> This page is for API.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# Action Approvals

Some Eon API methods are protected by action approval rules.
When a method is protected, calling it doesn't carry out the action right away.
Instead, Eon intercepts the call and creates an action request that must be submitted, approved, and then applied before the action runs.

This article explains how to complete an action that requires approval through the API.
For an overview, see [About Action Approvals].

You must already have permission to perform the underlying action.
Approval requirements apply on top of role-based access control, so without the action's own permission you can't start the flow.

[About Action Approvals]: /data-protection/account-administration/access-management/action-approvals/about-action-approvals

## Complete an action that requires approval

#### Before you start

* [Authenticate] with the Eon API to get an access token, and include it in the `Authorization` header of every request.

* Use the same credentials throughout the flow.
  An approved action request can be applied only by the original requester.

[Authenticate]: /api/using-the-api/authentication

### Receive the action request

Call the API method as you normally would.
If the method is protected by an action approval rule, Eon doesn't carry out the action.
Instead, it responds with `201` and an action request in the `CREATED` status.

Capture the action request's `id` from the `actionApprovalRequest` object in the response.
You'll pass it to the calls in the following steps.

**`Example request: Delete a backup policy`**

```bash title="Example request: Delete a backup policy"
curl -L -X DELETE 'https://{your_eon_subdomain}/api/v1/projects/:projectId/backup-policies/:backupPolicyId' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer {access_token}'
```

**`Response: Action request created`**

```json title="Response: Action request created" {3,5}
{
  "actionApprovalRequest": {
    "id": "018f3b3f-4818-7c31-a0d7-2e02f2f83a10",
    "operation": "DELETE_BACKUP_POLICY",
    "status": "CREATED",
    "requesterEmail": "requester@example.com",
    "policyDetails": [ ... ],
    "createdTime": "2026-05-04T23:00:05Z"
  }
}
```

You only need `actionApprovalRequest.id` to continue.

> **Note**
>
> An approval rule can be set to skip approval for API requests.
> If every rule that matches your request skips approval for API requests, the method runs normally and returns its standard `200` response instead of creating an action request.

### Submit the action request

Submit the action request to start the approval process by calling [Submit My Action Request][submit] with the action request ID.
Set `action` to `CONFIRM`, and optionally include a `comment` explaining why you need to perform the action.

The action request status changes to `PENDING_APPROVAL`, and the approval window begins.

**`Example request: Submit an action request`**

```bash title="Example request: Submit an action request" {5}
curl -L -X POST 'https://{your_eon_subdomain}/api/v1/projects/:projectId/action-approvals/my-requests/:requestId/submit' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer {access_token}' \
-d '{
  "action": "CONFIRM",
  "comment": "Removing a backup policy that has been replaced."
}'
```

To abandon a request instead of submitting it, set `action` to `DISCARD`.
A discarded request can't be submitted later.

[submit]: /api/api-reference/access-management/action-approvals/my-action-requests/create-action-approval-request

### Wait for approvals

Approvers must approve the request before the approval window ends.
Poll [Get My Action Request][get] to check the current status.

**`Example request: Get an action request`**

```bash title="Example request: Get an action request"
curl -L 'https://{your_eon_subdomain}/api/v1/projects/:projectId/action-approvals/my-requests/:requestId' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer {access_token}'
```

The response includes the request's `status` and the approval progress in `policyDetails`.
When all required approvals are received, the status becomes `APPROVED` and you can apply the action.
For the full list of statuses, see [Action Request Statuses][statuses].

To cancel a request while it's pending or approved, call [Cancel My Action Request][cancel].

[get]: /api/api-reference/access-management/action-approvals/my-action-requests/get-my-action-approval-request[cancel]: /api/api-reference/access-management/action-approvals/my-action-requests/cancel-action-approval-request[statuses]: /data-protection/account-administration/access-management/action-approvals/action-request-statuses

### Apply the approved action

Once the action request is `APPROVED`, carry out the action by calling the original API method again.
This time, include the `X-Action-Approval-Request-Id` header set to the action request ID.

Make sure the request parameters match your original call.
The approved action request can be applied only by the original requester, and only within the post-approval time period.

**`Example request: Apply the approved action`**

```bash title="Example request: Apply the approved action" {4}
curl -L -X DELETE 'https://{your_eon_subdomain}/api/v1/projects/:projectId/backup-policies/:backupPolicyId' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer {access_token}' \
-H 'X-Action-Approval-Request-Id: 018f3b3f-4818-7c31-a0d7-2e02f2f83a10'
```

When the call succeeds, the action runs and the request moves to the applied (`EXECUTED`) status.

## Key points to remember

* **Permission is still required** \

  Action approvals apply on top of role-based access control.
  You need permission for the underlying action before you can submit it as an action request.

* **Use the same requester throughout** \

  An approved action request can be applied only by the original requester.
  Use the same credentials for every step of the flow.

* **Match the original request** \

  When you apply an approved action, the request parameters must match your original call.

* **Watch the time windows** \

  A request must gather its required approvals within the approval window, and you must apply it within the post-approval time period.
  If either window elapses, the request expires and you have to submit a new one.