Skip to navigation
Using the API

Action Approvals

Some Eon API methods are protected by action approval rules. When a method is protected, calling it doesn’t carry out the action right away. Instead, Eon intercepts the call and creates an action request that must be submitted, approved, and then applied before the action runs.

This article explains how to complete an action that requires approval through the API. For an overview, see About Action Approvals.

You must already have permission to perform the underlying action. Approval requirements apply on top of role-based access control, so without the action’s own permission you can’t start the flow.

Complete an action that requires approval

Before you start

  • Authenticate with the Eon API to get an access token, and include it in the Authorization header of every request.

  • Use the same credentials throughout the flow. An approved action request can be applied only by the original requester.

1

Receive the action request

Call the API method as you normally would. If the method is protected by an action approval rule, Eon doesn’t carry out the action. Instead, it responds with 201 and an action request in the CREATED status.

Capture the action request’s id from the actionApprovalRequest object in the response. You’ll pass it to the calls in the following steps.

Example request: Delete a backup policy
curl -L -X DELETE 'https://{your_eon_subdomain}/api/v1/projects/:projectId/backup-policies/:backupPolicyId' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer {access_token}'
Response: Action request created
{
  "actionApprovalRequest": {
    "id": "018f3b3f-4818-7c31-a0d7-2e02f2f83a10",
    "operation": "DELETE_BACKUP_POLICY",
    "status": "CREATED",
    "requesterEmail": "requester@example.com",
    "policyDetails": [ ... ],
    "createdTime": "2026-05-04T23:00:05Z"
  }
}

You only need actionApprovalRequest.id to continue.

An approval rule can be set to skip approval for API requests. If every rule that matches your request skips approval for API requests, the method runs normally and returns its standard 200 response instead of creating an action request.

2

Submit the action request

Submit the action request to start the approval process by calling Submit My Action Request with the action request ID. Set action to CONFIRM, and optionally include a comment explaining why you need to perform the action.

The action request status changes to PENDING_APPROVAL, and the approval window begins.

Example request: Submit an action request
curl -L -X POST 'https://{your_eon_subdomain}/api/v1/projects/:projectId/action-approvals/my-requests/:requestId/submit' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer {access_token}' \
-d '{
  "action": "CONFIRM",
  "comment": "Removing a backup policy that has been replaced."
}'

To abandon a request instead of submitting it, set action to DISCARD. A discarded request can’t be submitted later.

3

Wait for approvals

Approvers must approve the request before the approval window ends. Poll Get My Action Request to check the current status.

Example request: Get an action request
curl -L 'https://{your_eon_subdomain}/api/v1/projects/:projectId/action-approvals/my-requests/:requestId' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer {access_token}'

The response includes the request’s status and the approval progress in policyDetails. When all required approvals are received, the status becomes APPROVED and you can apply the action. For the full list of statuses, see Action Request Statuses.

To cancel a request while it’s pending or approved, call Cancel My Action Request.

4

Apply the approved action

Once the action request is APPROVED, carry out the action by calling the original API method again. This time, include the X-Action-Approval-Request-Id header set to the action request ID.

Make sure the request parameters match your original call. The approved action request can be applied only by the original requester, and only within the post-approval time period.

Example request: Apply the approved action
curl -L -X DELETE 'https://{your_eon_subdomain}/api/v1/projects/:projectId/backup-policies/:backupPolicyId' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer {access_token}' \
-H 'X-Action-Approval-Request-Id: 018f3b3f-4818-7c31-a0d7-2e02f2f83a10'

When the call succeeds, the action runs and the request moves to the applied (EXECUTED) status.

Key points to remember

  • Permission is still required
    Action approvals apply on top of role-based access control. You need permission for the underlying action before you can submit it as an action request.

  • Use the same requester throughout
    An approved action request can be applied only by the original requester. Use the same credentials for every step of the flow.

  • Match the original request
    When you apply an approved action, the request parameters must match your original call.

  • Watch the time windows
    A request must gather its required approvals within the approval window, and you must apply it within the post-approval time period. If either window elapses, the request expires and you have to submit a new one.

Was this page helpful?