
targetNamedUserId	string or null
ticketId	string or null

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/clients/<clientID>/portal/requests/<requestID>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/requests/<requestID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/requests/<requestID>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/clients/<clientID>/portal/requests/<requestID>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/requests/<requestID>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/clients/<clientID>/portal/requests/<requestID>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PATCH /api/v1/clients/{clientID}/portal/requests/{requestID}

PATCHclientportal:usersmsp facemsp

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

patchRequest moves a request: in_progress, completed or cancelled (completed and cancelled are final).

Completing an offboarding ends the access of whoever is still active for the person leaving, and the client’s requesters hear the request is done.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
requestID	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
statusrequired	string

Responses

Status	Body	Description
200	application/json, PortalRequestView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:users.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
accessEndsAt	string (date-time) or null
completedAt	string (date-time) or null
effectiveAt	string (date-time) or null
formrequired	RequestForm	RequestForm is the request's form (contract 15: name, email, start/end date, equipment, notes).
form.devices	array of RequestDevice
form.devices[].actionrequired	string
form.devices[].agentId	string
form.devices[].descriptionrequired	string
form.emailrequired	string
form.endDate	string
form.namerequired	string
form.notes	string
form.startDate	string
idrequired	string
kindrequired	string
rowVersionrequired	integer	int64.
statusrequired	string
submittedAtrequired	string (date-time)
submittedByrequired	ApprovalActorView	ApprovalActorView is who raised a request.
submittedBy.kindrequired	string
submittedBy.label	string or null
submittedBy.refrequired	string
targetMemberId	string or null
targetNamedUserId	string or null
ticketId	string or null

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X PATCH 'https://depot.example.com/api/v1/clients/<clientID>/portal/requests/<requestID>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "status": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "status": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Patch `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/requests/<requestID>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/requests/<requestID>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "status": "string",
}

response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "status": "string"
}`)

  req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/clients/<clientID>/portal/requests/<requestID>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/requests/<requestID>";

const response = await fetch(url, {
  method: "PATCH",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "status": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "status": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/clients/<clientID>/portal/requests/<requestID>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());