Get the approval policy · Ownrecord docs

Returns the organization's approval policy:

tiers: what agents, apps and MCP clients may do per risk tier (allow, require_approval or deny). Until the policy is saved: write and financial allow, compliance and security require_approval.
twoPersonFor: the operations that need a second person's approval, whoever calls.
amountLimits: for operations that move money, the amount per currency at or below which a call runs at once (micros as a string).
overrides: stricter rules for single entities, agents and apps. The strictest applicable rule wins.

Without a saved policy id is null and version 0. availableOperations lists every operation a policy can name. The policy applies in both modes.

At a glance

REST: GET /api/v1/approval_policy
MCP tool: approval_policies_get
Operation ID: approval_policies.get
Scope: Organization
Permission: approvals:read
Risk tier: read
Dry run: Not supported
Idempotency: Not needed (read only)
Modes: Test and live
Authentication: API key with the approvals:read scope
Since: M2

Request

Query parameters

This operation takes no query parameters.

Response

200 OK with a JSON object:

Field	Type	Description
`object`	`"approval_policy"`
`id`	`apol_…` ID or null
`orgId`	`org_…` ID
`tiers`	object
`tiers.write`	one of `allow`, `require_approval`, `deny`
`tiers.financial`	one of `allow`, `require_approval`, `deny`
`tiers.compliance`	one of `allow`, `require_approval`, `deny`
`tiers.security`	one of `allow`, `require_approval`, `deny`
`twoPersonFor`	array of string
`amountLimits`	array of object
`amountLimits[].operationId`	string
`amountLimits[].perCall`	money
`version`	integer (at least 0)
`updatedAt`	date-time or null
`overrides`	array of object
`overrides[].id`	`apol_…` ID
`overrides[].object`	`"approval_policy_override"`
`overrides[].entityId`	`ent_…` ID or null
`overrides[].agentId`	`agt_…` ID or null
`overrides[].clientId`	`ocl_…` ID or null
`overrides[].tiers`	object
`overrides[].tiers.write`	one of `allow`, `require_approval`, `deny` or null
`overrides[].tiers.financial`	one of `allow`, `require_approval`, `deny` or null
`overrides[].tiers.compliance`	one of `allow`, `require_approval`, `deny` or null
`overrides[].tiers.security`	one of `allow`, `require_approval`, `deny` or null
`overrides[].twoPersonFor`	array of string
`overrides[].amountLimits`	array of object
`overrides[].amountLimits[].operationId`	string
`overrides[].amountLimits[].perCall`	money
`overrides[].version`	integer (at least 1)
`overrides[].updatedAt`	date-time
`availableOperations`	array of object
`availableOperations[].id`	string
`availableOperations[].summary`	string
`availableOperations[].riskTier`	one of `write`, `financial`, `compliance`, `security`
`availableOperations[].scope`	one of `org`, `entity`, `brand`
`availableOperations[].amounts`	boolean

Examples

Brand changes need a second person; one agent may not move money

HTTP

GET /api/v1/approval_policy
Authorization: Bearer or_test_…

Response (200):

JSON

{
  "object": "approval_policy",
  "id": "apol_01m4ttwd3veh9apbewxheq5xh9",
  "orgId": "org_01m4ttwd3veh9apbewxheq5xh3",
  "tiers": {
    "write": "allow",
    "financial": "allow",
    "compliance": "require_approval",
    "security": "require_approval"
  },
  "twoPersonFor": ["brands.update"],
  "amountLimits": [],
  "version": 2,
  "updatedAt": "2026-10-13T14:30:00.000Z",
  "overrides": [
    {
      "id": "apol_01m4ttwd3veh9apbewxheq5xhb",
      "object": "approval_policy_override",
      "entityId": null,
      "agentId": "agt_01m4ttwd3veh9apbewxheq5xhc",
      "clientId": null,
      "tiers": {
        "write": null,
        "financial": "deny",
        "compliance": null,
        "security": null
      },
      "twoPersonFor": [],
      "amountLimits": [],
      "version": 1,
      "updatedAt": "2026-10-13T14:30:00.000Z"
    }
  ],
  "availableOperations": [
    {
      "id": "brands.update",
      "summary": "Update a brand",
      "riskTier": "write",
      "scope": "brand",
      "amounts": false
    },
    {
      "id": "members.remove",
      "summary": "Remove a member",
      "riskTier": "security",
      "scope": "org",
      "amounts": false
    }
  ]
}

No policy saved yet

HTTP

GET /api/v1/approval_policy
Authorization: Bearer or_test_…

Response (200):

JSON

{
  "object": "approval_policy",
  "id": null,
  "orgId": "org_01m4ttwd3veh9apbewxheq5xh3",
  "tiers": {
    "write": "allow",
    "financial": "allow",
    "compliance": "require_approval",
    "security": "require_approval"
  },
  "twoPersonFor": [],
  "amountLimits": [],
  "version": 0,
  "updatedAt": null,
  "overrides": [],
  "availableOperations": [
    {
      "id": "brands.update",
      "summary": "Update a brand",
      "riskTier": "write",
      "scope": "brand",
      "amounts": false
    },
    {
      "id": "members.remove",
      "summary": "Remove a member",
      "riskTier": "security",
      "scope": "org",
      "amounts": false
    }
  ]
}

Errors

Code	HTTP status	When	What to do
`permission_denied`	403	You can't see the approval policy here.	Ask an organization owner or admin for a role or scope that allows this action.

It can also return these common errors: validation_failed, api_version_unsupported, authentication_required, api_key_invalid, resource_not_found, dry_run_not_supported, rate_limited, internal_error.

At a glance#

Request#

Query parameters#

Response#

Examples#

Brand changes need a second person; one agent may not move money#

No policy saved yet#

Errors#