> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Approve a handoff and issue its receipt

> Requires a normal-user principal: an application token is refused with 403, and any other token type is refused with 401 at the gate. The approver must differ from both draft owner and submitter. The approval event id is the immutable receipt id.



## OpenAPI

````yaml /pt/openapi/v3-current/cabine.yaml post /v1/handoffs/{handoffId}/approve
openapi: 3.1.0
info:
  description: >-
    The Cabine API serves Lerian Cabine, the operators' console over Lerian's
    native rails. Use it to acknowledge alerts, hand off shifts, delete operator
    users with four-eyes approval, and decide Lerian SPI operations under manual
    review with four-eyes approval.
  title: Lerian Cabine API
  version: 1.0.0
servers:
  - url: https://api.example.com
    description: >-
      Replace the example host with the URL provided during environment
      onboarding.
security: []
paths:
  /v1/handoffs/{handoffId}/approve:
    post:
      tags:
        - ShiftHandoffs
      summary: Approve a handoff and issue its receipt
      description: >-
        Requires a normal-user principal: an application token is refused with
        403, and any other token type is refused with 401 at the gate. The
        approver must differ from both draft owner and submitter. The approval
        event id is the immutable receipt id.
      operationId: approveShiftHandoff
      parameters:
        - in: header
          name: Authorization
          schema:
            type: string
        - in: path
          name: handoffId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApproveShiftHandoffOutputBody'
          description: OK
        '422':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Detail'
          description: Unprocessable Entity
        '500':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Detail'
          description: Internal Server Error
        default:
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Detail'
          description: Error
      security:
        - BearerAuth: []
components:
  schemas:
    ApproveShiftHandoffOutputBody:
      additionalProperties: false
      properties:
        approvedAt:
          format: date-time
          type: string
        handoff:
          $ref: '#/components/schemas/ShiftHandoffBody'
        receiptId:
          type: string
      required:
        - receiptId
        - approvedAt
        - handoff
      type: object
    Detail:
      additionalProperties: false
      properties:
        code:
          description: >-
            Stable, machine-readable domain error code scoped to the emitting
            service (format: <SERVICE>-NNNN).
          type: string
        correlationId:
          description: Request-scoped correlation identifier echoing X-Request-ID.
          examples:
            - req-7a3f9c2e
          type: string
        detail:
          description: >-
            A human-readable explanation specific to this occurrence of the
            problem.
          examples:
            - Property foo is required but is missing.
          type: string
        errors:
          description: Optional list of individual error details
          items:
            $ref: '#/components/schemas/ErrorDetail'
          type:
            - array
            - 'null'
        instance:
          description: >-
            A URI reference that identifies the specific occurrence of the
            problem.
          examples:
            - https://example.com/error-log/abc123
          format: uri
          type: string
        status:
          description: HTTP status code
          examples:
            - 400
          format: int64
          type: integer
        title:
          description: >-
            A short, human-readable summary of the problem type. This value
            should not change between occurrences of the error.
          examples:
            - Bad Request
          type: string
        type:
          default: about:blank
          description: A URI reference to human-readable documentation for the error.
          examples:
            - https://example.com/errors/example
          format: uri
          type: string
        upstream:
          $ref: '#/components/schemas/Upstream'
          description: >-
            RFC 9457 extension member: the error a proxied third-party provider
            reported. Absent unless the emitting service explicitly surfaced
            one.
      required:
        - correlationId
      type: object
    ShiftHandoffBody:
      additionalProperties: false
      properties:
        approvedBy:
          $ref: '#/components/schemas/HandoffOperatorBody'
        createdAt:
          format: date-time
          type: string
        evidence:
          items:
            $ref: '#/components/schemas/EvidenceReferenceBody'
          type: array
        id:
          description: Stable handoff identifier.
          type: string
        note:
          type: string
        owner:
          $ref: '#/components/schemas/HandoffOperatorBody'
        receiptId:
          type: string
        status:
          enum:
            - draft
            - submitted
            - approved
          type: string
        submittedBy:
          $ref: '#/components/schemas/HandoffOperatorBody'
        updatedAt:
          format: date-time
          type: string
      required:
        - id
        - status
        - owner
        - note
        - evidence
        - createdAt
        - updatedAt
      type: object
    ErrorDetail:
      additionalProperties: false
      properties:
        location:
          description: >-
            Where the error occurred, e.g. 'body.items[3].tags' or
            'path.thing-id'
          type: string
        message:
          description: Error message text
          type: string
        value:
          description: The value at the given location
      type: object
    Upstream:
      additionalProperties: false
      properties:
        code:
          description: The upstream provider's own error code, verbatim.
          examples:
            - E4001
          type: string
        message:
          description: >-
            The upstream provider's own error message, verbatim (bounded, never
            its raw response body).
          examples:
            - account not found at provider
          type: string
      type: object
    HandoffOperatorBody:
      additionalProperties: false
      properties:
        owner:
          description: Operator organization from the bearer token.
          type: string
        sub:
          description: Operator subject from the bearer token.
          type: string
      required:
        - sub
      type: object
    EvidenceReferenceBody:
      additionalProperties: false
      properties:
        label:
          description: Stable human label for the canonical evidence path.
          examples:
            - STR operation abc
          type: string
        path:
          description: Canonical Cabine application path.
          examples:
            - /str/operations/abc
          type: string
      required:
        - path
        - label
      type: object
  securitySchemes:
    BearerAuth:
      bearerFormat: JWT
      description: JWT bearer token issued by the identity provider.
      scheme: bearer
      type: http

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.