Get Approvers and Access
Lists who may manage, approve, review, contribute to or watch an approval flow, per flow or per stage.
Updated
/v1/approval-flows/{flow}/permissionscurl -X GET "https://api.orshot.com/v1/approval-flows/<FLOW>/permissions" \
-H "Authorization: Bearer <ORSHOT_API_KEY>"const res = await fetch("https://api.orshot.com/v1/approval-flows/<FLOW>/permissions", {
method: "GET",
headers: {
Authorization: "Bearer <ORSHOT_API_KEY>",
},
});
const data = await res.json();import requests
response = requests.get(
"https://api.orshot.com/v1/approval-flows/<FLOW>/permissions",
headers={"Authorization": "Bearer <ORSHOT_API_KEY>"},
)
data = response.json()$ch = curl_init("https://api.orshot.com/v1/approval-flows/<FLOW>/permissions");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
curl_setopt($ch, CURLOPT_HTTPHEADER, [
"Authorization: Bearer <ORSHOT_API_KEY>",
]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);require "net/http"
require "json"
uri = URI("https://api.orshot.com/v1/approval-flows/<FLOW>/permissions")
req = Net::HTTP::Get.new(uri)
req["Authorization"] = "Bearer <ORSHOT_API_KEY>"
res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(req) }
data = JSON.parse(res.body)Enterprise Only
The Approvals API is available on Enterprise plans, or through first-party apps (the Orshot app and the Orshot MCP server). This endpoint needs read access.
See Enterprise pricing to get access.
Lists who may manage, approve, review, contribute to or watch an approval flow, per flow or per stage. Use it to tell someone who their template is waiting on.
Endpoint#
https://api.orshot.com/v1/approval-flows/:flow/permissionsPath Parameters#
| Parameter | Type | Required | Description |
|---|---|---|---|
flow | String | Yes | The approval flow's id or slug. A number is an id, anything else a slug. |
Headers#
| Header | Required | Description |
|---|---|---|
Authorization | Yes | Bearer <API key or OAuth token> |
x-workspace-id | No | OAuth tokens with several workspaces: the workspace to act in. API keys ignore it. |
X-Orshot-User-Id | No | API keys only: the user id of the owner, admin or member this call is for. See Acting for a Team Member below. |
X-Session-Id | No | Groups the calls of one agent or MCP session in the activity history. |
Acting for a Team Member#
With an API key, you can send X-Orshot-User-Id with the user id of an owner, admin or member of the workspace to make this call for them. The answer then follows both the key's access level and that person's own access. See acting for a team member.
Request#
await fetch("https://api.orshot.com/v1/approval-flows/brand-and-legal/permissions", {
headers: { Authorization: "Bearer <ORSHOT_API_KEY>" },
});{
"grants": [
{
"id": 1,
"stage": {
"id": 2,
"slug": "brand-review",
"name": "Brand review"
},
"grantee": {
"type": "user",
"id": "9a4c7e2b-1d6f-4e3a-8b5c-2f7d0e9a4c61",
"label": "Priya Shah"
},
"permission": "decide",
"createdAt": "2026-09-28T09:30:00.000Z"
},
{
"id": 2,
"stage": {
"id": 4,
"slug": "legal-review",
"name": "Legal review"
},
"grantee": {
"type": "group",
"id": 1,
"label": "Legal team"
},
"permission": "decide",
"createdAt": "2026-09-28T09:30:00.000Z"
}
],
"stagesWithoutApprover": []
}Response Fields#
Responds 200 with:
| Field | Type | Description |
|---|---|---|
grants | Array | List of ApprovalGrant, fields below. |
grants[].id | Integer | Numeric id. |
grants[].stage | Object | { id, slug, name, archived? }. or null (whole flow); grants on an archived stage are kept as they are by permissions.set. |
grants[].grantee | Object | { type: user or group or role or invite or embed_user, id, label }. |
grants[].permission | String | One of manage, decide, review, contribute, watch. |
grants[].createdAt | String | ISO 8601 timestamp. |
Error Responses#
Every error has the same body: error, code, message and helpUrl, plus the fields that apply (required, role, context, blockers, violations, issues, current). Branch on error; code is more specific. See the error reference.
| Status Code | Error | Description |
|---|---|---|
| 401 | oauth_token_invalid | The OAuth token is invalid, expired or revoked. |
| 403 | api_key_missing | No Authorization: Bearer header. |
| 403 | permission_denied | You don't have access to do this. Ask an owner or admin. code names the capability, for example approval.item.decide_denied; required and role say what was missing. With code: insufficient_scope: the OAuth token lacks workspace:approvals:read. With code: approval.member_header_not_member: X-Orshot-User-Id names someone who isn't an owner, admin or member of the workspace now. With code: approval.member_header_not_allowed: an OAuth token sent X-Orshot-User-Id. |
| 403 | plan_required | The workspace's plan doesn't include Approvals, or doesn't include this part of it. |
| 403 | enterprise_api_required | Using approvals with an API key needs an Enterprise plan. Contact hi@orshot.com to turn it on. |
| 404 | not_found | This doesn't exist or isn't available to you. Reviewers get this, never 403, for flows and templates outside their access. |
| 422 | validation_failed | Some fields aren't valid: the fields listed in issues. issues lists each field with a path and a reason. |
| 422 | validation_failed | With code: approval.member_header_invalid: X-Orshot-User-Id isn't a user id. |
| 429 | rate_limit_exceeded | More than 120 approvals requests in a minute from one person or key. Wait for Retry-After. |
| 503 | approvals_unavailable | Approvals aren't available right now. Try again in a moment. Also returned while approvals are not switched on for the API. |
Ready to automate?
Start rendering images, PDFs and videos from your templates in under 2 minutes. Free plan, no credit card.
Get your API key- Image, PDF and video generation via API
- Visual editor with AI and smart layouts
- Zapier, Make, MCP and 50+ integrations
- White-label embed for your own app
- 100 free credits a month, no credit card required