---
title: "Request authorization for a change request"
method: POST
path: "/v1/change_requests/{change_request_id}/authorize"
tags: ["Change requests"]
---

# Request authorization for a change request

`POST /v1/change_requests/{change_request_id}/authorize`

This endpoint initiates an SMS OTP or device signing challenge to authorize a change request.<br> For SMS OTP challenges: include the `person_id` of the person to whom the SMS challenge should be sent in the body of the request. This person must have a verified mobile number. If the change request relates to a change on a business, then the person must have the necessary role to authorize the change request.<br> For device signing challenges: Include the `device_id` of the device to use for authorizing the change request. This device must already be registered via the device binding process.

## Path parameters

- `change_request_id` string, required

## Request body

- object
  - `delivery_method` 'mobile_number' | 'device_signing' — The method to use for delivering the authorization challenge.
  - `person_id` string — The person to whom the SMS OTP should be sent. Only include this property if the `delivery_method` is `mobile_number`.
  - `device_id` string — ID of the device used for authorization
  - `device_data` string — Base64 encoded device data as provided by Seon SDK. Details of Seon SDK integration can be found in the [device monitoring guide](https://docs.solarisgroup.com/guides/kyc/device-monitoring/).

## Response `200`

Successful result of the operation

- SolarisDecoratorsChangeRequestAuthorize
  - `id` string — ID of the change request.
  - `string_to_sign` string — (If the `delivery_method` is `device_signing`) The string that the customer's bound device must sign using its public key.
  - `status` 'AUTHORIZATION_REQUIRED' | 'CONFIRMATION_REQUIRED' | 'ACCEPTED' | 'COMPLETED' | 'FAILED' — The current status of the change request.
  - `updated_at` string, date-time — Timestamp from when the change request was last updated.

## Other responses

- `400` — An error occurred on the client side.
- `403` — You are not authorized to perform this action.
- `429` — SMS request rate limit exceeded for the given mobile number.
- `500` — Internal server error.
- `default` — Unexpected error

---

[API](https://skmtc.net/solarisgroup/apis/device-management.md) · [All operations](https://skmtc.net/solarisgroup/apis/device-management/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/solarisgroup/device-management/revisions/80dd46738839/schema)