> ## Documentation Index > Fetch the complete documentation index at: https://docs.mka1.com/llms.txt > Use this file to discover all available pages before exploring further. # Approve or deny a run's pending tool calls > Answers the approval requests a run stopped for and creates the run that continues it. A run that stopped for approval has status completed and lists the held calls in pending_approvals: an mcp_approval_request for an MCP tool call, a tool_approval_request for a built-in tool call the organization's tool policy holds. Send one decision as the body itself, or several under decisions. One request must decide every pending approval of the run, because the calls left out can never be answered afterwards; otherwise the answer is 409 with error code approvals_incomplete. An expired approval needs no decision and is left out of the continuation. The decision is single-use and bound to the original tool and arguments; a denied call never runs. When the tool policy names approvers for a call, only they decide it, in the approval queue: until one has, the answer is 409 with error code tool_approval_pending, and a decision that differs from the approver's is 409 with error code tool_approval_decision_mismatch. Decisions that pass these checks and are still refused show as a failed continuation run whose error.code is one of those two codes. A run whose approvals were already answered returns 409 with error code approvals_already_answered. Only the caller whose run was held can answer it; a teammate who can read the run gets 403 with error code not_run_caller. API-key callers also need read:responses, which reading the approvals requires. ## OpenAPI ````yaml https://apigw.mka1.com/speakeasy.json post /api/v1/agents/{agent_id}/runs/{run_id}/mcp-approvals openapi: 3.1.1 info: title: MKA1 API version: 1.1.0 description: >- The MKA1 API is a RESTful API that provides access to the MKA1 platform. Learn how to get started with the API and the TypeScript SDK [here](https://mka1.apidocumentation.com/guides/getting-started). license: name: Proprietary servers: - url: https://apigw.mka1.com description: MKA1 API Gateway - url: / description: Relative server URL (configurable via SDK constructor) security: [] tags: - name: Resource Authorization description: >- Manage permissions for LLM resources. Create resources, grant/revoke permissions, and delete resources. Only resource owners can grant, revoke, or delete permissions. x-displayName: Resource Authorization - name: Audit description: >- Audit API for org owners and admins. Trace one request end to end by its X-Request-ID: API gateway timing, the responses it created, and their model invocations and tool calls. x-displayName: Audit - name: Embeddings description: >- Text embedding API endpoints for generating vector representations of text. Create semantic embeddings for search, clustering, and similarity matching using various embedding models. x-displayName: Embeddings - name: Feedback description: >- User feedback API for rating and commenting on chat completions. Collect thumbs up/down ratings and detailed feedback to improve model responses and track user satisfaction. x-displayName: Feedback - name: Images description: >- Image generation API endpoints for creating images from text descriptions. Generate images with control over size, quality, and style. x-displayName: Images - name: MCP Vault description: >- MCP vault API for storing user-owned MCP server configurations and encrypted credentials. Agents reference vault IDs so secrets are resolved only at tool execution time. x-displayName: MCP Vault - name: Speech description: >- Speech API endpoints for audio processing. Convert text to natural-sounding speech (TTS) or transcribe speech to text (STT) in different languages. x-displayName: Speech - name: Usage description: >- Usage tracking and analytics API for monitoring token consumption, request counts, and cost analysis. View detailed statistics per user, model, and time period. x-displayName: Usage - name: Extract description: >- Structured data extraction API for extracting information from files. Define JSON schemas to extract structured data from images, PDFs, and documents. Supports reusable schema templates. x-displayName: Extract - name: Text Classification description: >- Text classification API for categorizing text into predefined labels. Use AI models to classify text content for sentiment analysis, topic categorization, and content moderation. x-displayName: Text Classification - name: Responses description: >- Agent-powered responses API for creating AI agents with autonomous tool usage. Build conversational assistants that can use web search, file operations, image generation, code execution, and MCP integrations. Supports background processing, streaming, and real-time status tracking. x-displayName: Responses - name: Files description: >- File management API for uploading, storing, and managing files with automatic expiration and S3 integration. Upload files that can be used with Assistants, Vector Stores, and other features. Files are stored in S3 with metadata tracked in PostgreSQL. Supports automatic cleanup of expired files. x-displayName: Files - name: Vector Stores description: >- Vector store API for storing and searching documents using embeddings. Create vector stores, upload files with automatic chunking and embedding generation, and perform semantic search. Files are processed asynchronously using Temporal workflows for durability. Supports automatic cleanup of expired stores and LanceDB for efficient vector storage. x-displayName: Vector Stores - name: Conversations description: >- Conversation management API for storing and retrieving conversation state across Response API calls. Create conversations, add items (user messages, assistant messages, system messages), and maintain conversation history. Supports metadata tracking and multi-turn dialogue state management. x-displayName: Conversations - name: Guardrails description: >- AI safety guardrails API for configuring content moderation and security policies. Set up ban word lists, prompt injection detection, and system prompt leakage prevention. Guardrails apply to all requests from an account and can be tested before deployment. x-displayName: Guardrails - name: Tool Policy description: >- Organization tool policy API. Org admins deny tool types, or require approval before their calls run, for every Responses request in the organization, including saved agent runs. The policy overrides what requests and agents configure. x-displayName: Tool Policy - name: Models description: >- Model listing API for discovering available models. Returns model IDs, ownership, and metadata for all registered models in the gateway. x-displayName: Models - name: Skills description: >- Skills API for managing versioned bundles of instructions and files following the Agent Skills standard. Create, version, and download reusable skill packages that include SKILL.md manifests for agent environments. x-displayName: Skills - name: Chat Completions description: >- **Deprecated: Use the Responses API (`/api/v1/llm/responses`) instead.** Chat completion endpoints with support for streaming, tool calls, and multiple providers. x-deprecated: true x-displayName: Chat Completions - name: Batches x-displayName: Batches - name: Evals x-displayName: Evals - name: Fine-Tuning x-displayName: Fine-Tuning - name: Memory Stores x-displayName: Memory Stores - name: Prompts x-displayName: Prompts - name: API Key x-displayName: API Key - name: OAuth x-displayName: OAuth - name: Session x-displayName: Session - name: Organization x-displayName: Organization - name: Cluster Admin x-displayName: Cluster Admin - name: Sessions description: Create, inspect, access, and terminate sandbox sessions. x-displayName: Sessions - name: Browser description: >- Connect to browser sessions through the gateway port proxy. Browser sessions expose a Chrome DevTools Protocol endpoint on port 9222. x-displayName: Browser - name: Execution description: Run shell commands and code inside an existing sandbox session. x-displayName: Execution - name: Workspace description: >- Inspect the workspace manifest, transfer files or archives, and download generated artifacts. x-displayName: Workspace - name: Sandbox Usage description: >- Aggregate sandbox usage statistics across sessions, execution, and workspace operations. x-displayName: Sandbox Usage - name: Sandbox Pricing description: >- Cluster-admin management of the sandbox compute rate card used for budgeted spend. x-displayName: Sandbox Pricing - name: Sandbox GitHub description: >- Connect a GitHub account, clone its repositories into sandbox sessions, and push branches and open pull requests from a session. The GitHub token stays in the sandbox service and never enters a session. x-displayName: Sandbox GitHub - name: Sandbox Environments description: >- Save reusable session configuration (repositories, environment variables, network access, and a setup script) and run the setup script in a session. x-displayName: Sandbox Environments - name: Sandbox Connectors description: >- Connect remote MCP servers (Linear, Notion, Sentry and others) to your account so Coding Harness sessions started from an environment that lists them can call their tools. The sandbox service keeps each connector's credential and never puts it in a session. x-displayName: Sandbox Connectors - name: Agents description: Create and manage reusable agent definitions. x-displayName: Agents - name: Agent Versions description: Inspect an agent's configuration history and roll back to a prior version. x-displayName: Agent Versions - name: Agent Runs description: Execute saved agents and inspect persisted run results. x-displayName: Agent Runs - name: Agent Connectors description: >- Connect saved agents to external messaging channels such as Telegram, including text, photo, and supported document exchange. x-displayName: Agent Connectors - name: Agent Schedules description: Create and manage scheduled or recurring saved agent runs. x-displayName: Agent Schedules - name: schema-4_other x-displayName: other - name: Billing x-displayName: Billing - name: Budgets x-displayName: Budgets - name: Settings x-displayName: Settings - name: Compute Jobs x-displayName: Compute Jobs - name: Compute Services x-displayName: Compute Services - name: Compute Catalog x-displayName: Compute Catalog - name: Compute Volumes x-displayName: Compute Volumes - name: Compute Pricing x-displayName: Compute Pricing - name: Compute Secrets x-displayName: Compute Secrets - name: Compute Usage x-displayName: Compute Usage - name: Compute Tenants x-displayName: Compute Tenants - description: Create, list, read, update, and delete repositories. name: Repositories x-displayName: Repositories - name: Tracking Experiments description: Create and query tenant experiments. x-displayName: Tracking Experiments - name: Tracking Runs description: Record and retrieve run parameters, metrics, and tags. x-displayName: Tracking Runs - name: analytics.projects x-displayName: Projects description: Create, list, rename, and archive analytics projects. - name: analytics.keys x-displayName: Capture keys description: Create and revoke project keys for sending events. - name: analytics x-displayName: Events description: Send events and query event counts or unique visitors. - name: analytics.events x-displayName: Event search description: List individual events with their properties, newest first. - name: analytics.visitors x-displayName: Visitor search description: List visitors by their latest activity, with first and last seen times. - name: generators x-displayName: generators - name: generations x-displayName: generations - name: formats x-displayName: formats - description: >- Flags, environments, evaluation, and the audit log. Administrative operations require a cluster administrator; evaluation uses an environment-specific evaluation key. name: Feature Flags x-displayName: Feature Flags - name: Service Status description: >- Current status of each service and the incident history, for this deployment's region. x-displayName: Service Status - name: Support Cases description: >- Open and follow support cases. Organization owners and admins see all of the organization's cases; other members see the cases they opened. x-displayName: Support Cases paths: /api/v1/agents/{agent_id}/runs/{run_id}/mcp-approvals: parameters: - name: agent_id in: path required: true schema: type: string - name: run_id in: path required: true schema: type: string - name: X-On-Behalf-Of in: header required: false schema: type: string description: Optional external end-user identifier forwarded by the API gateway. post: tags: - Agent Runs summary: Approve or deny a run's pending tool calls description: >- Answers the approval requests a run stopped for and creates the run that continues it. A run that stopped for approval has status completed and lists the held calls in pending_approvals: an mcp_approval_request for an MCP tool call, a tool_approval_request for a built-in tool call the organization's tool policy holds. Send one decision as the body itself, or several under decisions. One request must decide every pending approval of the run, because the calls left out can never be answered afterwards; otherwise the answer is 409 with error code approvals_incomplete. An expired approval needs no decision and is left out of the continuation. The decision is single-use and bound to the original tool and arguments; a denied call never runs. When the tool policy names approvers for a call, only they decide it, in the approval queue: until one has, the answer is 409 with error code tool_approval_pending, and a decision that differs from the approver's is 409 with error code tool_approval_decision_mismatch. Decisions that pass these checks and are still refused show as a failed continuation run whose error.code is one of those two codes. A run whose approvals were already answered returns 409 with error code approvals_already_answered. Only the caller whose run was held can answer it; a teammate who can read the run gets 403 with error code not_run_caller. API-key callers also need read:responses, which reading the approvals requires. operationId: decideAgentRunMcpApproval parameters: - name: X-On-Behalf-Of in: header required: false schema: type: string description: Optional external end-user identifier forwarded by the API gateway. requestBody: required: true content: application/json: schema: oneOf: - $ref: '#/components/schemas/DecideAgentRunMcpApprovalRequest' - $ref: '#/components/schemas/DecideAgentRunApprovalsRequest' responses: '201': description: Decisions accepted and continuation run created. content: application/json: schema: $ref: '#/components/schemas/AgentRunMcpApproval' '400': description: Error response content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '401': description: Error response content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '403': description: Error response content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '404': description: Error response content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '409': description: Error response content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '502': description: Error response content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' security: - bearerAuth: [] x-codeSamples: - lang: csharp label: CSharp (SDK) source: |- using MeetKai.MKA1; using MeetKai.MKA1.Types.Components; using MeetKai.MKA1.Types.Requests; var sdk = new SDK(bearerAuth: ""); var res = await sdk.AgentRuns.DecideAgentRunMcpApprovalAsync( agentId: "", runId: "", body: DecideAgentRunMcpApprovalRequestBody.CreateDecideAgentRunMcpApprovalRequest( new MeetKai.MKA1.Types.Components.DecideAgentRunMcpApprovalRequest() { ApprovalRequestId = "", Approve = false, } ) ); // handle response - lang: python label: Python (SDK) source: |- from meetkai_mka1 import SDK with SDK( bearer_auth="", ) as sdk: res = sdk.agent_runs.decide_agent_run_mcp_approval(agent_id="", run_id="", body={ "approval_request_id": "", "approve": False, }) # Handle response print(res) - lang: typescript label: Typescript (SDK) source: |- import { SDK } from "@meetkai/mka1"; const sdk = new SDK({ bearerAuth: "", }); async function run() { const result = await sdk.agentRuns.decideAgentRunMcpApproval({ agentId: "", runId: "", requestBody: { approvalRequestId: "", approve: false, }, }); console.log(result); } run(); - lang: go label: Go (SDK) source: "package main\n\nimport(\n\t\"context\"\n\tmka1 \"github.com/MeetKai/mka1-sdks/go\"\n\t\"github.com/MeetKai/mka1-sdks/go/models/components\"\n\t\"github.com/MeetKai/mka1-sdks/go/models/operations\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := mka1.New(\n mka1.WithSecurity(\"\"),\n )\n\n res, err := s.AgentRuns.DecideAgentRunMcpApproval(ctx, \"\", \"\", operations.CreateDecideAgentRunMcpApprovalRequestBodyDecideAgentRunMcpApprovalRequest(\n components.DecideAgentRunMcpApprovalRequest{\n ApprovalRequestID: \"\",\n Approve: false,\n },\n ), nil)\n if err != nil {\n log.Fatal(err)\n }\n if res.AgentRunMcpApproval != nil {\n // handle response\n }\n}" components: schemas: DecideAgentRunMcpApprovalRequest: type: object additionalProperties: false required: - approval_request_id - approve properties: approval_request_id: type: string minLength: 1 approve: type: boolean reason: type: string minLength: 1 maxLength: 2000 DecideAgentRunApprovalsRequest: type: object additionalProperties: false required: - decisions properties: decisions: type: array minItems: 1 maxItems: 300 description: >- One decision for each pending approval of the run. Each approval request may appear once. items: $ref: '#/components/schemas/AgentRunApprovalDecision' AgentRunMcpApproval: type: object required: - object - approval_request_id - approved - source_run_id - continuation_run properties: object: type: string enum: - agent.run.mcp_approval approval_request_id: type: string description: >- The first decision's approval request. Kept for clients that send one decision. approved: type: boolean description: The first decision. decisions: type: array description: >- Every decision the continuation run carries. Decisions for expired approvals are left out. items: $ref: '#/components/schemas/AgentRunApprovalDecision' source_run_id: type: string continuation_run: $ref: '#/components/schemas/AgentRun' ErrorEnvelope: type: object required: - error properties: error: type: object required: - message properties: message: type: string code: type: string description: A machine-readable error code, when the error has one. details: oneOf: - $ref: '#/components/schemas/JsonValue' - type: 'null' AgentRunApprovalDecision: type: object additionalProperties: false required: - approval_request_id - approve properties: approval_request_id: type: string minLength: 1 description: ID of the approval request, from the run's pending_approvals. approve: type: boolean reason: type: string minLength: 1 maxLength: 2000 description: >- Why the call was approved or denied. A denial reason is shown to the model. AgentRun: type: object required: - object - id - agent_id - agent_version - status - input - conversation - previous_response_id - metadata - gateway_response_id - gateway_response - error - pending_approvals - created_at - completed_at properties: object: type: string enum: - agent.run id: type: string agent_id: type: string agent_version: type: - integer - 'null' minimum: 1 description: >- The agent configuration version this run executed against. Null for runs created before versioning. status: type: string enum: - waiting - queued - submitting - completed - failed - cancelled - incomplete description: >- waiting means the run is held for one of the agent's max_concurrent_runs slots and has not been sent to the model; it can be cancelled. Terminal outcomes stay distinct: cancelled is caller-requested; incomplete means a limit or interruption stopped the run. gateway_response.incomplete_details records the reason, including max_tokens or max_tool_calls. Stored failed rows with one of these gateway outcomes are serialized with the gateway outcome, retaining any connector error and completion timestamp. input: $ref: '#/components/schemas/JsonValue' conversation: oneOf: - $ref: '#/components/schemas/JsonValue' - type: 'null' previous_response_id: type: - string - 'null' metadata: oneOf: - type: object additionalProperties: type: string - type: 'null' gateway_response_id: type: - string - 'null' gateway_response: oneOf: - $ref: '#/components/schemas/JsonValue' - type: 'null' error: oneOf: - $ref: '#/components/schemas/JsonValue' - type: 'null' pending_approvals: type: array description: >- The tool calls this run stopped for that nobody has answered yet. A run that stopped for approval has status completed; it is finished only when this list is empty. The list empties once a continuation run answers the calls. items: $ref: '#/components/schemas/AgentRunPendingApproval' created_at: type: string format: date-time completed_at: type: - string - 'null' format: date-time JsonValue: description: Arbitrary JSON value. AgentRunPendingApproval: type: object description: A tool call the run stopped for and nobody has answered yet. required: - id - kind - tool_type - name - server_label - arguments properties: id: type: string description: The approval request ID to decide. kind: type: string enum: - mcp_approval_request - tool_approval_request description: >- mcp_approval_request for an MCP tool call, tool_approval_request for a built-in tool call held by the organization's tool policy. tool_type: type: string description: >- The held tool's type, such as web_search or code_interpreter; mcp for an MCP tool call. name: type: string description: The tool the model called. server_label: type: - string - 'null' description: The MCP server's label; null for a built-in tool. arguments: type: string description: >- The call's arguments as a JSON string. Approving runs the tool with exactly these arguments. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: API Key description: >- Send Authorization: Bearer , using an MKA1 API key for automation or an OAuth API access token for a signed-in application. Use a dynamic security callback to refresh OAuth access tokens. Browser session-only operations still require their declared cookie. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.