Approvals: API examples

Generated from the public OpenAPI. Examples illustrate the contract and are not live results. Use your assigned gateway, credentials and identifiers. The snippets do not execute automatically.

Use Node.js 22 or later. Copy the setup below into an .mjs file, set QFP_BASE_URL and QFP_ACCESS_TOKEN, then append the operation snippet you need. No repository checkout or downloaded client is required. Keep secrets in your backend and persist each write key and body before sending.

Request setup

const required = name => {
  const value = process.env[name];
  if (!value) throw new Error(`Set ${name} before running this example`);
  return value;
};
const baseUrl = required('QFP_BASE_URL').replace(/\/$/, '');
if (!/^https:\/\//.test(baseUrl)) throw new Error('Use your assigned HTTPS gateway');
const token = required('QFP_ACCESS_TOKEN');
const segment = value => encodeURIComponent(value);
async function request(method, path, body, key) {
  const headers = { Authorization: `Bearer ${token}`, 'API-Version': '1.0.0', Accept: 'application/json' };
  if (key) headers['Idempotency-Key'] = key;
  const multipart = body instanceof FormData;
  if (body !== undefined && !multipart) headers['Content-Type'] = 'application/json';
  const response = await fetch(baseUrl + path, {
    method, headers, body: body === undefined ? undefined : multipart ? body : JSON.stringify(body),
    signal: AbortSignal.timeout(30_000), redirect: 'error',
  });
  const text = await response.text();
  const data = text && response.headers.get('content-type')?.includes('json') ? JSON.parse(text) : text || null;
  if (!response.ok) {
    const error = new Error(`HTTP ${response.status}`);
    Object.assign(error, { status: response.status, data, headers: response.headers });
    throw error;
  }
  return { status: response.status, data };
}

listMyTasks

The caller's inbox. API Reference · Integration guide

GET /api/approvals/tasks

const body = undefined;
const result = await request('GET', '/api/approvals/tasks', body, undefined);
console.log(result.status, result.data);

Replace angle-bracket placeholders before calling. Persist any idempotency key with the business instruction.

Potential responses

Documented statuses: 200, 400, 401.

For CSV/download endpoints, the response may be text rather than JSON. The request helper preserves that distinction.

listRequests

List approval requests. API Reference · Integration guide

GET /api/approvals/requests

const body = undefined;
const result = await request('GET', '/api/approvals/requests', body, undefined);
console.log(result.status, result.data);

Replace angle-bracket placeholders before calling. Persist any idempotency key with the business instruction.

Potential responses

Documented statuses: 200, 400, 401.

For CSV/download endpoints, the response may be text rather than JSON. The request helper preserves that distinction.

createRequest

Create an approval request directly. API Reference · Integration guide

POST /api/approvals/requests

Request body: twoStep

{
  "action": "FIAT_PAYMENT",
  "resourceId": "pay-manual-1",
  "reason": "Out-of-band payment",
  "expiresAt": "2026-09-01T00:00:00.000Z",
  "tasks": [
    {
      "step": 0,
      "approver": "#business_sign_off",
      "reason": "Business sign-off"
    },
    {
      "step": 1,
      "approver": "#compliance",
      "reason": "Compliance review"
    }
  ]
}

const body = {
  "action": "FIAT_PAYMENT",
  "resourceId": "pay-manual-1",
  "reason": "Out-of-band payment",
  "expiresAt": "2026-09-01T00:00:00.000Z",
  "tasks": [
    {
      "step": 0,
      "approver": "#business_sign_off",
      "reason": "Business sign-off"
    },
    {
      "step": 1,
      "approver": "#compliance",
      "reason": "Compliance review"
    }
  ]
};
const result = await request('POST', '/api/approvals/requests', body, undefined);
console.log(result.status, result.data);

Replace angle-bracket placeholders before calling. Persist any idempotency key with the business instruction.

Potential responses

Documented statuses: 201, 400, 401.

For CSV/download endpoints, the response may be text rather than JSON. The request helper preserves that distinction.

getRequest

Get one approval request. API Reference · Integration guide

GET /api/approvals/requests/{requestId}

const body = undefined;
const result = await request('GET', '/api/approvals/requests/' + encodeURIComponent('<requestId>') + '', body, undefined);
console.log(result.status, result.data);

Replace angle-bracket placeholders before calling. Persist any idempotency key with the business instruction.

Potential responses

Documented statuses: 200, 401, 404.

For CSV/download endpoints, the response may be text rather than JSON. The request helper preserves that distinction.

cancelRequest

Cancel a pending request. API Reference · Integration guide

POST /api/approvals/requests/{requestId}/cancel

const body = undefined;
const result = await request('POST', '/api/approvals/requests/' + encodeURIComponent('<requestId>') + '/cancel', body, undefined);
console.log(result.status, result.data);

Replace angle-bracket placeholders before calling. Persist any idempotency key with the business instruction.

Potential responses

Documented statuses: 200, 401, 404, 409.

For CSV/download endpoints, the response may be text rather than JSON. The request helper preserves that distinction.

approveTask

Approve a task. API Reference · Integration guide

POST /api/approvals/tasks/{taskId}/approve

const body = undefined;
const result = await request('POST', '/api/approvals/tasks/' + encodeURIComponent('<taskId>') + '/approve', body, undefined);
console.log(result.status, result.data);

Replace angle-bracket placeholders before calling. Persist any idempotency key with the business instruction.

Potential responses

Documented statuses: 200, 401, 403, 404, 409.

For CSV/download endpoints, the response may be text rather than JSON. The request helper preserves that distinction.

rejectTask

Reject a task. API Reference · Integration guide

POST /api/approvals/tasks/{taskId}/reject

const body = undefined;
const result = await request('POST', '/api/approvals/tasks/' + encodeURIComponent('<taskId>') + '/reject', body, undefined);
console.log(result.status, result.data);

Replace angle-bracket placeholders before calling. Persist any idempotency key with the business instruction.

Potential responses

Documented statuses: 200, 401, 403, 404, 409.

For CSV/download endpoints, the response may be text rather than JSON. The request helper preserves that distinction.

reassignTask

Move a pending task to a different approver or group. API Reference · Integration guide

POST /api/approvals/tasks/{taskId}/reassign

A request body is required. The contract supplies no JSON body example here; use the linked schema. Multipart requests need FormData/file fields, not a JSON body.

const body = requestBody;
const result = await request('POST', '/api/approvals/tasks/' + encodeURIComponent('<taskId>') + '/reassign', body, undefined);
console.log(result.status, result.data);

Replace angle-bracket placeholders before calling. Persist any idempotency key with the business instruction.

Potential responses

Documented statuses: 200, 400, 401, 404, 409.

For CSV/download endpoints, the response may be text rather than JSON. The request helper preserves that distinction.