Signing Requests
The Signing Requests endpoints raise signing requests for approval, list the requests waiting for a decision, send and validate approvers’ verification codes, record approval decisions, and check an artifact before signing.
For the corresponding user interface, refer to the Signing Requests section.
Endpoints
POST /signing_request/check-artifact/
Confirms that an artefact is recognised for the given application before a signing request is raised.
Request Body (application/json)
| Field | Type | Required | Description |
|---|
| app_id | integer | Yes | Application the artefact belongs to. |
| label | string | Yes | Artefact label. |
Example Request
curl -X POST "https://<your domain>/api/signing_request/check-artifact/" \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{"app_id":1,"label":"string"}'
Responses
| Status Code | Description |
|---|
| 200 | The operation completed. |
GET /signing_request/check_mfa_status/{approvalUser_id}
Reports whether multi-factor verification is required before this approver can decide a signing request.
Request Parameters
| Name | Located In | Type | Required | Description |
|---|
| approvalUser_id | Path | integer | Yes | Identifier of the approver. |
Example Request
curl -X GET "https://<your domain>/api/signing_request/check_mfa_status/<approvalUser_id>" \
-H "Authorization: Bearer <token>"
Responses
| Status Code | Description |
|---|
| 200 | Whether a verification code is needed for this approver. |
GET /signing_request/send_mfa_code/{approvalUser_id}
Emails a single-use verification code to the approver, for use with the validation endpoint before recording a decision.
Request Parameters
| Name | Located In | Type | Required | Description |
|---|
| approvalUser_id | Path | integer | Yes | Identifier of the approver. |
Example Request
curl -X GET "https://<your domain>/api/signing_request/send_mfa_code/<approvalUser_id>" \
-H "Authorization: Bearer <token>"
Responses
| Status Code | Description |
|---|
| 200 | The code was sent. |
POST /signing_request/signing_request_action/{approvalUser_id}
Records an approver's decision on a signing request. Where the approver has multi-factor verification enabled, a valid code must be supplied beforehand.
Request Parameters
| Name | Located In | Type | Required | Description |
|---|
| approvalUser_id | Path | integer | Yes | Identifier of the approver. |
Request Body (application/json)
| Field | Type | Required | Description |
|---|
| signingrequest_id | integer | Yes | Signing request being decided. |
| userApprovalStatus | integer | Yes | Decision to record: 1 approve, 3 reject. |
| id | integer | No | Identifier of the approval record. |
Example Request
curl -X POST "https://<your domain>/api/signing_request/signing_request_action/<approvalUser_id>" \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{"signingrequest_id":1,"userApprovalStatus":1,"id":1}'
Responses
| Status Code | Description |
|---|
| 200 | The decision was recorded. |
GET /signing_request/signing_request_approval/
Returns the signing requests the caller is an approver for, with the requester, certificate, environment and current state of each.
Example Request
curl -X GET "https://<your domain>/api/signing_request/signing_request_approval/" \
-H "Authorization: Bearer <token>"
Responses
| Status Code | Description |
|---|
| 200 | The requested records. |
POST /signing_request/signing_request_approval/
Submits a signing request for approval under the policy configured for the target environment.
Request Body (application/json)
| Field | Type | Required | Description |
|---|
| signingRequest_id | integer | No | SigningRequest id |
| approvalUser_id | integer | No | ApprovalUser id |
| userApprovalStatus | integer | No | UserApprovalStatus |
| created_date | string (date-time) | No | Created date |
Example Request
curl -X POST "https://<your domain>/api/signing_request/signing_request_approval/" \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{"signingRequest_id":1,"approvalUser_id":1,"userApprovalStatus":1,"created_date":"string"}'
Responses
| Status Code | Description |
|---|
| 201 | The operation completed. |
GET /signing_request/signing_request_approval/{approvalUser_id}/
Returns the signing requests assigned to one approver, optionally narrowed by environment, certificate or state.
Request Parameters
| Name | Located In | Type | Required | Description |
|---|
| approvalUser_id | Path | string | Yes | Identifier of the approver. |
| environment_id | Query | array of integer (comma-separated) | No | Limit to these environments. |
| certificate_name | Query | array of string (comma-separated) | No | Limit to these certificates. |
| status | Query | integer | No | Limit to one decision state: -1 failed, 0 pending, 1 approved, 2 signed, 3 rejected, 4 no action. |
| filters | Query | string | No | JSON array of {"field": .., "operator": .., "value": ..} objects, all of which must match. Fields: Request_ID, Certificate_Name, Environment_Name, Submitted_On, Approval_Status. Text fields take equals, not_equals, contains, not_contains, starts_with or ends_with; date fields take date_is, date_is_not, date_is_before or date_is_after with a YYYY-MM-DD value. Unknown fields and operators are ignored. Approval_Status takes only equals, with a state name (Pending, Approved, ...) or its number. |
| page | Query | integer | No | 1-based page number. Defaults to 1. |
| count | Query | integer | No | Records per page. Defaults to 10. |
Example Request
curl -X GET "https://<your domain>/api/signing_request/signing_request_approval/<approvalUser_id>/" \
-H "Authorization: Bearer <token>"
Responses
| Status Code | Description |
|---|
| 200 | The requested records. |
POST /signing_request/validate_mfa_code/{approvalUser_id}
Checks a verification code sent to an approver. Codes are single-use and expire after a short period.
Request Parameters
| Name | Located In | Type | Required | Description |
|---|
| approvalUser_id | Path | integer | Yes | Identifier of the approver. |
Request Body (application/json)
| Field | Type | Required | Description |
|---|
| mfa_code | string | Yes | Code received by the approver. |
Example Request
curl -X POST "https://<your domain>/api/signing_request/validate_mfa_code/<approvalUser_id>" \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{"mfa_code":"string"}'
Responses
| Status Code | Description |
|---|
| 200 | The code was accepted. The approver may now record a decision. |
