> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Propose an operation-approval resolution (maker) > Raises a four-eyes proposal for an SPI operationId. The MAKER identity is the bearer token's sub, and the token MUST be a normal-user principal (403 otherwise). A second live proposal for the same operationId is rejected (409). ## OpenAPI ````yaml /en/openapi/v3-current/cabine.yaml post /v1/operation-approvals openapi: 3.1.0 info: description: >- The Cabine API serves Lerian Cabine, the operators' console over Lerian's native rails. Use it to acknowledge alerts, hand off shifts, delete operator users with four-eyes approval, and decide Lerian SPI operations under manual review with four-eyes approval. title: Lerian Cabine API version: 1.0.0 servers: - url: https://api.example.com description: >- Replace the example host with the URL provided during environment onboarding. security: [] paths: /v1/operation-approvals: post: tags: - OperationApprovalFourEyes summary: Propose an operation-approval resolution (maker) description: >- Raises a four-eyes proposal for an SPI operationId. The MAKER identity is the bearer token's sub, and the token MUST be a normal-user principal (403 otherwise). A second live proposal for the same operationId is rejected (409). operationId: proposeOperationApproval parameters: - description: >- Bearer JWT. Must be a normal-user principal (the MAKER): an application token is refused with 403, and any other token type is refused with 401 at the gate. in: header name: Authorization schema: description: >- Bearer JWT. Must be a normal-user principal (the MAKER): an application token is refused with 403, and any other token type is refused with 401 at the gate. type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/ProposeOperationApprovalBody' description: >- Propose a four-eyes resolution for an SPI operationId. The Cabine API validates shape only, never regulatory meaning. required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/OperationApprovalStateBody' description: Created '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unprocessable Entity '500': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Internal Server Error default: content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Error security: - BearerAuth: [] components: schemas: ProposeOperationApprovalBody: additionalProperties: false properties: action: description: The opaque resolution proposed. enum: - ATTACH_BACEN_RESOURCE - CONFIRM_NOT_APPLIED type: string bacenResourceId: description: >- Required (UUID) when action=ATTACH_BACEN_RESOURCE; must be absent when action=CONFIRM_NOT_APPLIED. type: string digest: description: >- Hex SHA-256 (64 lowercase hex chars) — the SPI operation's requestFingerprint. type: string note: description: Optional maker-authored reason. type: string operationId: description: The SPI DICT/MED operationId this approval concerns (UUID). type: string required: - operationId - action - digest type: object OperationApprovalStateBody: additionalProperties: false properties: action: description: The opaque resolution proposed; the Cabine API never interprets it. enum: - ATTACH_BACEN_RESOURCE - CONFIRM_NOT_APPLIED examples: - ATTACH_BACEN_RESOURCE type: string approvalId: description: The workflow's own identity — use this in GET and decision paths. examples: - 9b2f6c1e-4d7a-4e83-a5c0-3f1d8e2b7a46 type: string at: description: When the latest event was recorded (RFC 3339). format: date-time type: string bacenResourceId: description: Set only when action=ATTACH_BACEN_RESOURCE. type: string checker: $ref: '#/components/schemas/DeleteOperatorBody' description: Server-extracted decider identity, once decided. decisionDeadline: description: Past this instant only 'expired' may follow 'requested'. format: date-time type: string delivery: $ref: '#/components/schemas/OperationApprovalDeliveryBody' description: >- The delivery status of the decision sent to Lerian SPI, once at least one attempt has run. digest: description: >- Hex SHA-256 the maker echoed (the SPI operation's requestFingerprint). type: string maker: $ref: '#/components/schemas/DeleteOperatorBody' description: Server-extracted proposer identity. note: description: Optional operator-authored reason. type: string operationId: description: The SPI DICT/MED operationId this approval concerns. examples: - 5c8e1a47-2b9d-4f60-8e3a-d1f47b09c625 type: string state: description: Latest workflow lifecycle action. enum: - requested - approved - rejected - expired examples: - requested type: string required: - approvalId - operationId - state - action - digest - maker - decisionDeadline - at type: object Detail: additionalProperties: false properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). type: string correlationId: description: Request-scoped correlation identifier echoing X-Request-ID. examples: - req-7a3f9c2e type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. required: - correlationId type: object DeleteOperatorBody: additionalProperties: false properties: owner: description: Operator org (the token's 'owner' claim), when present. examples: - acme type: string sub: description: Operator subject (the token's 'sub' claim, server-extracted). examples: - alice type: string required: - sub type: object OperationApprovalDeliveryBody: additionalProperties: false properties: attemptCount: description: How many delivery attempts have run so far. format: int64 type: integer lastAttemptAt: description: When the most recent attempt ran. format: date-time type: string lastStatusCode: description: >- The HTTP status SPI last answered with, when a response was received. format: int64 type: integer outcome: description: >- pending: still retrying. succeeded: the decision landed on the SPI operation. refused: SPI answered 422 and did not apply the decision. exhausted: gave up after the maximum number of delivery attempts without a delivered answer. Read the operation in Lerian SPI before you propose again. enum: - pending - succeeded - refused - exhausted type: string required: - outcome - attemptCount type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.