# Operations held for a person to approve, newest first, each with `payee_display`

`GET /approvals` · Skerry · Limits, agents and approvals

Operations held for a person to approve, newest first, each with `payee_display`: the destination as a person would recognise it, where there is one, and `decisions`: each decision recorded so far, oldest first, as `{ decision, actor_type, actor_ref, note, created_at }`. `actor_ref` is a key's id, a member's id or the reference an approver's links were made for; never a secret or a token. `?customer_id=&status=pending`

- Scope: approvals:read
- Moves money: no
- Idempotency: none
- Untrusted: reason, request, payee_display, decision_note, result, decisions.note

## Parameters

- `customer_id` (query), string: The customer, by any of its ids.
- `status` (query), string: Only objects in this state.
- `limit` (query), integer: How many to return, 1 to 100.
- `cursor` (query), string: The `next_cursor` of the previous page.

## Responses

- `200`: Success.
- `202`: requires_approval — Not an error: the operation is held for a person. The body names the approval.
- `400`: price_below_minimum — The price is below the smallest single payment for a method (`detail.method`, `detail.minimum`), or has a part of a cent. Set `credit_only`, raise the price, or drop the method.
- `401`: dpop_invalid — The token is bound to a key and the DPoP proof was missing, wrong for this request, or already used.
- `402`: payment_failed — The payer's bank or card refused. `detail.reason` says why in plain terms.
- `403`: agent_payment_over_max — The merchant asks for more than `max_amount`. Nothing was signed. `detail.asked_minor` is the lowest price asked, in US cents.
- `404`: not_found — No such object in this project — including one that belongs to somebody else.
- `409`: token_not_issued — A delegated payment token could not be issued ready to use, for instance because the payer would have to act. Nothing was sent to the merchant.
- `429`: too_many_waiters — This key already has as many requests waiting (`?wait=`) as it may. Let one finish, or read without wait.
- `500`: internal_error — Ours. Quote the `request_id` and we can find the call.
- `502`: platform_error — A provider failed. Safe to retry with the same Idempotency-Key.
- `503`: oauth_unavailable — The authorisation server's keys could not be read, so tokens cannot be checked. API keys still work.

## Example

```sh
curl -X GET 'https://api.skerry.xyz/approvals' \
  -H 'Authorization: Bearer $KEY'
```