---
title: "POST /api/v1/cert-manager/signers/{signerId}/requests/pre-approve"
method: POST
path: "/api/v1/cert-manager/signers/{signerId}/requests/pre-approve"
tags: ["PKI Signers"]
---

# POST /api/v1/cert-manager/signers/{signerId}/requests/pre-approve

`POST /api/v1/cert-manager/signers/{signerId}/requests/pre-approve`

Pre-approve signing for a member (admin only)

## Path parameters

- `signerId` string, uuid, required

## Request body

- object
  - `granteeUserId` string, uuid
  - `granteeIdentityId` string, uuid
  - `justification` string, required
  - `requestedSignings` integer
  - `requestedWindowDuration` string — How long the approval stays usable once it is granted, for example '4h'. The window starts when the request is approved.
  - `scope` object — Optional parameters to scope this approval to (command, signingApplication, signingApplicationHash, hostname, osUsername, ipAddress, dataHash). Every value declared here must match at signing time or the sign call is denied; parameters left out are not restricted. A command must match exactly, apart from whitespace, so a different order of options is a different command. ipAddress is compared against the address the sign call arrives from and dataHash against the digest of the submitted payload, so those two hold even if a caller reports something else. A machine identity that declares a scope without naming ipAddress has it filled in with the address the request arrives from; send null to leave signing unrestricted by address.
    - `command` string
    - `signingApplication` string
    - `signingApplicationHash` string
    - `hostname` string
    - `osUsername` string
    - `ipAddress` string
    - `dataHash` string

## Response `200`

Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/revisions/c057052770f0/schema)