Approve, reject or ask for changes to a listed app

POST /api/v1/platform/app_reviews/ocl_01m4ttwd3veh9apbewxheq5xha/decide
Authorization: Bearer or_test_…
Idempotency-Key: 3f1c9a52-7d0e-4b8f-9a61-0c2d5e8b7f14
Content-Type: application/json

{
  "decision": "approve",
  "reason": "Identity, privacy policy and questionnaire checked; scopes match the filing service.",
  "checklist": {
    "version": 1,
    "items": [
      {
        "id": "publisher_identity",
        "checked": true
      },
      {
        "id": "contact_confirmed",
        "checked": true
      },
      {
        "id": "privacy_policy",
        "checked": true
      },
      {
        "id": "questionnaire_acceptable",
        "checked": true
      },
      {
        "id": "scopes_justified",
        "checked": true
      },
      {
        "id": "redirect_uris",
        "checked": true
      },
      {
        "id": "branding",
        "checked": true
      }
    ]
  },
  "expectedVersion": 3
}

{
  "id": "ocl_01m4ttwd3veh9apbewxheq5xha",
  "object": "app_listing",
  "ownerOrgId": "org_01m4ttwd3veh9apbewxheq5xhb",
  "name": "Ledgerly AI",
  "publisher": "Ledgerly AI B.V.",
  "visibility": "listed",
  "appStatus": "active",
  "status": "approved",
  "listed": true,
  "scopes": ["filings:read", "filings:write", "tasks:read", "tasks:write", "ledger:read"],
  "approvedScopes": ["filings:read", "filings:write", "tasks:read", "tasks:write", "ledger:read"],
  "pendingScopes": [],
  "submittedAt": "2026-10-30T09:00:00.000Z",
  "decidedAt": "2026-10-31T10:15:00.000Z",
  "reason": "Identity, privacy policy and questionnaire checked; scopes match the filing service.",
  "application": {
    "publisher": {
      "legalName": "Ledgerly AI B.V.",
      "country": "NL",
      "websiteUrl": "https://ledgerly.example",
      "contact": {
        "name": "Mira de Vries",
        "email": "partners@ledgerly.example"
      }
    },
    "privacyPolicyUrl": "https://ledgerly.example/privacy",
    "questionnaire": {
      "version": 1,
      "answers": [
        {
          "questionId": "data_location",
          "answer": null,
          "details": "AWS eu-central-1 (Frankfurt), Germany"
        },
        {
          "questionId": "encryption_in_transit",
          "answer": "yes",
          "details": null
        },
        {
          "questionId": "encryption_at_rest",
          "answer": "yes",
          "details": null
        },
        {
          "questionId": "credential_storage",
          "answer": "yes",
          "details": null
        },
        {
          "questionId": "staff_access",
          "answer": "yes",
          "details": null
        },
        {
          "questionId": "incident_response",
          "answer": "yes",
          "details": null
        },
        {
          "questionId": "subprocessors",
          "answer": "yes",
          "details": "AWS (hosting), Postmark (email)"
        },
        {
          "questionId": "model_training",
          "answer": "no",
          "details": null
        },
        {
          "questionId": "data_deletion",
          "answer": "yes",
          "details": "Within 30 days of uninstalling"
        },
        {
          "questionId": "vulnerability_management",
          "answer": "yes",
          "details": null
        }
      ]
    },
    "scopeJustifications": [
      {
        "scope": "filings:read",
        "justification": "Reads filing periods to prepare each return."
      },
      {
        "scope": "filings:write",
        "justification": "Records the prepared return and its submission."
      },
      {
        "scope": "tasks:read",
        "justification": "Finds the filing tasks assigned to the app."
      },
      {
        "scope": "tasks:write",
        "justification": "Claims and completes filing tasks."
      },
      {
        "scope": "ledger:read",
        "justification": "Reconciles the return with the tax payable accounts."
      }
    ],
    "partnerTermsVersion": "1.0",
    "submittedBy": "usr_01m4ttwd3veh9apbewxheq5xhf"
  },
  "history": [
    {
      "action": "submitted",
      "at": "2026-10-30T09:00:00.000Z",
      "by": "usr_01m4ttwd3veh9apbewxheq5xhf",
      "reason": null,
      "scopes": []
    },
    {
      "action": "approved",
      "at": "2026-10-31T10:15:00.000Z",
      "by": "usr_01m4ttwd3veh9apbewxheq5xhg",
      "reason": "Identity, privacy policy and questionnaire checked; scopes match the filing service.",
      "scopes": ["filings:read", "filings:write", "tasks:read", "tasks:write", "ledger:read"]
    }
  ],
  "version": 4,
  "org": {
    "id": "org_01m4ttwd3veh9apbewxheq5xhb",
    "slug": "ledgerly",
    "name": "Ledgerly AI"
  },
  "checklist": {
    "version": 1,
    "items": [
      {
        "id": "publisher_identity",
        "checked": true
      },
      {
        "id": "contact_confirmed",
        "checked": true
      },
      {
        "id": "privacy_policy",
        "checked": true
      },
      {
        "id": "questionnaire_acceptable",
        "checked": true
      },
      {
        "id": "scopes_justified",
        "checked": true
      },
      {
        "id": "redirect_uris",
        "checked": true
      },
      {
        "id": "branding",
        "checked": true
      }
    ]
  },
  "redirectUris": ["https://ledgerly.example/oauth/callback"],
  "websiteUrl": "https://ledgerly.example",
  "logoUrl": null,
  "unjustifiedScopes": []
}