Approve sensitive steps | Made with Pepper Agent API

AI is optional. Pepper needs no AI account, and the owner chooses which client to connect.

Some changes have a larger effect than an everyday edit. They email a customer, record money, change settings, publish to visitors, delete records or export data. An AI client cannot make these changes directly. It prepares a request. The person that the connection acts for approves or rejects the exact change in Pepper. After approval, the client runs the change once.

Issuing an invoice, quote, pro forma or credit note uses the same steps. See Issue after approval.

How a request works

The client calls the prepare tool with the change and a new idempotency key. MCP uses <operation>_prepare, for example payments_record_prepare. HTTP uses POST /api/v1/approvals/<operation>/{id}; a change without a record has no {id}.
Pepper checks the change with the same rules as the screen and saves a summary. Nothing changes yet. The answer has HTTP 202, the approval_id, a nonce, the summary rows, expires_at and a review_url.
The delegated person gets an Approval item in the inbox, an in-app alert and one email with the review link. See Approval requests from AI clients.
The person opens the review page and checks each value, then approves or rejects the request.
The client reads the request with approvals_get. When its status is approved, the client calls the execute tool with the nonce and a new idempotency key. MCP uses the operation name, for example payments_record. HTTP uses POST /api/v1/approvals/{approval_id}/<operation>.
Pepper runs the change once, as the person, through the same action as the screen. The answer has the status executed and the result, such as the changed record or a download link.

Treat only the executed answer, or the changed record, as proof that the change happened. Approved only allows the client to run it.

What the person reviews

The review page names the AI connection and shows each value of the change. A changed value shows its old value and its new value. Amounts are exact and show their currency. Codes, such as a payment method, show as words, and on/off settings show as yes or no.

The approve button names the change, for example Record a payment. A change that cannot be undone, such as a deletion, has a red button. In Agent approvals, you can decide several waiting requests together. Payments, refunds, online payments, purchase payments and voids, and bank details are always decided one at a time.

Rules for every request

The connection needs the app's execute grant, for example invoices:execute, and the delegated person needs the permission in the tables below. The owner gives the grant when the connection is made. See Connect an external client.
A prepare call accepts only the arguments of its tool. Pepper refuses any other argument, such as a status.
The record must stay the same until the change runs. When someone changes it first, the request becomes out of date and nothing runs. Prepare a new request.
A role update becomes out of date if its permissions, desks or start desk change before approval or execution. Prepare it again to review the current access. The newer saved role stays unchanged.
An email or reminder goes only to the addresses the person approved. When a contact's address changes after the approval, the request is out of date (approval_stale) and nothing is sent.
A request waits for the owner's approval window, 10 minutes unless the owner changes it. An expired, rejected, cancelled or out-of-date request cannot run. A client can cancel its own request with approvals_cancel.
A repeated execute call with the same idempotency key returns the first answer and changes nothing more.
Permission and record access are checked again when the change runs. A revoked connection or a lost permission stops it.
The audit log and the record history show the change with the person and the AI connection.
An export returns a single-use link that works for five minutes. Opening it makes the file again with the person's current access.
A backup stays in Pepper. A person downloads it from Settings > Backups.

Money

Only one tool moves money: payments_online_refund refunds a card payment through Stripe after the person approves the exact amount. Pepper records the refund before it asks Stripe, so a retry with the same execute key continues the same refund and never refunds twice. Recording a payment or a refund states that money moved outside Pepper; it moves no money. Stripe keys, webhook secrets and AI provider keys are entered in Pepper only, and no tool reads or sends them.

What stays with people

No tool exists for these steps:

passwords, two-factor authentication, sessions and devices, sign-in with SSO, agent connections, grants and approvals, and ownership transfer
installing updates, and downloading or restoring backups
steps that only a visitor can do, such as claiming an offer, reserving a booking, giving consent, answering as the customer or unsubscribing

Approval tools by app

Each row is one change. The table shows the MCP name and title of the execute tool, the prepare tool with its HTTP path, and the permission that the delegated person needs. The execute path uses the same operation part after the approval ID. For example, POST /api/v1/approvals/payments-record/{id} prepares a payment, and POST /api/v1/approvals/{approval_id}/payments-record runs it.

Invoices

Grant: invoices:execute.

Operation	Prepare	Permission	What the person approves
`documents_delete_draft` Delete a draft	`documents_delete_draft_prepare`, `POST /api/v1/approvals/documents-delete-draft/{id}`	`invoices.manage`	Delete one draft. An issued document is never deleted; cancel it instead. Cannot be undone.
`documents_cancel` Cancel an issued document	`documents_cancel_prepare`, `POST /api/v1/approvals/documents-cancel/{id}`	`invoices.manage`	Cancel one issued document. Its number stays used and the original stays unchanged; a paid invoice or one with a credit note cannot be cancelled. Cannot be undone.
`payments_record` Record a payment	`payments_record_prepare`, `POST /api/v1/approvals/payments-record/{id}`	`invoices.manage`	Record a payment the person received on an issued invoice. It records money received; it moves no money. Decided on its own.
`payments_reverse` Reverse a payment	`payments_reverse_prepare`, `POST /api/v1/approvals/payments-reverse/{id}`	`invoices.manage`	Reverse a payment recorded by mistake. The row stays in the history. Decided on its own; cannot be undone.
`refunds_record` Record a refund	`refunds_record_prepare`, `POST /api/v1/approvals/refunds-record/{id}`	`invoices.manage`	Record a refund the person paid on an issued credit note. It records money returned; it moves no money. Decided on its own.
`refunds_reverse` Reverse a refund	`refunds_reverse_prepare`, `POST /api/v1/approvals/refunds-reverse/{id}`	`invoices.manage`	Reverse a refund recorded by mistake. The row stays in the history. Decided on its own; cannot be undone.
`quotes_accept` Record that a quote was accepted	`quotes_accept_prepare`, `POST /api/v1/approvals/quotes-accept/{id}`	`invoices.manage`	Record that the customer accepted a sent quote, with the name of the person who accepted it. A linked deal is won.
`quotes_decline` Record that a quote was declined	`quotes_decline_prepare`, `POST /api/v1/approvals/quotes-decline/{id}`	`invoices.manage`	Record that the customer declined a sent quote.
`quotes_convert` Turn a quote into an invoice draft	`quotes_convert_prepare`, `POST /api/v1/approvals/quotes-convert/{id}`	`invoices.manage`	Turn an accepted quote into an invoice draft with the same lines. Nothing is issued.
`proformas_convert` Turn a pro forma into an invoice draft	`proformas_convert_prepare`, `POST /api/v1/approvals/proformas-convert/{id}`	`invoices.manage`	Turn an issued pro forma into an invoice draft with the same lines. Nothing is issued.
`documents_send` Send a document by email	`documents_send_prepare`, `POST /api/v1/approvals/documents-send/{id}`	`invoices.manage`	Email an issued document with its PDF to the recipients the person sees in the send dialog (documents_email_draft), with this subject and text.
`documents_remind` Send a payment reminder	`documents_remind_prepare`, `POST /api/v1/approvals/documents-remind/{id}`	`invoices.manage`	Email a payment reminder for an issued invoice with a balance, to the invoice recipients, with the reminder template.
`documents_reminders_pause` Pause or resume reminders	`documents_reminders_pause_prepare`, `POST /api/v1/approvals/documents-reminders-pause/{id}`	`invoices.manage`	Pause or resume the automatic payment reminders of one invoice.
`documents_record_delivery` Record a delivery outside Pepper	`documents_record_delivery_prepare`, `POST /api/v1/approvals/documents-record-delivery/{id}`	`invoices.manage`	Record that the person delivered an issued document outside Pepper, by post, by hand or another channel. Nothing is sent.
`recurring_save` Save a recurring schedule	`recurring_save_prepare`, `POST /api/v1/approvals/recurring-save`	`invoices.manage`	Add or change a recurring invoice schedule. With auto_send it emails each new invoice to the customer.
`recurring_run` Create the next recurring invoice	`recurring_run_prepare`, `POST /api/v1/approvals/recurring-run/{id}`	`invoices.manage`	Create the next invoice of a recurring schedule now, as Generate now does. With auto_send it is issued and emailed.
`recurring_change` Pause, resume or delete a schedule	`recurring_change_prepare`, `POST /api/v1/approvals/recurring-change/{id}`	`invoices.manage`	Pause, resume or delete a recurring schedule. Invoices it already created stay. Cannot be undone.
`payments_online_enable` Switch online payments on or off	`payments_online_enable_prepare`, `POST /api/v1/approvals/payments-online-enable`	`invoices.manage`	Switch online card payments on or off with the Stripe account the owner already saved. Keys are never sent or read; the owner enters them in Pepper. Decided on its own.
`payments_online_refund` Send an online refund	`payments_online_refund_prepare`, `POST /api/v1/approvals/payments-online-refund/{id}`	`invoices.manage`	Refund money to the customer's card through Stripe for an issued credit note, up to what the card payment allows. Money moves when this runs. Each refund is approved on its own. Decided on its own.
`payments_online_check` Check an online payment with Stripe	`payments_online_check_prepare`, `POST /api/v1/approvals/payments-online-check/{id}`	`invoices.manage`	Ask Stripe again for the state of one online payment or refund attempt and record the answer. No money moves. Decided on its own.
`payments_online_recover` Link an online payment to its Stripe record	`payments_online_recover_prepare`, `POST /api/v1/approvals/payments-online-recover/{id}`	`invoices.manage`	Link an online attempt whose creation was uncertain to the Stripe record the person found, after Stripe confirms the amount and currency. No money moves. Decided on its own.

Customers

Grant: customers:execute.

Operation	Prepare	Permission	What the person approves
`customers_create` Add a customer	`customers_create_prepare`, `POST /api/v1/approvals/customers-create`	`customers.manage`	Add a customer or supplier with its tax identity, address and contact details.
`customers_update` Change a customer	`customers_update_prepare`, `POST /api/v1/approvals/customers-update/{id}`	`customers.manage`	Change a customer's identity, tax number, electronic address, addresses, language, tags or active state. Send only the fields that change. Issued documents keep the details they were issued with.
`customers_delete` Delete a customer	`customers_delete_prepare`, `POST /api/v1/approvals/customers-delete/{id}`	`customers.manage`	Delete a customer. Issued documents keep the customer details they were issued with. Cannot be undone.
`customers_contact_save` Save a customer contact	`customers_contact_save_prepare`, `POST /api/v1/approvals/customers-contact-save/{id}`	`customers.manage`	Add or change a customer contact and whether it receives invoices and reminders. Future documents go to these recipients.
`customers_contact_delete` Delete a customer contact	`customers_contact_delete_prepare`, `POST /api/v1/approvals/customers-contact-delete/{id}`	`customers.manage`	Delete a customer contact. It no longer receives documents. Cannot be undone.
`customers_contact_reorder` Reorder customer contacts	`customers_contact_reorder_prepare`, `POST /api/v1/approvals/customers-contact-reorder/{id}`	`customers.manage`	Put a customer's contacts in a new order. The first contact that receives invoices is the main recipient.
`customers_import` Import customers	`customers_import_prepare`, `POST /api/v1/approvals/customers-import`	`customers.manage`	Import up to 500 customers at once, as the import screen does after its preview. Rows with errors are reported and not saved.
`customers_export` Export customers	`customers_export_prepare`, `POST /api/v1/approvals/customers-export`	`customers.view`	Export every customer the person may see as a CSV file, through a single-use download link. Needs the data export permission. Returns a download link.
`customers_workspace_provision` Open a hosted workspace	`customers_workspace_provision_prepare`, `POST /api/v1/approvals/customers-workspace-provision/{id}`	`customers.manage`	Open a hosted workspace for a customer on a plan and invite its owner by email. For the installation operator.
`customers_workspace_plan` Put a workspace on a plan	`customers_workspace_plan_prepare`, `POST /api/v1/approvals/customers-workspace-plan/{id}`	`customers.manage`	Put a customer's hosted workspace on a plan now, or from and until a date in its time zone.
`customers_workspace_state` Change a workspace state	`customers_workspace_state_prepare`, `POST /api/v1/approvals/customers-workspace-state/{id}`	`customers.manage`	Activate, suspend, close or retain a customer's hosted workspace. Cannot be undone.
`customers_workspace_resend` Resend a workspace invitation	`customers_workspace_resend_prepare`, `POST /api/v1/approvals/customers-workspace-resend/{id}`	`customers.manage`	Send the hosted workspace's owner invitation again.

Sales

Grant: crm:execute.

Operation	Prepare	Permission	What the person approves
`pipeline_stage_create` Add a pipeline stage	`pipeline_stage_create_prepare`, `POST /api/v1/approvals/pipeline-stage-create`	`crm.manage`	Add an open stage at the end of the pipeline, with its win probability and the days after which a deal in it counts as idle.
`pipeline_stage_update` Change a pipeline stage	`pipeline_stage_update_prepare`, `POST /api/v1/approvals/pipeline-stage-update/{id}`	`crm.manage`	Rename a pipeline stage or change its probability and idle days. Deals stay in it.
`pipeline_stage_reorder` Reorder pipeline stages	`pipeline_stage_reorder_prepare`, `POST /api/v1/approvals/pipeline-stage-reorder`	`crm.manage`	Put every open pipeline stage in a new order. Send each live stage ID once.
`pipeline_stage_archive` Archive a pipeline stage	`pipeline_stage_archive_prepare`, `POST /api/v1/approvals/pipeline-stage-archive/{id}`	`crm.manage`	Archive a pipeline stage. The last open stage cannot be archived. Cannot be undone.
`pipeline_reason_create` Add a lost reason	`pipeline_reason_create_prepare`, `POST /api/v1/approvals/pipeline-reason-create`	`crm.manage`	Add a lost reason that people choose when a deal is lost.
`pipeline_reason_update` Rename a lost reason	`pipeline_reason_update_prepare`, `POST /api/v1/approvals/pipeline-reason-update/{id}`	`crm.manage`	Rename a lost reason. Deals lost with it keep it.
`pipeline_reason_archive` Archive a lost reason	`pipeline_reason_archive_prepare`, `POST /api/v1/approvals/pipeline-reason-archive/{id}`	`crm.manage`	Archive a lost reason. Deals lost with it keep it. Cannot be undone.
`leads_import` Import leads	`leads_import_prepare`, `POST /api/v1/approvals/leads-import`	`crm.manage`	Import up to 500 leads at once, as the import screen does after its preview. A lead whose email is already a lead or customer is skipped.
`sales_overview_export` Export the Sales overview	`sales_overview_export_prepare`, `POST /api/v1/approvals/sales-overview-export`	`crm.manage`	Export the Sales overview for a period as a CSV file, through a single-use download link. Needs the data export permission. Returns a download link.
`leads_privacy_report` Make a lead’s personal-data report	`leads_privacy_report_prepare`, `POST /api/v1/approvals/leads-privacy-report/{id}`	`crm.manage`	Make the personal-data report of one lead, as Settings > Audit log does for a data request, as a JSON file through a single-use download link. For the owner. Returns a download link.

Projects

Grant: engagements:execute.

Operation	Prepare	Permission	What the person approves
`decisions_job_move` Move a job to another stage	`decisions_job_move_prepare`, `POST /api/v1/approvals/decisions-job-move/{id}`	`projects.manage`	Move a customer job page to its next stage. The customer is told by email.
`decisions_job_close` Close or reopen a job page	`decisions_job_close_prepare`, `POST /api/v1/approvals/decisions-job-close/{id}`	`projects.manage`	Close a customer job page when the work is done, or open it again. The customer is told by email.
`decisions_question_ask` Ask a customer a question	`decisions_question_ask_prepare`, `POST /api/v1/approvals/decisions-question-ask/{id}`	`projects.manage`	Ask the customer a question on their job page. The customer is told by email.
`decisions_question_reopen` Ask a question again	`decisions_question_reopen_prepare`, `POST /api/v1/approvals/decisions-question-reopen/{id}`	`projects.manage`	Ask the customer an answered question again, with the reason. The customer is told by email.
`decisions_remind` Remind a customer about open questions	`decisions_remind_prepare`, `POST /api/v1/approvals/decisions-remind/{id}`	`projects.manage`	Remind the customer by email about open questions or proofs on their page.
`decisions_notice_retry` Send a customer page email again	`decisions_notice_retry_prepare`, `POST /api/v1/approvals/decisions-notice-retry/{id}`	`projects.manage`	Send a customer page email again that could not be delivered.
`projects_work_settings` Change work settings	`projects_work_settings_prepare`, `POST /api/v1/approvals/projects-work-settings`	`projects.manage`	Change the task key prefix for tasks outside projects and the billing increment of tracked time. Existing keys and billed time stay.
`projects_report_export` Export a project report	`projects_report_export_prepare`, `POST /api/v1/approvals/projects-report-export`	`projects.use`	Export the unbilled-work or margin report as a CSV file, through a single-use download link. Needs the data export permission. Returns a download link.
`projects_time_export` Export tracked time	`projects_time_export_prepare`, `POST /api/v1/approvals/projects-time-export`	`projects.use`	Export the tracked-time register, or one project's time, as a CSV file, through a single-use download link. Needs the data export permission. Returns a download link.
`projects_workload_export` Export the workload	`projects_workload_export_prepare`, `POST /api/v1/approvals/projects-workload-export`	`projects.manage`	Export one week of the team's workload as a PDF, through a single-use download link. Returns a download link.

Boards

Grant: boards:execute.

Operation	Prepare	Permission	What the person approves
`boards_audience` Change who can open a board	`boards_audience_prepare`, `POST /api/v1/approvals/boards-audience/{id}`	`boards.use`	Change who can open a board: only its members, its teams or everyone in the business. The summary counts the people who gain access.
`boards_member_role` Change a board member	`boards_member_role_prepare`, `POST /api/v1/approvals/boards-member-role/{id}`	`boards.use`	Add a person to a board with a role, change their role, or remove them with role null.
`boards_join_admin` Join a board as admin	`boards_join_admin_prepare`, `POST /api/v1/approvals/boards-join-admin/{id}`	`boards.manage`	Join a board as its admin to recover it, as an installation manager can in Pepper. The board's members see that you joined.
`boards_export` Export a board	`boards_export_prepare`, `POST /api/v1/approvals/boards-export/{id}`	`boards.use`	Export a board with its lists, cards and comments as JSON or CSV, through a single-use download link. A complete JSON export is needed before boards_delete. Returns a download link.
`boards_delete` Delete a board	`boards_delete_prepare`, `POST /api/v1/approvals/boards-delete/{id}`	`boards.use`	Delete a board after a complete JSON export made in the last hour. Its files stay in Files. Cannot be undone.

Purchases

Grant: purchases:execute.

Operation	Prepare	Permission	What the person approves
`purchases_payment` Record that a purchase was paid	`purchases_payment_prepare`, `POST /api/v1/approvals/purchases-payment/{id}`	`purchases.manage`	Record that the person paid a purchase, with the date and method, or clear that record. It records money paid; it moves no money. Decided on its own.
`purchases_void` Void a purchase	`purchases_void_prepare`, `POST /api/v1/approvals/purchases-void/{id}`	`purchases.manage`	Void a purchase recorded by mistake, with a reason. It stays in the history and leaves the totals. Decided on its own; cannot be undone.
`purchases_category_create` Add a purchase category	`purchases_category_create_prepare`, `POST /api/v1/approvals/purchases-category-create`	`purchases.manage`	Add a purchase category. Needs the settings permission.
`purchases_category_update` Change a purchase category	`purchases_category_update_prepare`, `POST /api/v1/approvals/purchases-category-update/{id}`	`purchases.manage`	Rename a purchase category or switch it off. Purchases keep it.
`purchases_period_export` Export a tax period	`purchases_period_export_prepare`, `POST /api/v1/approvals/purchases-period-export`	`purchases.manage`	Export a tax period for the accountant: the PDF summary, or a ZIP with the summary, the purchases and their receipts. Through a single-use download link. Returns a download link.

Items

Grant: items:execute.

Operation	Prepare	Permission	What the person approves
`items_delete` Delete an item	`items_delete_prepare`, `POST /api/v1/approvals/items-delete/{id}`	`items.manage`	Delete a catalogue item. Documents that used it keep their lines. To keep it but hide it, archive it with items_update instead. Cannot be undone.
`items_import` Import items	`items_import_prepare`, `POST /api/v1/approvals/items-import`	`items.manage`	Import up to 500 catalogue items at once, as the import screen does after its preview. Rows with errors are reported and not saved.
`items_export` Export items	`items_export_prepare`, `POST /api/v1/approvals/items-export`	`items.view`	Export the catalogue as a CSV file, through a single-use download link. Needs the data export permission. Returns a download link.

Offers

Grant: offers:execute.

Operation	Prepare	Permission	What the person approves
`offers_counter_confirm` Stamp or redeem at the counter	`offers_counter_confirm_prepare`, `POST /api/v1/approvals/offers-counter-confirm`	`offers.redeem`	Stamp a card or redeem an offer for a customer at the counter, with the code they show.
`offers_counter_correct` Correct a counter visit	`offers_counter_correct_prepare`, `POST /api/v1/approvals/offers-counter-correct`	`offers.redeem`	Correct a counter stamp or redemption made by mistake, with a reason. Cannot be undone.

Listings

Grant: listings:execute.

Operation	Prepare	Permission	What the person approves
`listings_publish` Publish or withdraw a listing	`listings_publish_prepare`, `POST /api/v1/approvals/listings-publish/{id}`	`listings.manage`	Publish a listing on the listing widgets, or take it offline. Visitors see it at once.
`listings_follow_up` Follow up a listing enquiry	`listings_follow_up_prepare`, `POST /api/v1/approvals/listings-follow-up/{id}`	`listings.manage`	Move a listing enquiry to its next step, such as a viewing at a time, and email the visitor about it.
`listings_alert_privacy_lookup` Find a listing-alert subscriber	`listings_alert_privacy_lookup_prepare`, `POST /api/v1/approvals/listings-alert-privacy-lookup`	`listings.manage`	Find the collected personal records that match an email address or name, for a person's data request. For the owner.
`listings_alert_privacy_report` Report a listing-alert subscriber’s data	`listings_alert_privacy_report_prepare`, `POST /api/v1/approvals/listings-alert-privacy-report`	`listings.manage`	Make the personal-data report of one collected record as a JSON file, through a single-use download link. For the owner. Returns a download link.
`listings_alert_privacy_erase` Erase a listing-alert subscriber’s data	`listings_alert_privacy_erase_prepare`, `POST /api/v1/approvals/listings-alert-privacy-erase`	`listings.manage`	Erase the personal fields of one collected record for a person's data request. The record stays as an anonymous entry. For the owner. Cannot be undone.

Bookings

Grant: bookings:execute.

Operation	Prepare	Permission	What the person approves
`bookings_change` Change a booking	`bookings_change_prepare`, `POST /api/v1/approvals/bookings-change/{id}`	`bookings.manage`	Reschedule a booking, cancel it with a reason, or record that it was completed or a no-show. The customer gets the usual booking email.
`bookings_mail_retry` Send a booking email again	`bookings_mail_retry_prepare`, `POST /api/v1/approvals/bookings-mail-retry`	`bookings.manage`	Send a booking email again that could not be delivered.

Content

Grant: content:execute.

Operation	Prepare	Permission	What the person approves
`content_request_send` Send a content request	`content_request_send_prepare`, `POST /api/v1/approvals/content-request-send/{id}`	`content.manage`	Email a customer a personal link to approve a case, read an update or acknowledge a guide.
`content_subscriber_privacy_lookup` Find a content subscriber	`content_subscriber_privacy_lookup_prepare`, `POST /api/v1/approvals/content-subscriber-privacy-lookup`	`content.manage`	Find the collected personal records that match an email address or name, for a person's data request. For the owner.
`content_subscriber_privacy_report` Report a content subscriber’s data	`content_subscriber_privacy_report_prepare`, `POST /api/v1/approvals/content-subscriber-privacy-report`	`content.manage`	Make the personal-data report of one collected record as a JSON file, through a single-use download link. For the owner. Returns a download link.
`content_subscriber_privacy_erase` Erase a content subscriber’s data	`content_subscriber_privacy_erase_prepare`, `POST /api/v1/approvals/content-subscriber-privacy-erase`	`content.manage`	Erase the personal fields of one collected record for a person's data request. The record stays as an anonymous entry. For the owner. Cannot be undone.

Analytics

Grant: analytics:execute.

Operation	Prepare	Permission	What the person approves
`analytics_website` Add an analytics website	`analytics_website_prepare`, `POST /api/v1/approvals/analytics-website`	`analytics.manage`	Add a website whose pages may count analytics. It gets its own public site key.
`analytics_page` Approve an analytics page	`analytics_page_prepare`, `POST /api/v1/approvals/analytics-page`	`analytics.manage`	Approve a page path of a website for analytics counts.
`analytics_campaign` Add an analytics campaign	`analytics_campaign_prepare`, `POST /api/v1/approvals/analytics-campaign`	`analytics.manage`	Add a named campaign with its tags, so links that carry those tags count as that campaign.
`analytics_export` Export analytics	`analytics_export_prepare`, `POST /api/v1/approvals/analytics-export`	`analytics.view`	Export the analytics report for a period as a CSV file, through a single-use download link. Returns a download link.

Reports

Grant: reports:execute.

Operation	Prepare	Permission	What the person approves
`reports_tax_export` Export the tax report	`reports_tax_export_prepare`, `POST /api/v1/approvals/reports-tax-export`	`data.export`	Export the tax report for a period and currency as a CSV file, through a single-use download link. Returns a download link.
`reports_aging_export` Export the aging report	`reports_aging_export_prepare`, `POST /api/v1/approvals/reports-aging-export`	`data.export`	Export the aging report in one currency as a CSV file, through a single-use download link. Returns a download link.
`reports_statement_export` Export a customer statement	`reports_statement_export_prepare`, `POST /api/v1/approvals/reports-statement-export`	`data.export`	Export a customer statement for a period and currency as a CSV file, through a single-use download link. Returns a download link.
`reports_invoices_export` Export invoices	`reports_invoices_export_prepare`, `POST /api/v1/approvals/reports-invoices-export`	`data.export`	Export the invoices of a period as a CSV file, through a single-use download link. Returns a download link.
`reports_money_export` Export the Money overview	`reports_money_export_prepare`, `POST /api/v1/approvals/reports-money-export`	`data.export`	Export the Money overview with the same filters as reports_money as a CSV file, through a single-use download link. Returns a download link.

Files

Grant: files:execute.

Operation	Prepare	Permission	What the person approves
`files_share` Make a share link	`files_share_prepare`, `POST /api/v1/approvals/files-share/{id}`	`files.share`	Make a public share link for a file that anyone with the link can open until it expires. A password is set in Pepper only.

People

Grant: people:execute.

Operation	Prepare	Permission	What the person approves
`people_invite` Invite a person	`people_invite_prepare`, `POST /api/v1/approvals/people-invite`	`people.manage`	Invite a person by email to join with a role, or as a guest with chosen apps and records. They set their own password.
`people_invitation_resend` Resend an invitation	`people_invitation_resend_prepare`, `POST /api/v1/approvals/people-invitation-resend/{id}`	`people.manage`	Send an open invitation again with a new link.
`people_invitation_revoke` Revoke an invitation	`people_invitation_revoke_prepare`, `POST /api/v1/approvals/people-invitation-revoke/{id}`	`people.manage`	Revoke an open invitation. Its link stops working. Cannot be undone.
`people_role` Change a person’s role	`people_role_prepare`, `POST /api/v1/approvals/people-role/{id}`	`people.manage`	Change a person's role, and optionally their language and time zone. The owner's role does not change here.
`people_guest_scope` Change a guest’s access	`people_guest_scope_prepare`, `POST /api/v1/approvals/people-guest-scope/{id}`	`people.manage`	Set which apps and records a guest can open.
`people_deactivate` Deactivate a person	`people_deactivate_prepare`, `POST /api/v1/approvals/people-deactivate/{id}`	`people.manage`	Deactivate a person. They are signed out and cannot sign in; their records stay. Cannot be undone.
`people_reactivate` Reactivate a person	`people_reactivate_prepare`, `POST /api/v1/approvals/people-reactivate/{id}`	`people.manage`	Let a deactivated person sign in again with their former role.
`people_offboard` Offboard a person	`people_offboard_prepare`, `POST /api/v1/approvals/people-offboard/{id}`	`people.manage`	Offboard a person: hand their open work to a successor and deactivate them. people_offboard_preview shows what moves. Cannot be undone.
`people_delete` Delete a person	`people_delete_prepare`, `POST /api/v1/approvals/people-delete/{id}`	`people.manage`	Delete a person who never did any work. Someone with records is offboarded instead. Cannot be undone.
`teams_save` Save a team	`teams_save_prepare`, `POST /api/v1/approvals/teams-save`	`people.manage`	Add a team or change its name, description, members and lead. Members gain or lose the team's shared access.
`teams_archive` Archive or restore a team	`teams_archive_prepare`, `POST /api/v1/approvals/teams-archive/{id}`	`people.manage`	Archive a team or restore it.
`people_rate` Set a person’s rate	`people_rate_prepare`, `POST /api/v1/approvals/people-rate/{id}`	`people.manage`	Set a person's cost or billable hourly rate from a date. Earlier time keeps its rate.
`people_time_off` Record time off	`people_time_off_prepare`, `POST /api/v1/approvals/people-time-off/{id}`	`people.manage`	Record a person's time off. Workload and planning leave those days free.
`people_time_off_remove` Remove time off	`people_time_off_remove_prepare`, `POST /api/v1/approvals/people-time-off-remove/{id}`	`people.manage`	Remove recorded time off. Cannot be undone.
`people_desks` Assign a person’s desks	`people_desks_prepare`, `POST /api/v1/approvals/people-desks/{id}`	`people.manage`	Give a person their own desks or return to their role. Changing the list signs the person out and revokes agent connections. Owners and administrators cannot be limited.

Forms

Grant: forms:execute.

Operation	Prepare	Permission	What the person approves
`widgets_publish` Publish or withdraw a widget	`widgets_publish_prepare`, `POST /api/v1/approvals/widgets-publish/{id}`	`forms.manage`	Publish a widget on its public link and the websites it allows, or take it offline. Visitors see it at once.
`widgets_placement_close` Close a placement	`widgets_placement_close_prepare`, `POST /api/v1/approvals/widgets-placement-close/{id}`	`forms.manage`	Close a placement. Its printed codes and links then show the widget's closed state. Cannot be undone.
`forms_publish` Publish or withdraw a form	`forms_publish_prepare`, `POST /api/v1/approvals/forms-publish/{id}`	`forms.manage`	Publish a form for its audience, or take it offline.
`widgets_request_send` Send a response request	`widgets_request_send_prepare`, `POST /api/v1/approvals/widgets-request-send/{id}`	`forms.manage`	Email a customer a personal link to give a testimonial, feedback or answers on this widget.
`widgets_testimonial_moderate` Show or hide a testimonial	`widgets_testimonial_moderate_prepare`, `POST /api/v1/approvals/widgets-testimonial-moderate/{id}`	`forms.manage`	Show a customer's testimonial on the public wall, or hide it, and set its place. The customer's consent still applies.
`forms_submissions_export` Export form submissions	`forms_submissions_export_prepare`, `POST /api/v1/approvals/forms-submissions-export`	`forms.manage`	Export chosen form submissions as a CSV file, through a single-use download link. Needs the data export permission. Returns a download link.

Settings

Grant: settings:execute.

Operation	Prepare	Permission	What the person approves
`settings_save` Change settings	`settings_save_prepare`, `POST /api/v1/approvals/settings-save`	`settings.manage`	Change settings in one group: company identity, address and tax registration, invoicing defaults, language and formats, PDF, the sender name and address, reminders or file limits. The logo is set in Pepper.
`settings_reset` Reset a settings section	`settings_reset_prepare`, `POST /api/v1/approvals/settings-reset`	`settings.manage`	Reset one settings section to its factory values. Cannot be undone.
`settings_number_sequence` Change a number sequence	`settings_number_sequence_prepare`, `POST /api/v1/approvals/settings-number-sequence/{id}`	`settings.manage`	Change the number pattern of a document type. Issued numbers never change; a next number below one already used is refused.
`settings_role_save` Save a role	`settings_role_save_prepare`, `POST /api/v1/approvals/settings-role-save`	`users.manage`	Save a custom role or change any role’s desks and start desk. Built-in permissions stay fixed. Desk-list changes sign out affected people; start-only changes do not.
`settings_role_delete` Delete a role	`settings_role_delete_prepare`, `POST /api/v1/approvals/settings-role-delete/{id}`	`users.manage`	Delete a custom role that nobody holds. Cannot be undone.
`settings_tax_create` Add a tax rate	`settings_tax_create_prepare`, `POST /api/v1/approvals/settings-tax-create`	`settings.manage`	Add a tax rate that documents can use. Issued documents keep the rate they were issued with.
`settings_tax_update` Change a tax rate	`settings_tax_update_prepare`, `POST /api/v1/approvals/settings-tax-update/{id}`	`settings.manage`	Change a tax rate's name, category, default or active state. Issued documents keep the rate they were issued with.
`settings_tax_reorder` Move a tax rate	`settings_tax_reorder_prepare`, `POST /api/v1/approvals/settings-tax-reorder/{id}`	`settings.manage`	Move a tax rate up or down in the list people choose from.
`settings_tax_delete` Delete a tax rate	`settings_tax_delete_prepare`, `POST /api/v1/approvals/settings-tax-delete/{id}`	`settings.manage`	Delete a tax rate that no document or item uses; switch off one that is in use. Cannot be undone.
`settings_item_category_create` Add an item category	`settings_item_category_create_prepare`, `POST /api/v1/approvals/settings-item-category-create`	`settings.manage`	Add an item category.
`settings_item_category_update` Change an item category	`settings_item_category_update_prepare`, `POST /api/v1/approvals/settings-item-category-update/{id}`	`settings.manage`	Rename an item category or switch it off. Items keep it.
`settings_email_template` Change an email template	`settings_email_template_prepare`, `POST /api/v1/approvals/settings-email-template/{id}`	`settings.manage`	Change the subject and text of one email template in one language. Use the template variables Pepper lists.
`settings_email_template_reset` Reset an email template	`settings_email_template_reset_prepare`, `POST /api/v1/approvals/settings-email-template-reset/{id}`	`settings.manage`	Put one email template back to Pepper's default text. Cannot be undone.
`settings_bank_create` Add a bank account	`settings_bank_create_prepare`, `POST /api/v1/approvals/settings-bank-create`	`settings.manage`	Add a bank account that invoices show for payment. Each bank change is approved on its own. Decided on its own.
`settings_bank_update` Change a bank account	`settings_bank_update_prepare`, `POST /api/v1/approvals/settings-bank-update/{id}`	`settings.manage`	Change a bank account, or make it the default. Invoices issued before keep the details they were issued with. Each bank change is approved on its own. Decided on its own.
`backups_create` Make a backup	`backups_create_prepare`, `POST /api/v1/approvals/backups-create`	`settings.manage`	Make a full encrypted backup now. A person downloads it from Settings > Backups; the file never leaves Pepper through an AI client.
`backups_delete` Delete a backup	`backups_delete_prepare`, `POST /api/v1/approvals/backups-delete`	`settings.manage`	Delete one backup file. Cannot be undone.
`backups_schedule` Set the backup schedule	`backups_schedule_prepare`, `POST /api/v1/approvals/backups-schedule`	`settings.manage`	Set how often Pepper makes a backup and how many it keeps.
`intelligence_save` Change the AI suggestion settings	`intelligence_save_prepare`, `POST /api/v1/approvals/intelligence-save`	`settings.manage`	Switch the optional AI suggestions on or off, choose the features and set the daily limits. The provider key is entered in Pepper only.
`intelligence_test` Test the AI provider connection	`intelligence_test_prepare`, `POST /api/v1/approvals/intelligence-test`	`settings.manage`	Send one synthetic test to the AI provider with the saved key, as Test connection does. It counts toward the daily limit.
`workspaces_plan_save` Save a workspace plan	`workspaces_plan_save_prepare`, `POST /api/v1/approvals/workspaces-plan-save`	`settings.manage`	Add a hosted workspace plan, or save a new version of one. Workspaces on an earlier version keep it until moved.
`audit_export` Export the audit trail	`audit_export_prepare`, `POST /api/v1/approvals/audit-export`	`settings.manage`	Make a signed export of the audit trail with its checks, as a ZIP through a single-use download link. Returns a download link.
`audit_retention_save` Change the audit retention	`audit_retention_save_prepare`, `POST /api/v1/approvals/audit-retention-save`	`settings.manage`	Set how many days each class of audit events is kept, at least 365. Financial events are kept as the law requires.
`audit_prune` Remove expired audit events	`audit_prune_prepare`, `POST /api/v1/approvals/audit-prune`	`settings.manage`	Remove the audit events older than their retention now, as the nightly job does. The chain stays verifiable. Cannot be undone.
`audit_subject_report` Make a personal-data report	`audit_subject_report_prepare`, `POST /api/v1/approvals/audit-subject-report`	`settings.manage`	Make the personal-data report of one person record (a customer, contact, lead or person) as a JSON file through a single-use download link. For the owner. Returns a download link.
`audit_subject_erase` Erase personal data	`audit_subject_erase_prepare`, `POST /api/v1/approvals/audit-subject-erase`	`settings.manage`	Erase the personal fields of one person record for a data request. Issued originals and financial figures stay. For the owner. Cannot be undone.
`desks_update` Arrange a desk	`desks_update_prepare`, `POST /api/v1/approvals/desks-update/{id}`	`settings.manage`	Arrange an existing desk. Changing entries changes the access ceiling and signs affected people out. Everything cannot be renamed or arranged.