---
title: "Apply a governance decision to a tool approval family."
method: POST
path: "/tool-approvals"
---

# Apply a governance decision to a tool approval family.

`POST /tool-approvals`

## Headers

- `Oximy-Version` '2026-06-29'
- `Idempotency-Key` string, required

## Request body

- ToolApprovalWriteRequest
  - `tool` string, required
  - `decision` 'approved' | 'pending' | 'unapproved' | 'flagged' | 'warn' | 'blocked', required
  - `reason` string
  - `review_note` string
  - `risk_level` 'low' | 'medium' | 'high' | 'critical'
  - `risk_flags` string[]
  - `enforcement_message` string
  - `enforcement_conditions` string

## Response `200`

Tool approval decision applied.

- ToolApprovalResponse
  - `object` 'tool_approval', required
  - `request_id` string, required
  - `as_of` string, date-time, required
  - `data` ToolApproval, required
    - `id` string, required
    - `object` 'tool_approval', required
    - `tool_id` string, required
    - `tool_type` string
    - `status` 'approved' | 'pending' | 'unapproved' | 'flagged' | 'warn' | 'blocked', required
    - `reviewed_at` string, date-time
    - `review_note` string
    - `risk_level` string
    - `risk_flags` string[]
    - `enforcement_message` string
    - `enforcement_conditions` string
    - `first_detected_at` string, date-time
    - `last_seen_at` string, date-time
    - `sources` string[], required

## Other responses

- `400` — Invalid parameters.
- `401` — Missing or invalid API key.
- `403` — The API key does not have the required scope.
- `404` — The requested resource was not found in the calling key's workspace scope.
- `409` — Conflict or idempotency replay conflict.
- `429` — Rate limit exceeded.
- `500` — Unexpected server error.

---

[API](https://skmtc.net/oximy/apis/oximy-public-api.md) · [All operations](https://skmtc.net/oximy/apis/oximy-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/oximy/oximy-public-api/revisions/36cc62fb2aaf/schema)