# Get the approval policy

> The approval_policies.get operation: GET /api/v1/approval_policy in the REST API and the approval_policies_get tool in the MCP server.

Returns the organization's approval policy:

- `tiers`: what agents, apps and MCP clients may do per risk tier (`allow`, `require_approval` or `deny`).
  Until the policy is saved: write and financial `allow`, compliance and security `require_approval`.
- `twoPersonFor`: the operations that need a second person's approval, whoever calls.
- `amountLimits`: for operations that move money, the amount per currency at or below which a call runs at
  once (micros as a string).
- `overrides`: stricter rules for single entities, agents and apps. The strictest applicable rule wins.

Without a saved policy `id` is null and `version` 0. `availableOperations` lists every operation a policy
can name. The policy applies in both modes.

## At a glance

- **REST:** `GET /api/v1/approval_policy`
- **MCP tool:** `approval_policies_get`
- **Operation ID:** `approval_policies.get`
- **Scope:** Organization
- **Permission:** `approvals:read`
- **Risk tier:** `read`
- **Dry run:** Not supported
- **Idempotency:** Not needed (read only)
- **Modes:** Test and live
- **Authentication:** API key with the `approvals:read` scope
- **Since:** M2

## Request

### Query parameters

This operation takes no query parameters.

## Response

`200 OK` with a JSON object:

| Field                                    | Type                                                  | Description |
| ---------------------------------------- | ----------------------------------------------------- | ----------- |
| `object`                                 | `"approval_policy"`                                   |             |
| `id`                                     | `apol_…` ID or null                                   |             |
| `orgId`                                  | `org_…` ID                                            |             |
| `tiers`                                  | object                                                |             |
| `tiers.write`                            | one of `allow`, `require_approval`, `deny`            |             |
| `tiers.financial`                        | one of `allow`, `require_approval`, `deny`            |             |
| `tiers.compliance`                       | one of `allow`, `require_approval`, `deny`            |             |
| `tiers.security`                         | one of `allow`, `require_approval`, `deny`            |             |
| `twoPersonFor`                           | array of string                                       |             |
| `amountLimits`                           | array of object                                       |             |
| `amountLimits[].operationId`             | string                                                |             |
| `amountLimits[].perCall`                 | money                                                 |             |
| `version`                                | integer (at least 0)                                  |             |
| `updatedAt`                              | date-time or null                                     |             |
| `overrides`                              | array of object                                       |             |
| `overrides[].id`                         | `apol_…` ID                                           |             |
| `overrides[].object`                     | `"approval_policy_override"`                          |             |
| `overrides[].entityId`                   | `ent_…` ID or null                                    |             |
| `overrides[].agentId`                    | `agt_…` ID or null                                    |             |
| `overrides[].clientId`                   | `ocl_…` ID or null                                    |             |
| `overrides[].tiers`                      | object                                                |             |
| `overrides[].tiers.write`                | one of `allow`, `require_approval`, `deny` or null    |             |
| `overrides[].tiers.financial`            | one of `allow`, `require_approval`, `deny` or null    |             |
| `overrides[].tiers.compliance`           | one of `allow`, `require_approval`, `deny` or null    |             |
| `overrides[].tiers.security`             | one of `allow`, `require_approval`, `deny` or null    |             |
| `overrides[].twoPersonFor`               | array of string                                       |             |
| `overrides[].amountLimits`               | array of object                                       |             |
| `overrides[].amountLimits[].operationId` | string                                                |             |
| `overrides[].amountLimits[].perCall`     | money                                                 |             |
| `overrides[].version`                    | integer (at least 1)                                  |             |
| `overrides[].updatedAt`                  | date-time                                             |             |
| `availableOperations`                    | array of object                                       |             |
| `availableOperations[].id`               | string                                                |             |
| `availableOperations[].summary`          | string                                                |             |
| `availableOperations[].riskTier`         | one of `write`, `financial`, `compliance`, `security` |             |
| `availableOperations[].scope`            | one of `org`, `entity`, `brand`                       |             |
| `availableOperations[].amounts`          | boolean                                               |             |

## Examples

### Brand changes need a second person; one agent may not move money

```http
GET /api/v1/approval_policy
Authorization: Bearer or_test_…
```

Response (`200`):

```json
{
  "object": "approval_policy",
  "id": "apol_01m4ttwd3veh9apbewxheq5xh9",
  "orgId": "org_01m4ttwd3veh9apbewxheq5xh3",
  "tiers": {
    "write": "allow",
    "financial": "allow",
    "compliance": "require_approval",
    "security": "require_approval"
  },
  "twoPersonFor": ["brands.update"],
  "amountLimits": [],
  "version": 2,
  "updatedAt": "2026-10-13T14:30:00.000Z",
  "overrides": [
    {
      "id": "apol_01m4ttwd3veh9apbewxheq5xhb",
      "object": "approval_policy_override",
      "entityId": null,
      "agentId": "agt_01m4ttwd3veh9apbewxheq5xhc",
      "clientId": null,
      "tiers": {
        "write": null,
        "financial": "deny",
        "compliance": null,
        "security": null
      },
      "twoPersonFor": [],
      "amountLimits": [],
      "version": 1,
      "updatedAt": "2026-10-13T14:30:00.000Z"
    }
  ],
  "availableOperations": [
    {
      "id": "brands.update",
      "summary": "Update a brand",
      "riskTier": "write",
      "scope": "brand",
      "amounts": false
    },
    {
      "id": "members.remove",
      "summary": "Remove a member",
      "riskTier": "security",
      "scope": "org",
      "amounts": false
    }
  ]
}
```

### No policy saved yet

```http
GET /api/v1/approval_policy
Authorization: Bearer or_test_…
```

Response (`200`):

```json
{
  "object": "approval_policy",
  "id": null,
  "orgId": "org_01m4ttwd3veh9apbewxheq5xh3",
  "tiers": {
    "write": "allow",
    "financial": "allow",
    "compliance": "require_approval",
    "security": "require_approval"
  },
  "twoPersonFor": [],
  "amountLimits": [],
  "version": 0,
  "updatedAt": null,
  "overrides": [],
  "availableOperations": [
    {
      "id": "brands.update",
      "summary": "Update a brand",
      "riskTier": "write",
      "scope": "brand",
      "amounts": false
    },
    {
      "id": "members.remove",
      "summary": "Remove a member",
      "riskTier": "security",
      "scope": "org",
      "amounts": false
    }
  ]
}
```

## Errors

| Code                                                                                   | HTTP status | When                                    | What to do                                                                      |
| -------------------------------------------------------------------------------------- | ----------- | --------------------------------------- | ------------------------------------------------------------------------------- |
| [`permission_denied`](https://ownrecord.io/docs/reference/errors.md#permission_denied) | 403         | You can't see the approval policy here. | Ask an organization owner or admin for a role or scope that allows this action. |

It can also return these [common errors](https://ownrecord.io/docs/reference.md#common-errors): [`validation_failed`](https://ownrecord.io/docs/reference/errors.md#validation_failed), [`api_version_unsupported`](https://ownrecord.io/docs/reference/errors.md#api_version_unsupported), [`authentication_required`](https://ownrecord.io/docs/reference/errors.md#authentication_required), [`api_key_invalid`](https://ownrecord.io/docs/reference/errors.md#api_key_invalid), [`resource_not_found`](https://ownrecord.io/docs/reference/errors.md#resource_not_found), [`dry_run_not_supported`](https://ownrecord.io/docs/reference/errors.md#dry_run_not_supported), [`rate_limited`](https://ownrecord.io/docs/reference/errors.md#rate_limited), [`internal_error`](https://ownrecord.io/docs/reference/errors.md#internal_error).