DevOpsAgentService / Client / update_approval_action

update_approval_action

DevOpsAgentService.Client.update_approval_action(**kwargs)

Updates an approval request with the terminal decision (APPROVED or REJECTED). A single operation handles both verbs via the action enum.

See also: AWS API Documentation

Request Syntax

response = client.update_approval_action(
    agentSpaceId='string',
    approvalId='string',
    action='APPROVED'|'REJECTED',
    finalPattern={
        'tool': 'string',
        'argumentPins': {
            'string': 'string'
        }
    },
    reason='string',
    ttlSeconds=123,
    singleUse=True|False
)
Parameters:

  • agentSpaceId (string) –

    [REQUIRED]

    The agent space identifier — multi-tenant workspace scope. Bound from the request URI.

  • approvalId (string) –

    [REQUIRED]

    Identifier of the approval request being resolved. A UUID. Bound from the request URI.

  • action (string) –

    [REQUIRED]

    The action to take on the approval request — APPROVED or REJECTED.

  • finalPattern (dict) –

    The finalized pattern (tool + argumentPins) that scopes the approval. Required when action is APPROVED; must be absent when action is REJECTED. The pattern narrows, and must not widen, the invocation originally requested by the agent. This cross-field invariant is enforced by service-side validation.

    • tool (string) – [REQUIRED]

      Identifier of the tool the pattern applies to (e.g. use_aws for AWS actions, or a third-party tool name).

    • argumentPins (dict) – [REQUIRED]

      Argument constraints that narrow which tool invocations the pattern matches. For AWS tools, the map must include operation (the IAM action, e.g. ec2:AuthorizeSecurityGroupIngress) and resource_arn (the resource ARN or ARN glob); additional narrowing arguments go in further pin keys. The same {tool, argumentPins} shape is used uniformly for AWS and third-party tools, with tool-specific keys for third-party tools. Requests whose argument pins are collectively too large are rejected with a ValidationException.

      • (string) –

        Argument pin key in an ApprovalPattern (e.g. operation, resource_arn).

        • (string) –

          Argument pin value in an ApprovalPattern.

  • reason (string) – Optional free-text rationale for the decision. Permitted when action is REJECTED; ignored when action is APPROVED.

  • ttlSeconds (integer) – Approval lifetime in seconds, starting from when the decision is submitted. Required when action is APPROVED AND singleUse is false; must be absent when action is REJECTED or when singleUse is true (a single-use approval backs one executed action and the redemption window collapses). Cross-field invariants are enforced by service-side validation; the @range bound here is the operation-boundary check that always applies (a maximum of 4 hours).

  • singleUse (boolean) – Whether the approved action backs a single executed tool call (true) or is reusable within ttlSeconds (false). Required when action is APPROVED; must be absent when action is REJECTED. When true, ttlSeconds must be absent (the redemption window collapses to the single use). When false, ttlSeconds is required and bounds the reuse window. Cross-field invariants are enforced by service-side validation.

Return type:

dict

Returns:

Response Syntax

{
    'approvalId': 'string',
    'status': 'PENDING'|'APPROVED'|'REJECTED'|'REVOKED'|'REDEEMED',
    'expiresAt': datetime(2015, 1, 1)
}

Response Structure

  • (dict) –

    Response structure for UpdateApprovalAction. Reports the post-submission lifecycle status of the approval request and, when applicable, the absolute expiry timestamp. The status is a lifecycle state distinct from the action verb — an APPROVED submission transitions the request to APPROVED status (live, redeemable); a REJECTED submission transitions it to REJECTED status (terminal).

    • approvalId (string) –

      Identifier of the approval request that was resolved. Echoed back so the client can correlate the response with the request.

    • status (string) –

      Lifecycle status of the approval request immediately after submission. Expected post-submission states are APPROVED (when the action is APPROVED) or REJECTED (when the action is REJECTED); PENDING is not returned from this operation, and REVOKED and REDEEMED are reachable only via subsequent reads.

    • expiresAt (datetime) –

      Absolute timestamp at which the approval expires. Set when status is APPROVED (computed as the submission time plus ttlSeconds); absent when status is REJECTED.

Exceptions