Approve or deny actions

When a session’s turn suspends on a gated tool call, your UI can present the decision.

List pending approvals — GET /approvals

curl -s https://api.sectr.dev/approvals \
  -H "Authorization: Bearer $SECTR_API_KEY"

Returns pending approvals across all apps — each item pairs the session with the TOOL_APPROVAL_REQUIRED event envelope, so your UI renders the tool name, arguments, and reason directly from the payload. Per-session status also flips to awaiting_approval (visible in GET /sessions/{id} and GET /sessions).

Decide — POST /sessions/{id}/approval

curl -X POST https://api.sectr.dev/sessions/$SESSION_ID/approval \
  -H "Authorization: Bearer $SECTR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"approved": true, "approver": "ops-dashboard"}'

202 — the decision is journaled (TOOL_APPROVAL_GRANTED/DENIED) and the resume is scheduled; the resumed turn streams on the same journal tail as everything else.

• approved — required boolean. false denies: the agent receives the rejection as the tool’s result and continues (it sees a denied call, not a crash).
• approver — optional attribution; defaults to the authenticated principal. The CLI sends "sectr send" — you’d send your user’s id.

409 = no pending approval on that session (already decided, or the turn ended). 404 = unknown session. Decide exactly once — the decision is a journal event, not a setting.