---
title: "Respond To Permission Request"
method: POST
path: "/api/permission-response"
tags: ["Agent Chat"]
---

# Respond To Permission Request

`POST /api/permission-response`

Respond to a permission request from the agent.

When the agent calls send_invoice, send_proposal, or send_gmail, it emits a
permission_request event via SSE. The frontend displays a confirmation dialog
and calls this endpoint with the user's response.

The agent waits up to 60 seconds for a response. If no response is received,
the permission request times out and the tool call is denied.

Request body:
    thread_id: The thread ID
    request_id: The permission request ID (from the permission_request event)
    approved: True to allow the action, False to deny
    message: Optional message explaining the decision (shown to agent if denied)

Returns:
    success: True if the response was handled
    message: Status message

## Query parameters

- `user_id` string
- `org_id` string

## Request body

- PermissionResponseRequest — Request body for responding to a permission request. `thread_id` is optional because not every permission request comes from a chat thread. MCP-origin requests (ChatGPT, the Claude connector, Cursor, the Every CLI) have no thread -- they are bound to a user and an org instead. While this field was required, an MCP row could not even be SUBMITTED here: the schema rejected `null` with a 422 before any authorization ran, which is why the destructive-write gate had to ship with enforcement off.
  - `thread_id` string, nullable
  - `request_id` string, required
  - `approved` boolean, required
  - `message` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/every/apis/every-api.md) · [All operations](https://skmtc.net/every/apis/every-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/every/every-api/versions/9744001af85d/schema)