# Policies and approvals

> Register, list and switch spending rules on or off, and resolve purchases that a rule held for a person.

## Policies

### `POST /v1/policies`

Scope `policies:write` (workspace key). Registers a policy document. `workspaceId` comes from your key.

| Field | Type | Required |
|---|---|---|
| `document` | string, in the [policy language](https://docs.zanora.dev/buyers/policies.md) | yes |

```bash
curl -s -X POST https://api.zanora.dev/v1/policies -H "x-api-key: $WKEY" \
  -H 'content-type: application/json' -d '{"document":"approval:\n  price > 5"}'
# → {"policies":[{"id":"pol_…","policyType":"approval","enabled":true,…}]}
```

A document with several sections becomes several policies. A line that can't be parsed rejects the whole document with `400`.

### `GET /v1/policies`

Scope `policies:read`. Your workspace's policies, including disabled ones: `{ policies }`.

### `POST /v1/policies/:id/disable`

Scope `policies:write`. Stops applying a policy from the next purchase. No body. Returns `{ policy }`.

### `POST /v1/policies/:id/enable`

Scope `policies:write`. Starts applying it again. No body.

## Approvals

### `GET /v1/approvals`

Scope `approvals:read`. Your workspace's approval requests: `{ approvals }`. Filter with `?status=pending` (or `approved`, `denied`).

```json
{ "approvals": [{ "id": "apr_…", "agentId": "invoice-bot", "walletId": "wal_…", "capabilityId": "cap_…",
  "amountMinor": "1200", "currency": "USD", "rule": "price > 5", "status": "pending", "createdAt": "…" }] }
```

### `POST /v1/approvals/:id/approve`

Scope `approvals:write`. Approves the request. Body is optional: `{ resolvedBy? }`. The approval covers **one** later purchase by that wallet of that capability, at up to the approved amount.

### `POST /v1/approvals/:id/deny`

Scope `approvals:write`. Denies it. Body is optional: `{ resolvedBy? }`.

> **Tip — Keep approvals:write away from agents:**
>
> Give agents a key without `approvals:write`, so a model can never approve its own held spend. See [Approvals](https://docs.zanora.dev/buyers/approvals.md#keeping-approval-with-people).