Approve sensitive steps | Pepper Agent API

Your AI needs approval for sensitive work. You can decide each time or set a rule with limits. Approval allows one exact action. The review page does not execute it.

Sensitive actions include sending email, recording money, changing settings, publishing, deleting records and exporting data. Your AI prepares a request for the person it acts for. By default, that person checks the details in Pepper and approves or rejects the request. A matching rule can approve supported actions instead.

AI is optional. The owner chooses whether to allow connections, and each connection stays within its granted access.

Issuing an invoice, quote, pro forma or credit note uses the same steps. See Issue after approval.

What the person reviews

The review page names the AI connection or rule and shows the request’s status below its heading. Review the exact values first. Changed values show their old and new values together. Amounts include their currency. On/off settings show as yes or no.

Read the consequence below the values before you decide. A waiting request shows its expiry beside the decision guidance. A closed request keeps its details and status without approval buttons.

The approve button names the change, for example Record a payment. A change that cannot be undone, such as a deletion, has a red button. In Agent approvals, you can decide several waiting requests together. Manual decisions for payments, refunds, online payments, purchase payments and voids, and bank details remain one at a time.

Create an approval rule

For staff connections and automation rules, use the approval menu on the request. Customer workspace connections still require individual approval.

Open a pending request and check its exact values and consequence.
Open the approval menu and choose Approval rules.
Expand Add a rule for this action and give it a name you will recognize on receipts.
Keep This exact action, or select Invoice issue for this customer when offered.
Set the maximum uses and expiry.
For money, set Maximum per action and Total budget in the displayed currency.
Click Save rule.

Saving selects Use my rules for this source. It affects new requests. The request already waiting still needs your decision.

This exact action fixes the record, values and content shown in the request. An email rule fixes its recipients and message. Invoice issue for this customer permits invoice issue for the named customer and currency. It cannot issue quotes, pro formas or credit notes under that broader scope.

Rules support document issue, exact document emails, and exact payment or refund records. Each rule expires within 30 days and allows at most 100 uses. Money limits use exact minor units. Recording a payment or refund does not move money. Other sensitive actions, including online card refunds, deletion, exports, access changes and publication, still ask.

A rule belongs to one person and one connection or automation rule. It does not transfer to another source or add permissions. Changed access, tool definitions or an automation version invalidate the consent.

Change or stop automatic approval

The same menu offers three levels:

Ask every time: every new approval request waits for you.
Approve routine work: customer creation can pass the approval queue. In Assistant, this also permits the listed routine changes.
Use my rules: routine work plus supported sensitive actions that match your rules.

External AI clients can already make ordinary changes allowed by their grants. These levels do not add a confirmation step to ordinary API tools.

Open Approval rules to see remaining uses, expiry and reserved budget. Expand a rule and click Stop rule to revoke it. Choose Ask every time to stop automatic approval for the source.

A policy change stops approved automatic requests that have not started. It cannot recall an email or undo an action already started. Reserved uses and budget remain consumed, including after cancellation or failure, so retrying cannot silently widen consent. A backup restore keeps this evidence and returns policies to Ask every time.

How a request works

The client calls the prepare tool with the change and a new idempotency key. MCP uses <operation>_prepare, for example payments_record_prepare. HTTP uses POST /api/v1/approvals/<operation>/{id}; a change without a record has no {id}.
Pepper checks the change with the same rules as the screen and saves a summary. Nothing changes yet. The answer has HTTP 202, the approval_id, a nonce, the summary rows, expires_at and a review_url.
Pepper checks the source’s approval policy. A matching rule returns approved with automatic decision details. Otherwise, the delegated person gets an Approval item in the inbox, an in-app alert and one email with the review link. See Approval requests from AI clients.
For a pending request, the person opens the review page and checks each value, then approves or rejects the request.
The client reads the request with approvals_get. When its status is approved, the client calls the execute tool with the nonce and a new idempotency key. MCP uses the operation name, for example payments_record. HTTP uses POST /api/v1/approvals/{approval_id}/<operation>.
Pepper runs the change once, as the person, through the same action as the screen. The answer has the status executed and the result, such as the changed record or a download link.

Treat only the executed answer, or the changed record, as proof that the change happened. Approved only allows the client to run it.

Rules for every request

The connection needs the app's execute grant, for example invoices:execute, and the delegated person needs the permission in the tables below. The owner gives the grant when the connection is made. See Connect an external client.
A prepare call accepts only the arguments of its tool. Pepper refuses any other argument, such as a status.
The record must stay the same until the change runs. When someone changes it first, the request becomes out of date and nothing runs. Prepare a new request.
A role update becomes out of date if its permissions, desks or start desk change before approval or execution. Prepare it again to review the current access. The newer saved role stays unchanged.
An email or reminder goes only to the addresses the person approved. When a contact's address changes after the approval, the request is out of date (approval_stale) and nothing is sent.
A request waits for the owner's approval window, 10 minutes unless the owner changes it. An expired, rejected, cancelled or out-of-date request cannot run. A client can cancel its own request with approvals_cancel.
A repeated execute call with the same idempotency key returns the first answer and changes nothing more.
Permission and record access are checked again when the change runs. A revoked connection or a lost permission stops it.
The audit log and the record history show the change with the person and the AI connection.
An export returns a single-use link that works for five minutes. Opening it makes the file again with the person's current access.
A backup stays in Pepper. A person downloads it from Settings > Backups.

Money

Only one tool moves money: payments_online_refund refunds a card payment through Stripe after the person approves the exact amount. Pepper records the refund before it asks Stripe, so a retry with the same execute key continues the same refund and never refunds twice. Recording a payment or a refund states that money moved outside Pepper; it moves no money. Stripe keys, webhook secrets and AI provider keys are entered in Pepper only, and no tool reads or sends them.

What stays with people

No tool exists for these steps:

passwords, two-factor authentication, sessions and devices, sign-in with SSO, agent connections, grants approval levels, rules and individual approvals, and ownership transfer
installing updates, and downloading or restoring backups
steps that only a visitor can do, such as claiming an offer, reserving a booking, giving consent, answering as the customer or unsubscribing

Customer accounts

Each operation below needs customers.accounts.manage and current access to the account's Customer. The connection also needs the matching execute grant.

MCP preparation uses the listed name plus _prepare. HTTP preparation uses POST /api/v1/approvals/customer-accounts-{operation}/{id}, with hyphens replacing underscores.

Operation	Required input beyond the account ID	Result after approval and execution
`customer_accounts_disable`	`version`, `reason`	Disables access and ends sessions.
`customer_accounts_enable`	`version`, `reason`	Allows a new sign-in when the account remains eligible.
`customer_accounts_revoke_sessions`	`version`, `reason`	Ends current sessions without preventing a new sign-in.
`customer_accounts_relink`	`binding_version`, `customer_id`, `reason`	Changes the Customer for future purchases.
`customer_accounts_reverse_relink`	`binding_version`, `relink_id`, `reason`	Restores the eligible previous link.
`customer_accounts_resolve_deletion`	Request `version`, `request_id`, `status`, `reason`	Records `resolved`, `deferred` or `rejected` with a reply. It erases nothing.
`customer_accounts_export`	No additional operation fields	Creates a permitted account-data download; also requires `data.export`.

These operations cannot be approved in a batch. Changed account, binding or request versions require a new review.

The export contains account-owned profile, addresses, consent, requests and access history. It does not infer financial access from the Customer link.

Owner-confirmed account erasure uses the existing data-subject approval with an explicit account subject. A deletion-request decision is a separate action.

Approval tools by app

Each row is one change. The table shows the MCP name and title of the execute tool, the prepare tool with its HTTP path, and the permission that the delegated person needs. The execute path uses the same operation part after the approval ID. For example, POST /api/v1/approvals/payments-record/{id} prepares a payment, and POST /api/v1/approvals/{approval_id}/payments-record runs it.

Invoices

Grant: invoices:execute.

Operation	Prepare	Permission	What the person approves
`documents_delete_draft` Delete a draft	`documents_delete_draft_prepare`, `POST /api/v1/approvals/documents-delete-draft/{id}`	`invoices.manage`	Delete one draft. An issued document is never deleted; cancel it instead. Cannot be undone.
`documents_cancel` Cancel an issued document	`documents_cancel_prepare`, `POST /api/v1/approvals/documents-cancel/{id}`	`invoices.manage`	Cancel one issued document. Its number stays used and the original stays unchanged; a paid invoice or one with a credit note cannot be cancelled. Cannot be undone.
`payments_record` Record a payment	`payments_record_prepare`, `POST /api/v1/approvals/payments-record/{id}`	`invoices.manage`	Record a payment the person received on an issued invoice. It records money received; it moves no money. Decided on its own.
`payments_reverse` Reverse a payment	`payments_reverse_prepare`, `POST /api/v1/approvals/payments-reverse/{id}`	`invoices.manage`	Reverse a payment recorded by mistake. The row stays in the history. Decided on its own; cannot be undone.
`refunds_record` Record a refund	`refunds_record_prepare`, `POST /api/v1/approvals/refunds-record/{id}`	`invoices.manage`	Record a refund the person paid on an issued credit note. It records money returned; it moves no money. Decided on its own.
`refunds_reverse` Reverse a refund	`refunds_reverse_prepare`, `POST /api/v1/approvals/refunds-reverse/{id}`	`invoices.manage`	Reverse a refund recorded by mistake. The row stays in the history. Decided on its own; cannot be undone.
`quotes_accept` Record that a quote was accepted	`quotes_accept_prepare`, `POST /api/v1/approvals/quotes-accept/{id}`	`invoices.manage`	Record that the customer accepted a sent quote, with the name of the person who accepted it. A linked deal is won.
`quotes_decline` Record that a quote was declined	`quotes_decline_prepare`, `POST /api/v1/approvals/quotes-decline/{id}`	`invoices.manage`	Record that the customer declined a sent quote.
`quotes_convert` Turn a quote into an invoice draft	`quotes_convert_prepare`, `POST /api/v1/approvals/quotes-convert/{id}`	`invoices.manage`	Turn an accepted quote into an invoice draft with the same lines. Nothing is issued.
`proformas_convert` Turn a pro forma into an invoice draft	`proformas_convert_prepare`, `POST /api/v1/approvals/proformas-convert/{id}`	`invoices.manage`	Turn an issued pro forma into an invoice draft with the same lines. Nothing is issued.
`documents_send` Send a document by email	`documents_send_prepare`, `POST /api/v1/approvals/documents-send/{id}`	`invoices.manage`	Email an issued document with its PDF to the recipients the person sees in the send dialog (documents_email_draft), with this subject and text.
`documents_remind` Send a payment reminder	`documents_remind_prepare`, `POST /api/v1/approvals/documents-remind/{id}`	`invoices.manage`	Email a payment reminder for an issued invoice with a balance, to the invoice recipients, with the reminder template.
`documents_reminders_pause` Pause or resume reminders	`documents_reminders_pause_prepare`, `POST /api/v1/approvals/documents-reminders-pause/{id}`	`invoices.manage`	Pause or resume the automatic payment reminders of one invoice.
`documents_record_delivery` Record a delivery outside Pepper	`documents_record_delivery_prepare`, `POST /api/v1/approvals/documents-record-delivery/{id}`	`invoices.manage`	Record that the person delivered an issued document outside Pepper, by post, by hand or another channel. Nothing is sent.
`recurring_save` Save a recurring schedule	`recurring_save_prepare`, `POST /api/v1/approvals/recurring-save`	`invoices.manage`	Add or change a recurring invoice schedule. The person reviews exact tax choices, entered-price basis and explicit matching inputs. Saved line_id and omitted selectors retain saved policy. With auto_send it emails each new invoice to the customer.
`recurring_run` Create the next recurring invoice	`recurring_run_prepare`, `POST /api/v1/approvals/recurring-run/{id}`	`invoices.manage`	Create the next invoice of a recurring schedule now, as Generate now does. With auto_send it is issued and emailed.
`recurring_change` Pause, resume or delete a schedule	`recurring_change_prepare`, `POST /api/v1/approvals/recurring-change/{id}`	`invoices.manage`	Pause, resume or delete a recurring schedule. Invoices it already created stay. Cannot be undone.
`payments_online_enable` Switch online payments on or off	`payments_online_enable_prepare`, `POST /api/v1/approvals/payments-online-enable`	`invoices.manage`	Switch online card payments on or off with the Stripe account the owner already saved. Keys are never sent or read; the owner enters them in Pepper. Decided on its own.
`payments_online_refund` Send an online refund	`payments_online_refund_prepare`, `POST /api/v1/approvals/payments-online-refund/{id}`	`invoices.manage`	Refund money to the customer's card through Stripe for an issued credit note, up to what the card payment allows. Money moves when this runs. Each refund is approved on its own. Decided on its own.
`payments_online_check` Check an online payment with Stripe	`payments_online_check_prepare`, `POST /api/v1/approvals/payments-online-check/{id}`	`invoices.manage`	Ask Stripe again for the state of one online payment or refund attempt and record the answer. No money moves. Decided on its own.
`payments_online_recover` Link an online payment to its Stripe record	`payments_online_recover_prepare`, `POST /api/v1/approvals/payments-online-recover/{id}`	`invoices.manage`	Link an online attempt whose creation was uncertain to the Stripe record the person found, after Stripe confirms the amount and currency. No money moves. Decided on its own.

Customers

Grant: customers:execute.

Operation	Prepare	Permission	What the person approves
`customers_create` Add a customer	`customers_create_prepare`, `POST /api/v1/approvals/customers-create`	`customers.manage`	Add a customer or supplier with its tax identity, address and contact details.
`customers_update` Change a customer	`customers_update_prepare`, `POST /api/v1/approvals/customers-update/{id}`	`customers.manage`	Change a customer's identity, tax number, electronic address, addresses, language, tags or active state. Send only the fields that change. Issued documents keep the details they were issued with.
`customers_delete` Delete a customer	`customers_delete_prepare`, `POST /api/v1/approvals/customers-delete/{id}`	`customers.manage`	Delete a customer. Issued documents keep the customer details they were issued with. Cannot be undone.
`customers_contact_save` Save a customer contact	`customers_contact_save_prepare`, `POST /api/v1/approvals/customers-contact-save/{id}`	`customers.manage`	Add or change a customer contact and whether it receives invoices and reminders. Future documents go to these recipients.
`customers_contact_delete` Delete a customer contact	`customers_contact_delete_prepare`, `POST /api/v1/approvals/customers-contact-delete/{id}`	`customers.manage`	Delete a customer contact. It no longer receives documents. Cannot be undone.
`customers_suppression_add` Stop automatic messages to an address	`customers_suppression_add_prepare`, `POST /api/v1/approvals/customers-suppression-add/{id}`	`customers.manage`	Stop automatic messages (follow-ups, automatic reminders, automation sends) to a contact or to the customer's own address. A person's own send still reaches them. Lifting is a Settings operation.
`customers_contact_reorder` Reorder customer contacts	`customers_contact_reorder_prepare`, `POST /api/v1/approvals/customers-contact-reorder/{id}`	`customers.manage`	Put a customer's contacts in a new order. The first contact that receives invoices is the main recipient.
`customers_import` Import customers	`customers_import_prepare`, `POST /api/v1/approvals/customers-import`	`customers.manage`	Import up to 500 customers at once, as the import screen does after its preview. Rows with errors are reported and not saved.
`customers_export` Export customers	`customers_export_prepare`, `POST /api/v1/approvals/customers-export`	`customers.view`	Export every customer the person may see as a CSV file, through a single-use download link. Needs the data export permission. Returns a download link.
`customers_workspace_provision` Open a hosted workspace	`customers_workspace_provision_prepare`, `POST /api/v1/approvals/customers-workspace-provision/{id}`	`customers.manage`	Open a hosted workspace for a customer on a plan and invite its owner by email. For the installation operator.
`customers_workspace_plan` Put a workspace on a plan	`customers_workspace_plan_prepare`, `POST /api/v1/approvals/customers-workspace-plan/{id}`	`customers.manage`	Put a customer's hosted workspace on a plan now, or from and until a date in its time zone.
`customers_workspace_state` Change a workspace state	`customers_workspace_state_prepare`, `POST /api/v1/approvals/customers-workspace-state/{id}`	`customers.manage`	Activate, suspend, close or retain a customer's hosted workspace. Cannot be undone.
`customers_workspace_resend` Resend a workspace invitation	`customers_workspace_resend_prepare`, `POST /api/v1/approvals/customers-workspace-resend/{id}`	`customers.manage`	Send the hosted workspace's owner invitation again.
`customer_accounts_disable` Disable access	`customer_accounts_disable_prepare`, `POST /api/v1/approvals/customer-accounts-disable/{id}`	`customers.accounts.manage`	Manage this customer account through its current Customer scope. Disable and sign-out revoke sessions. Relinking changes future checkout identity only; existing purchases and issued originals stay unchanged. A deletion decision records a reply, not erasure. Decided on its own; cannot be undone.
`customer_accounts_enable` Enable access	`customer_accounts_enable_prepare`, `POST /api/v1/approvals/customer-accounts-enable/{id}`	`customers.accounts.manage`	Manage this customer account through its current Customer scope. Disable and sign-out revoke sessions. Relinking changes future checkout identity only; existing purchases and issued originals stay unchanged. A deletion decision records a reply, not erasure. Decided on its own.
`customer_accounts_revoke_sessions` Sign out everywhere	`customer_accounts_revoke_sessions_prepare`, `POST /api/v1/approvals/customer-accounts-revoke-sessions/{id}`	`customers.accounts.manage`	Manage this customer account through its current Customer scope. Disable and sign-out revoke sessions. Relinking changes future checkout identity only; existing purchases and issued originals stay unchanged. A deletion decision records a reply, not erasure. Decided on its own.
`customer_accounts_relink` Change linked Customer	`customer_accounts_relink_prepare`, `POST /api/v1/approvals/customer-accounts-relink/{id}`	`customers.accounts.manage`	Manage this customer account through its current Customer scope. Disable and sign-out revoke sessions. Relinking changes future checkout identity only; existing purchases and issued originals stay unchanged. A deletion decision records a reply, not erasure. Decided on its own; cannot be undone.
`customer_accounts_reverse_relink` Restore previous link	`customer_accounts_reverse_relink_prepare`, `POST /api/v1/approvals/customer-accounts-reverse-relink/{id}`	`customers.accounts.manage`	Manage this customer account through its current Customer scope. Disable and sign-out revoke sessions. Relinking changes future checkout identity only; existing purchases and issued originals stay unchanged. A deletion decision records a reply, not erasure. Decided on its own; cannot be undone.
`customer_accounts_resolve_deletion` Record decision	`customer_accounts_resolve_deletion_prepare`, `POST /api/v1/approvals/customer-accounts-resolve-deletion/{id}`	`customers.accounts.manage`	Manage this customer account through its current Customer scope. Disable and sign-out revoke sessions. Relinking changes future checkout identity only; existing purchases and issued originals stay unchanged. A deletion decision records a reply, not erasure. Decided on its own.
`customer_accounts_export` Export account data	`customer_accounts_export_prepare`, `POST /api/v1/approvals/customer-accounts-export/{id}`	`customers.accounts.manage`	Export account-owned profile, addresses, consent, requests and access history. Also requires data.export. No financial purchases are inferred from the Customer link. Decided on its own; returns a download link.
`customers_message_send` Send a follow-up message	`customers_message_send_prepare`, `POST /api/v1/approvals/customers-message-send`	`customers.manage`	Send one follow-up message (thanks after payment, a check-in after a project, or a welcome) to the recipient derived from a document, customer, engagement or lead: the primary billing contact, else the customer address, or the lead. The person reviews the recipient, the address, the template and the rendered text. One message per approval at most; the delivery result is reported, never promised. Decided on its own.
`account_team_invite` Invite a staff member to your account	`account_team_invite_prepare`, `POST /api/v1/approvals/account-team-invite`	``	Owners: invite one staff member by email, with all widgets or chosen widgets (account_team_widgets). The invitation email is sent after approval.
`account_team_resend` Send an account invitation again	`account_team_resend_prepare`, `POST /api/v1/approvals/account-team-resend/{id}`	``	Owners: send a pending invitation again with a new link; the previous link stops working.
`account_team_cancel` Cancel an account invitation	`account_team_cancel_prepare`, `POST /api/v1/approvals/account-team-cancel/{id}`	``	Owners: cancel a pending invitation; its link stops working. Cannot be undone.
`account_team_revoke` Remove a staff member from your account	`account_team_revoke_prepare`, `POST /api/v1/approvals/account-team-revoke/{id}`	``	Owners: remove a staff member's access to this account at once. Their other accounts are unaffected. Cannot be undone.
`account_people_export` Export your account's collected people	`account_people_export_prepare`, `POST /api/v1/approvals/account-people-export`	``	Export the collected people of this account as CSV through a single-use download link. Returns a download link.
`account_privacy_lookup` Find a person for a data request	`account_privacy_lookup_prepare`, `POST /api/v1/approvals/account-privacy-lookup`	``	Find the people this account holds for an exact email address or reference, for a data request. Nothing changes.
`account_privacy_report` Make a collected person's personal-data report	`account_privacy_report_prepare`, `POST /api/v1/approvals/account-privacy-report`	``	Make the personal-data report of one collected person of this account as a JSON file through a single-use download link. Returns a download link.
`account_privacy_erase` Erase a collected person's personal data	`account_privacy_erase_prepare`, `POST /api/v1/approvals/account-privacy-erase`	``	Erase the personal fields of one collected person of this account for a data request. Kept promises and issued originals stay. Cannot be undone.
`account_privacy_hold` Set a retention hold on a collected person	`account_privacy_hold_prepare`, `POST /api/v1/approvals/account-privacy-hold`	``	Place or lift a retention hold on one collected person of this account; a held person cannot be erased until the date.
`account_privacy_file` Download a collected person's file	`account_privacy_file_prepare`, `POST /api/v1/approvals/account-privacy-file`	``	Download one private file a collected person of this account sent, for a data request. Returns a download link.
`account_billing_pdf` Download an invoice from your provider	`account_billing_pdf_prepare`, `POST /api/v1/approvals/account-billing-pdf`	``	Download the PDF of one invoice or credit note your provider issued to this account. Returns a download link.
`account_record_file` Download a form submission file	`account_record_file_prepare`, `POST /api/v1/approvals/account-record-file`	``	Download one file attached to a form submission this account received. Returns a download link.
`account_shop_seller_save` Save your shop's business details	`account_shop_seller_save_prepare`, `POST /api/v1/approvals/account-shop-seller-save`	``	Owners: set who your shop invoices come from: legal name, address, tax number and email, and, until the first invoice, the number prefix. Later invoices use them; issued ones keep theirs. Read account_shop_setup for the version. Decided on its own.
`account_shop_tax_rate_save` Save a shop tax rate	`account_shop_tax_rate_save_prepare`, `POST /api/v1/approvals/account-shop-tax-rate-save`	``	Owners: add or change one of your own tax rates: name, exact percentage and an optional note printed on invoices. A change applies to new carts; placed orders keep their tax. Changing a rate needs its version from account_shop_setup. Decided on its own.
`account_shop_document_pdf` Download an invoice of your shop	`account_shop_document_pdf_prepare`, `POST /api/v1/approvals/account-shop-document-pdf`	``	Owners: download the original PDF of one invoice or credit note your shop issued, exactly as issued. Returns a download link.
`account_shop_export` Download your shop's invoices for a period	`account_shop_export_prepare`, `POST /api/v1/approvals/account-shop-export`	``	Owners: everything your bookkeeper needs for one period (400 days at most): a ZIP of your shop's issued originals with a documents.csv summary. Returns a download link.
`account_team_shop` Change a staff member's shop access	`account_team_shop_prepare`, `POST /api/v1/approvals/account-team-shop/{id}`	``	Owners: let one staff member pack, ship and handle returns (orders) and receive and count stock (stock) in your shop. Money, tax, invoices and exports stay yours.

Sales

Grant: crm:execute.

Operation	Prepare	Permission	What the person approves
`pipeline_stage_create` Add a pipeline stage	`pipeline_stage_create_prepare`, `POST /api/v1/approvals/pipeline-stage-create`	`crm.manage`	Add an open stage at the end of the pipeline, with its win probability and the days after which a deal in it counts as idle.
`pipeline_stage_update` Change a pipeline stage	`pipeline_stage_update_prepare`, `POST /api/v1/approvals/pipeline-stage-update/{id}`	`crm.manage`	Rename a pipeline stage or change its probability and idle days. Deals stay in it.
`pipeline_stage_reorder` Reorder pipeline stages	`pipeline_stage_reorder_prepare`, `POST /api/v1/approvals/pipeline-stage-reorder`	`crm.manage`	Put every open pipeline stage in a new order. Send each live stage ID once.
`pipeline_stage_archive` Archive a pipeline stage	`pipeline_stage_archive_prepare`, `POST /api/v1/approvals/pipeline-stage-archive/{id}`	`crm.manage`	Archive a pipeline stage. The last open stage cannot be archived. Cannot be undone.
`pipeline_reason_create` Add a lost reason	`pipeline_reason_create_prepare`, `POST /api/v1/approvals/pipeline-reason-create`	`crm.manage`	Add a lost reason that people choose when a deal is lost.
`pipeline_reason_update` Rename a lost reason	`pipeline_reason_update_prepare`, `POST /api/v1/approvals/pipeline-reason-update/{id}`	`crm.manage`	Rename a lost reason. Deals lost with it keep it.
`pipeline_reason_archive` Archive a lost reason	`pipeline_reason_archive_prepare`, `POST /api/v1/approvals/pipeline-reason-archive/{id}`	`crm.manage`	Archive a lost reason. Deals lost with it keep it. Cannot be undone.
`leads_import` Import leads	`leads_import_prepare`, `POST /api/v1/approvals/leads-import`	`crm.manage`	Import up to 500 leads at once, as the import screen does after its preview. A lead whose email is already a lead or customer is skipped.
`sales_overview_export` Export the Sales overview	`sales_overview_export_prepare`, `POST /api/v1/approvals/sales-overview-export`	`crm.manage`	Export the Sales overview for a period as a CSV file, through a single-use download link. Needs the data export permission. Returns a download link.
`leads_privacy_report` Make a lead’s personal-data report	`leads_privacy_report_prepare`, `POST /api/v1/approvals/leads-privacy-report/{id}`	`crm.manage`	Make the personal-data report of one lead, as Settings > Audit log does for a data request, as a JSON file through a single-use download link. For the owner. Returns a download link.

Projects

Grant: engagements:execute.

Operation	Prepare	Permission	What the person approves
`decisions_job_move` Move a job to another stage	`decisions_job_move_prepare`, `POST /api/v1/approvals/decisions-job-move/{id}`	`projects.manage`	Move a customer job page to its next stage. The customer is told by email.
`decisions_job_close` Close or reopen a job page	`decisions_job_close_prepare`, `POST /api/v1/approvals/decisions-job-close/{id}`	`projects.manage`	Close a customer job page when the work is done, or open it again. The customer is told by email.
`decisions_question_ask` Ask a customer a question	`decisions_question_ask_prepare`, `POST /api/v1/approvals/decisions-question-ask/{id}`	`projects.manage`	Ask the customer a question on their job page. The customer is told by email.
`decisions_question_reopen` Ask a question again	`decisions_question_reopen_prepare`, `POST /api/v1/approvals/decisions-question-reopen/{id}`	`projects.manage`	Ask the customer an answered question again, with the reason. The customer is told by email.
`decisions_remind` Remind a customer about open questions	`decisions_remind_prepare`, `POST /api/v1/approvals/decisions-remind/{id}`	`projects.manage`	Remind the customer by email about open questions or proofs on their page.
`decisions_notice_retry` Send a customer page email again	`decisions_notice_retry_prepare`, `POST /api/v1/approvals/decisions-notice-retry/{id}`	`projects.manage`	Send a customer page email again that could not be delivered.
`projects_work_settings` Change work settings	`projects_work_settings_prepare`, `POST /api/v1/approvals/projects-work-settings`	`projects.manage`	Change the task key prefix for tasks outside projects and the billing increment of tracked time. Existing keys and billed time stay.
`projects_report_export` Export a project report	`projects_report_export_prepare`, `POST /api/v1/approvals/projects-report-export`	`projects.use`	Export the unbilled-work or margin report as a CSV file, through a single-use download link. Needs the data export permission. Returns a download link.
`projects_time_export` Export tracked time	`projects_time_export_prepare`, `POST /api/v1/approvals/projects-time-export`	`projects.use`	Export the tracked-time register, or one project's time, as a CSV file, through a single-use download link. Needs the data export permission. Returns a download link.
`projects_workload_export` Export the workload	`projects_workload_export_prepare`, `POST /api/v1/approvals/projects-workload-export`	`projects.manage`	Export one week of the team's workload as a PDF, through a single-use download link. Returns a download link.

Boards

Grant: boards:execute.

Operation	Prepare	Permission	What the person approves
`boards_audience` Change who can open a board	`boards_audience_prepare`, `POST /api/v1/approvals/boards-audience/{id}`	`boards.use`	Change who can open a board: only its members, its teams or everyone in the business. The summary counts the people who gain access.
`boards_member_role` Change a board member	`boards_member_role_prepare`, `POST /api/v1/approvals/boards-member-role/{id}`	`boards.use`	Add a person to a board with a role, change their role, or remove them with role null.
`boards_join_admin` Join a board as admin	`boards_join_admin_prepare`, `POST /api/v1/approvals/boards-join-admin/{id}`	`boards.manage`	Join a board as its admin to recover it, as an installation manager can in Pepper. The board's members see that you joined.
`boards_export` Export a board	`boards_export_prepare`, `POST /api/v1/approvals/boards-export/{id}`	`boards.use`	Export a board with its lists, cards and comments as JSON or CSV, through a single-use download link. A complete JSON export is needed before boards_delete. Returns a download link.
`boards_delete` Delete a board	`boards_delete_prepare`, `POST /api/v1/approvals/boards-delete/{id}`	`boards.use`	Delete a board after a complete JSON export made in the last hour. Its files stay in Files. Cannot be undone.

Docs

Grant: docs:execute.

Operation	Prepare	Permission	What the person approves
`docs_approve` Approve edition · Docs	`docs_approve_prepare`, `POST /api/v1/approvals/docs-approve/{id}`	`docs.approve`	Approve and freeze the exact current controlled Doc edition after the person reviews its exact text, current references and version. A later edition requires an explicit recheck of the earlier edition. Decided on its own.
`docs_share` Create recipient link · Docs	`docs_share_prepare`, `POST /api/v1/approvals/docs-share/{id}`	`docs.share`	Create one expiring capability for the selected exact frozen edition after the person approves what leaves the workspace. Only the outbound response may contain an ephemeral recipient URL; generic approval results and receipts retain no capability. Decided on its own.
`docs_access` People and teams · Docs	`docs_access_prepare`, `POST /api/v1/approvals/docs-access/{id}`	`docs.manage`	Change one named person/team read/edit grant. The Doc owner, current people/team scope and linked business source remain authoritative. Decided on its own; cannot be undone.
`docs_update` Owner / Linked record · Docs	`docs_update_prepare`, `POST /api/v1/approvals/docs-update/{id}`	`docs.manage`	Change the controlled owner or business parent under the exact current writer lease and version. This can change who may access the Doc; the person reviews each changed field. Decided on its own.
`docs_writer_end` End editing session · Docs	`docs_writer_end_prepare`, `POST /api/v1/approvals/docs-writer-end/{id}`	`docs.manage`	Explicitly end the current writer lease as Doc owner. It never silently takes over a writer or changes content. Decided on its own; cannot be undone.

Signatures

Grant: signatures:execute.

Operation	Prepare	Permission	What the person approves
`signatures_send` Send request	`signatures_send_prepare`, `POST /api/v1/approvals/signatures-send/{id}`	`docs.share	invoices.manage`
`signatures_reissue` Reissue link	`signatures_reissue_prepare`, `POST /api/v1/approvals/signatures-reissue/{id}`	`docs.share	invoices.manage`

Calendar

Grant: calendar:execute.

Operation	Prepare	Permission	What the person approves
`calendar_export` Export a calendar view	`calendar_export_prepare`, `POST /api/v1/approvals/calendar-export`	`calendar.use`	Export the selected currently permitted calendar view as ICS after the person approves the named date range, timezone and source filters. Downloading checks current grants again. Decided on its own; returns a download link.
`calendar_feed_create` Create a calendar subscription	`calendar_feed_create_prepare`, `POST /api/v1/approvals/calendar-feed-create`	`calendar.use`	Create a bearer-secret calendar subscription only after the person approves its current actor, source filters and ongoing disclosure. The URL is shown once, stored only as a hash and never retained in approval results. A lost response requires revocation and a new approved subscription. Decided on its own.
`calendar_invite` Send reviewed calendar invitations	`calendar_invite_prepare`, `POST /api/v1/approvals/calendar-invite/{id}`	`calendar.use`	Approve sending the already frozen exact invitation preparation. The review names every current recipient/address, sender, event content, timing, recurrence and exception. Changed versions, addresses, sources or authority refuse. Queued/uncertain results never confirm transport acceptance. Decided on its own.
`calendar_mail_retry` Retry a calendar invitation	`calendar_mail_retry_prepare`, `POST /api/v1/approvals/calendar-mail-retry/{id}`	`calendar.use`	Explicitly retry one failed or uncertain invitation after the person reviews its immutable recipient/content, current state, lifetime attempt count and duplicate-delivery warning. An earlier uncertain attempt may already have been accepted. Never retry automatically. Decided on its own.

Automations

Grant: automations:execute.

Operation	Prepare	Permission	What the person approves
`automations_trust` Trust an automation rule	`automations_trust_prepare`, `POST /api/v1/approvals/automations-trust/{id}`	`automations.manage`	Mark an active automation rule trusted: its follow-up message and request steps then run without a per-send approval, on the authority of the person who approves this request, who must be an owner or admin (a manager alone is refused with 403 automation_trust_authority). Trust is bound to the rule version; editing, stopping or deactivating the rule clears it. Revoke with automations_trust_revoke. Decided on its own.
`automations_webhook_send` Send a reviewed webhook	`automations_webhook_send_prepare`, `POST /api/v1/approvals/automations-webhook-send/{id}`	`automations.manage`	Send the exact JSON bytes to the named public HTTPS endpoint after human approval. At most five total attempts in this approval cycle; only known retryable failures are retried. Timeout or worker uncertainty requires a new exact human review. HTTP acceptance does not confirm remote business completion. Decided on its own.
`automations_webhook_retry` Retry a reviewed webhook	`automations_webhook_retry_prepare`, `POST /api/v1/approvals/automations-webhook-retry/{id}`	`automations.manage`	Retry one rejected or unknown delivery after a new exact human review of destination, immutable JSON bytes, current state, lifetime attempts and duplicate warning. Retains the same remote delivery ID and payload; grants a new maximum-five-attempt cycle. An earlier unknown attempt may already have been accepted. Decided on its own.

Purchases

Grant: purchases:execute.

Operation	Prepare	Permission	What the person approves
`purchases_payment` Record that a purchase was paid	`purchases_payment_prepare`, `POST /api/v1/approvals/purchases-payment/{id}`	`purchases.manage`	Record that the person paid a purchase, with the date and method, or clear that record. It records money paid; it moves no money. Decided on its own.
`purchases_void` Void a purchase	`purchases_void_prepare`, `POST /api/v1/approvals/purchases-void/{id}`	`purchases.manage`	Void a purchase recorded by mistake, with a reason. It stays in the history and leaves the totals. Decided on its own; cannot be undone.
`purchases_category_create` Add a purchase category	`purchases_category_create_prepare`, `POST /api/v1/approvals/purchases-category-create`	`purchases.manage`	Add a purchase category. Needs the settings permission.
`purchases_category_update` Change a purchase category	`purchases_category_update_prepare`, `POST /api/v1/approvals/purchases-category-update/{id}`	`purchases.manage`	Rename a purchase category or switch it off. Purchases keep it.
`purchases_period_export` Export a tax period	`purchases_period_export_prepare`, `POST /api/v1/approvals/purchases-period-export`	`purchases.manage`	Export a tax period for the accountant: the PDF summary, or a ZIP with the summary, the purchases and their receipts. Through a single-use download link. Returns a download link.

Items

Grant: items:execute.

Operation	Prepare	Permission	What the person approves
`items_delete` Delete an item	`items_delete_prepare`, `POST /api/v1/approvals/items-delete/{id}`	`items.manage`	Delete a catalogue item. Documents that used it keep their lines. To keep it but hide it, archive it with items_update instead. Cannot be undone.
`items_import` Import items	`items_import_prepare`, `POST /api/v1/approvals/items-import`	`items.manage`	Import up to 500 catalogue items at once, as the import screen does after its preview. Rows with errors are reported and not saved.
`items_export` Export items	`items_export_prepare`, `POST /api/v1/approvals/items-export`	`items.view`	Export the catalogue as a CSV file, through a single-use download link. Needs the data export permission. Returns a download link.
`stock_change` Change stock	`stock_change_prepare`, `POST /api/v1/approvals/stock-change/{id}`	`items.manage`	Receive stock, append a reasoned adjustment or physical count, or restock a separately approved return. Counts change on-hand to the stated exact quantity and never overwrite holds. Inspect the exact variant, quantity, direction and reason before approval.
`catalogue_policy` Change backorder policy	`catalogue_policy_prepare`, `POST /api/v1/approvals/catalogue-policy/{id}`	`items.manage`	Owner only: allow or refuse new backorders for this product. Enabling permits reservations when physical stock is missing; it does not invent stock or permit shipping missing goods.
`catalogue_import` Import catalogue	`catalogue_import_prepare`, `POST /api/v1/approvals/catalogue-import`	`items.manage`	Atomically import product/variant CSV, up to 1000 rows and 512 KiB per agent request. Exact stock counts append differences; reservations remain. Review every proposed row. A stale product or invalid row refuses the entire import.
`catalogue_export` Export catalogue	`catalogue_export_prepare`, `POST /api/v1/approvals/catalogue-export`	`items.view`	Export up to 1000 product/variant rows and exact on-hand, reserved and available quantities. Requires data.export and returns a single-use download link. Use full portable recovery for the complete installation. Returns a download link.
`stock_alert_privacy_lookup` Find a stock-alert subscriber	`stock_alert_privacy_lookup_prepare`, `POST /api/v1/approvals/stock-alert-privacy-lookup`	`items.manage`	For the owner: find stock-alert personal records for an email address or exact alert ID. Each lookup needs approval; it creates no customer or marketing membership.
`stock_alert_privacy_report` Report a stock-alert subscriber’s data	`stock_alert_privacy_report_prepare`, `POST /api/v1/approvals/stock-alert-privacy-report`	`items.manage`	For the owner: export one stock-alert personal-data report through a scoped, single-use download. Consent and delivery history are included; private transport and withdrawal secrets are excluded. Returns a download link.
`stock_alert_privacy_erase` Erase a stock-alert subscriber’s data	`stock_alert_privacy_erase_prepare`, `POST /api/v1/approvals/stock-alert-privacy-erase`	`items.manage`	For the owner: withdraw a stock alert and erase its contact fields, exact source facts and withdrawal grant. Retain minimal consent and actual delivery outcomes. A changed reviewed record is refused. Cannot be undone.
`stock_alert_retry` Retry a stock-alert email	`stock_alert_retry_prepare`, `POST /api/v1/approvals/stock-alert-retry`	`items.manage`	For the owner: queue one deliberate retry of a known temporary stock-alert mail failure. A sent, unknown, withdrawn, expired or changed delivery is refused. The scheduler rechecks current consent, publication and stock before SMTP.

Orders

Grant: orders:execute.

Operation	Prepare	Permission	What the person approves
`orders_place` Place order	`orders_place_prepare`, `POST /api/v1/approvals/orders-place/{id}`	`orders.manage`	Place the reviewed order, reserve its tracked stock and issue its one invoice together. Current prices, destination tax, shipping and catalogue revisions must still match the exact quoted digest. This does not record payment. Decided on its own.
`orders_cancel` Cancel order	`orders_cancel_prepare`, `POST /api/v1/approvals/orders-cancel/{id}`	`orders.manage`	Cancel a wholly unshipped order with no active packing allocation. An unpaid order voids its invoice; an already fully credited and refunded order closes while retaining every issued original and money record. This creates no credit or refund. Authenticated provider recovery runs before cancellation; pending, unknown or attention outcomes retain the order and stock. Shipped orders keep their return flow. Decided on its own; cannot be undone.
`orders_remainder_release` Close unshipped remainder	`orders_remainder_release_prepare`, `POST /api/v1/approvals/orders-remainder-release/{id}`	`orders.manage`	Close the exact unshipped remainder of one tracked physical line and release its held stock once. Cancel any unshipped packing allocation first. Existing shipments and return rights stay available. Invoice amounts, credits, payments and refunds do not change. This does not assert a financial settlement. Decided on its own; cannot be undone.
`orders_payment` Record payment	`orders_payment_prepare`, `POST /api/v1/approvals/orders-payment/{id}`	`orders.manage`	Record the exact incoming money the person attests was received, through the existing invoice payment action. Review currency, amount, payment date and method. This never claims an online provider charge succeeded. Decided on its own.
`orders_shipment_create` Create fulfilment	`orders_shipment_create_prepare`, `POST /api/v1/approvals/orders-shipment-create/{id}`	`orders.manage`	Create a fulfilment for exact remaining quantities. Picking, packing and shipping are separate reviewed steps. An unpaid shipment remains visibly unpaid; this does not consume stock or claim delivery. Decided on its own.
`orders_shipment_step` Fulfilment	`orders_shipment_step_prepare`, `POST /api/v1/approvals/orders-shipment-step/{id}`	`orders.manage`	Advance this exact fulfilment through pick, pack or ship/complete. Shipping consumes held stock once and records staff handoff, never carrier delivery or payment. With a reason, cancel an unshipped allocation while retaining the order hold, or correct carrier/tracking on a shipped physical fulfilment; quantities never change. Decided on its own.
`orders_return_request` Request return	`orders_return_request_prepare`, `POST /api/v1/approvals/orders-return-request/{id}`	`orders.manage`	Request a return for no more than fulfilled quantities not already returned. Receipt, inspection, restocking, credit and refund remain separate decisions; this request performs none of them. Decided on its own.
`orders_return_step` Returns	`orders_return_step_prepare`, `POST /api/v1/approvals/orders-return-step/{id}`	`orders.manage`	Perform only the reviewed return step. Receive records arrival; inspect records condition and eligible quantity; restock separately appends eligible physical stock. Credit separately issues one credit note at original frozen prices/tax and needs invoice authority. Credit never claims refund or changes stock. Decided on its own.
`orders_delivery_grant` Create download link	`orders_delivery_grant_prepare`, `POST /api/v1/approvals/orders-delivery-grant/{id}`	`orders.manage`	Create an expiring signed link for the purchased original of a paid/free digital line and shipped fulfilment. Default seven days, maximum thirty. Renewal revokes the older grant. A retry recovers the same currently valid grant; no private file identifier or storage path is returned. Decided on its own.
`orders_delivery_revoke` Revoke download link	`orders_delivery_revoke_prepare`, `POST /api/v1/approvals/orders-delivery-revoke/{id}`	`orders.manage`	Durably revoke this order-scoped digital delivery grant. Later opens and retained agent results refuse it. This cannot recall a copy already downloaded. Decided on its own; cannot be undone.
`orders_purchase_grant` Renew customer link	`orders_purchase_grant_prepare`, `POST /api/v1/approvals/orders-purchase-grant/{id}`	`orders.manage`	Create or renew a signed customer link to this placed order and its issued invoice. Default thirty days, maximum ninety. All older purchase links are revoked. This grants no portal account, staff access or payment authority. Requires current order and invoice management access. Decided on its own.
`orders_purchase_revoke` Revoke customer link	`orders_purchase_revoke_prepare`, `POST /api/v1/approvals/orders-purchase-revoke/{id}`	`orders.manage`	Revoke this signed customer order and invoice link. Retained URLs and agent results refuse it immediately. Business records and digital delivery grants keep their separate lifecycle. Decided on its own; cannot be undone.
`orders_packing_slip` Packing slip	`orders_packing_slip_prepare`, `POST /api/v1/approvals/orders-packing-slip/{id}`	`data.export`	Export this fulfilment’s packing slip through a five-minute single-use download. It contains the frozen destination and quantities, not prices or private digital files. Current order access and data.export are checked again when downloading. Decided on its own; returns a download link.
`shipping_save` Save shipping method	`shipping_save_prepare`, `POST /api/v1/approvals/shipping-save`	`orders.manage`	Owner only: save a versioned shipping method in one fixed currency. Review exact flat/zone/band prices and tax policy. Existing accepted orders retain their own frozen rates; gaps, overlaps and ambiguous country matches refuse. Decided on its own.

Websites

Grant: websites:execute.

Operation	Prepare	Permission	What the person approves
`websites_publish` Publish website	`websites_publish_prepare`, `POST /api/v1/approvals/websites-publish/{id}`	`websites.publish`	Publish the exact saved draft at the reviewed address. Current referenced files, catalogue values, widget versions and origin rules must still match. Decided on its own.
`websites_unpublish` Withdraw website	`websites_unpublish_prepare`, `POST /api/v1/approvals/websites-unpublish/{id}`	`websites.publish`	Withdraw this website from all public addresses. The private draft and immutable history remain. Decided on its own; cannot be undone.
`websites_restore` Restore to draft	`websites_restore_prepare`, `POST /api/v1/approvals/websites-restore/{id}`	`websites.manage`	Replace the private draft with the selected immutable version as a new version. The public website stays as it is. Decided on its own; cannot be undone.
`websites_rollback` Publish this version	`websites_rollback_prepare`, `POST /api/v1/approvals/websites-rollback/{id}`	`websites.publish`	Publish the selected immutable version as a new publication at the current address. Retain all history. Decided on its own; cannot be undone.
`websites_access_grant` Change who can edit a website	`websites_access_grant_prepare`, `POST /api/v1/approvals/websites-access-grant/{id}`	``	Client account owners only: let a team member edit, or edit and publish, this site; change a grant; or withdraw any grant, a platform person's included. Withdrawal ends their access at once.
`websites_access_set` Change a person's website access	`websites_access_set_prepare`, `POST /api/v1/approvals/websites-access-set/{id}`	`websites.manage`	Set which platform websites one person reaches: all sites, or chosen sites (at least one), with edit and publish chosen separately, never above their role. The owner and administrators always reach every site. Read websites_person_access first for the version.
`websites_code_close` Close a page code	`websites_code_close_prepare`, `POST /api/v1/approvals/websites-code-close/{id}`	`websites.manage`	Close a QR code of a website. Its printed copies keep working: a scan then lands on the website's home page without the code's campaign. Cannot be undone.

Offers

Grant: offers:execute.

Operation	Prepare	Permission	What the person approves
`offers_counter_confirm` Stamp or redeem at the counter	`offers_counter_confirm_prepare`, `POST /api/v1/approvals/offers-counter-confirm`	`offers.redeem`	Stamp a card or redeem an offer for a customer at the counter, with the code they show.
`offers_counter_correct` Correct a counter visit	`offers_counter_correct_prepare`, `POST /api/v1/approvals/offers-counter-correct`	`offers.redeem`	Correct a counter stamp or redemption made by mistake, with a reason. In a client account only its owner corrects. Cannot be undone.

Listings

Grant: listings:execute.

Operation	Prepare	Permission	What the person approves
`listings_publish` Publish or withdraw a listing	`listings_publish_prepare`, `POST /api/v1/approvals/listings-publish/{id}`	`listings.manage`	Publish a listing on the listing widgets, or take it offline. Visitors see it at once.
`listings_follow_up` Follow up a listing enquiry	`listings_follow_up_prepare`, `POST /api/v1/approvals/listings-follow-up/{id}`	`listings.manage`	Move a listing enquiry to its next step, such as a viewing at a time, and email the visitor about it.
`listings_alert_privacy_lookup` Find a listing-alert subscriber	`listings_alert_privacy_lookup_prepare`, `POST /api/v1/approvals/listings-alert-privacy-lookup`	`listings.manage`	Find the collected personal records that match an email address or name, for a person's data request. For the owner.
`listings_alert_privacy_report` Report a listing-alert subscriber’s data	`listings_alert_privacy_report_prepare`, `POST /api/v1/approvals/listings-alert-privacy-report`	`listings.manage`	Make the personal-data report of one collected record as a JSON file, through a single-use download link. For the owner. Returns a download link.
`listings_alert_privacy_erase` Erase a listing-alert subscriber’s data	`listings_alert_privacy_erase_prepare`, `POST /api/v1/approvals/listings-alert-privacy-erase`	`listings.manage`	Erase the personal fields of one collected record for a person's data request. The record stays as an anonymous entry. For the owner. Cannot be undone.

Bookings

Grant: bookings:execute.

Operation	Prepare	Permission	What the person approves
`bookings_change` Change a booking	`bookings_change_prepare`, `POST /api/v1/approvals/bookings-change/{id}`	`bookings.manage`	Reschedule a booking, cancel it with a reason, or record that it was completed or a no-show. The customer gets the usual booking email.
`bookings_mail_retry` Send a booking email again	`bookings_mail_retry_prepare`, `POST /api/v1/approvals/bookings-mail-retry`	`bookings.manage`	Send a booking email again that could not be delivered.

Content

Grant: content:execute.

Operation	Prepare	Permission	What the person approves
`content_request_send` Send a content request	`content_request_send_prepare`, `POST /api/v1/approvals/content-request-send/{id}`	`content.manage`	Email a customer a personal link to approve a case, read an update or acknowledge a guide. In a client account the recipient is one of its collected people.
`content_subscriber_privacy_lookup` Find a content subscriber	`content_subscriber_privacy_lookup_prepare`, `POST /api/v1/approvals/content-subscriber-privacy-lookup`	`content.manage`	Find the collected personal records that match an email address or name, for a person's data request. For the owner.
`content_subscriber_privacy_report` Report a content subscriber’s data	`content_subscriber_privacy_report_prepare`, `POST /api/v1/approvals/content-subscriber-privacy-report`	`content.manage`	Make the personal-data report of one collected record as a JSON file, through a single-use download link. For the owner. Returns a download link.
`content_subscriber_privacy_erase` Erase a content subscriber’s data	`content_subscriber_privacy_erase_prepare`, `POST /api/v1/approvals/content-subscriber-privacy-erase`	`content.manage`	Erase the personal fields of one collected record for a person's data request. The record stays as an anonymous entry. For the owner. Cannot be undone.

Analytics

Grant: analytics:execute.

Operation	Prepare	Permission	What the person approves
`analytics_website` Add an analytics website	`analytics_website_prepare`, `POST /api/v1/approvals/analytics-website`	`analytics.manage`	Add a website whose pages may count analytics. It gets its own public site key.
`analytics_page` Approve an analytics page	`analytics_page_prepare`, `POST /api/v1/approvals/analytics-page`	`analytics.manage`	Approve a page path of a website for analytics counts.
`analytics_campaign` Add an analytics campaign	`analytics_campaign_prepare`, `POST /api/v1/approvals/analytics-campaign`	`analytics.manage`	Add a named campaign with approved tags. Supply site_id for a Pepper website or website_id for an external analytics origin, never both. Pepper sites also require websites.manage.
`analytics_export` Export analytics	`analytics_export_prepare`, `POST /api/v1/approvals/analytics-export`	`analytics.view`	Export the analytics report for a period as a CSV file, through a single-use download link. Returns a download link.

Reports

Grant: reports:execute.

Operation	Prepare	Permission	What the person approves
`reports_tax_export` Export the tax report	`reports_tax_export_prepare`, `POST /api/v1/approvals/reports-tax-export`	`data.export`	Export the tax report for a period and currency as a CSV file, through a single-use download link. Returns a download link.
`reports_aging_export` Export the aging report	`reports_aging_export_prepare`, `POST /api/v1/approvals/reports-aging-export`	`data.export`	Export the aging report in one currency as a CSV file, through a single-use download link. Returns a download link.
`reports_statement_export` Export a customer statement	`reports_statement_export_prepare`, `POST /api/v1/approvals/reports-statement-export`	`data.export`	Export a customer statement for a period and currency as a CSV file, through a single-use download link. Returns a download link.
`reports_invoices_export` Export invoices	`reports_invoices_export_prepare`, `POST /api/v1/approvals/reports-invoices-export`	`data.export`	Export the invoices of a period as a CSV file, through a single-use download link. Returns a download link.
`reports_money_export` Export the Money overview	`reports_money_export_prepare`, `POST /api/v1/approvals/reports-money-export`	`data.export`	Export the Money overview with the same filters as reports_money as a CSV file, through a single-use download link. Returns a download link.

Files

Grant: files:execute.

Operation	Prepare	Permission	What the person approves
`files_share` Make a share link	`files_share_prepare`, `POST /api/v1/approvals/files-share/{id}`	`files.share`	Make a public share link for a file that anyone with the link can open until it expires. A password is set in Pepper only.

People

Grant: people:execute.

Operation	Prepare	Permission	What the person approves
`people_invite` Invite a person	`people_invite_prepare`, `POST /api/v1/approvals/people-invite`	`people.manage`	Invite a person by email to join with a role, or as a guest with chosen apps and records. They set their own password.
`people_invitation_resend` Resend an invitation	`people_invitation_resend_prepare`, `POST /api/v1/approvals/people-invitation-resend/{id}`	`people.manage`	Send an open invitation again with a new link.
`people_invitation_revoke` Revoke an invitation	`people_invitation_revoke_prepare`, `POST /api/v1/approvals/people-invitation-revoke/{id}`	`people.manage`	Revoke an open invitation. Its link stops working. Cannot be undone.
`people_role` Change a person’s role	`people_role_prepare`, `POST /api/v1/approvals/people-role/{id}`	`people.manage`	Change a person's role, and optionally their language and time zone. The owner's role does not change here.
`people_guest_scope` Change a guest’s access	`people_guest_scope_prepare`, `POST /api/v1/approvals/people-guest-scope/{id}`	`people.manage`	Set which apps and records a guest can open.
`people_deactivate` Deactivate a person	`people_deactivate_prepare`, `POST /api/v1/approvals/people-deactivate/{id}`	`people.manage`	Deactivate a person. They are signed out and cannot sign in; their records stay. Cannot be undone.
`people_reactivate` Reactivate a person	`people_reactivate_prepare`, `POST /api/v1/approvals/people-reactivate/{id}`	`people.manage`	Let a deactivated person sign in again with their former role.
`people_offboard` Offboard a person	`people_offboard_prepare`, `POST /api/v1/approvals/people-offboard/{id}`	`people.manage`	Offboard a person: hand their open work to a successor and deactivate them. people_offboard_preview shows what moves. Cannot be undone.
`people_delete` Delete a person	`people_delete_prepare`, `POST /api/v1/approvals/people-delete/{id}`	`people.manage`	Delete a person who never did any work. Someone with records is offboarded instead. Cannot be undone.
`teams_save` Save a team	`teams_save_prepare`, `POST /api/v1/approvals/teams-save`	`people.manage`	Add a team or change its name, description, members and lead. Members gain or lose the team's shared access.
`teams_archive` Archive or restore a team	`teams_archive_prepare`, `POST /api/v1/approvals/teams-archive/{id}`	`people.manage`	Archive a team or restore it.
`people_rate` Set a person’s rate	`people_rate_prepare`, `POST /api/v1/approvals/people-rate/{id}`	`people.manage`	Set a person's cost or billable hourly rate from a date. Earlier time keeps its rate.
`people_time_off` Record time off	`people_time_off_prepare`, `POST /api/v1/approvals/people-time-off/{id}`	`people.manage`	Record a person's time off. Workload and planning leave those days free.
`people_time_off_remove` Remove time off	`people_time_off_remove_prepare`, `POST /api/v1/approvals/people-time-off-remove/{id}`	`people.manage`	Remove recorded time off. Cannot be undone.
`people_desks` Assign a person’s desks	`people_desks_prepare`, `POST /api/v1/approvals/people-desks/{id}`	`people.manage`	Give a person their own desks or return to their role. Changing the list signs the person out and revokes agent connections. Owners and administrators cannot be limited.

Forms

Grant: forms:execute.

Operation	Prepare	Permission	What the person approves
`widgets_publish` Publish or withdraw a widget	`widgets_publish_prepare`, `POST /api/v1/approvals/widgets-publish/{id}`	`bookings.manage	content.manage
`widgets_placement_close` Close a placement	`widgets_placement_close_prepare`, `POST /api/v1/approvals/widgets-placement-close/{id}`	`bookings.manage	content.manage
`widgets_visitor_settings_widen` Open the visitor door to visitors' agents	`widgets_visitor_settings_widen_prepare`, `POST /api/v1/approvals/widgets-visitor-settings-widen`	`settings.manage`	Open the visitor door, or some of its widget families, to visitors' AI agents. Their agents can then read the published widgets of those families and act on them as a visitor would, at once. A change that only closes needs no approval: use widgets.visitor_settings.save. Decided on its own.
`widgets_placement_set_undo` Undo a placement set	`widgets_placement_set_undo_prepare`, `POST /api/v1/approvals/widgets-placement-set-undo/{id}`	`bookings.manage	content.manage
`people_card_invite` Invite a person to publish a business card	`people_card_invite_prepare`, `POST /api/v1/approvals/people-card-invite/{id}`	`people.manage`	Invite one person who has not published a business card to publish their own card, once: an inbox notice and one email. The person still publishes their own card.
`widgets_wallet_change` Switch or remove a wallet platform	`widgets_wallet_change_prepare`, `POST /api/v1/approvals/widgets-wallet-change`	`settings.manage`	Switch Apple Wallet or Google Wallet passes for business cards on or off, or remove that platform's credentials. Switching off or removing revokes the passes of that platform. The person reviews the fields a pass discloses before switching on. Decided on its own; cannot be undone.
`forms_publish` Publish or withdraw a form	`forms_publish_prepare`, `POST /api/v1/approvals/forms-publish/{id}`	`forms.manage`	Publish a form for its audience, or take it offline.
`widgets_request_send` Send a response request	`widgets_request_send_prepare`, `POST /api/v1/approvals/widgets-request-send/{id}`	`forms.manage`	Email a customer a personal link to give a testimonial, feedback or answers on this widget. A feedback request names the closed project or completed booking it is about (source_type and source_id). In a client account, customer_id is one of the account's collected people (a lead).
`widgets_testimonial_moderate` Show or hide a testimonial	`widgets_testimonial_moderate_prepare`, `POST /api/v1/approvals/widgets-testimonial-moderate/{id}`	`forms.manage`	Show a customer's testimonial on the public wall, or hide it, and set its place. The customer's consent still applies.
`forms_submissions_export` Export form submissions	`forms_submissions_export_prepare`, `POST /api/v1/approvals/forms-submissions-export`	`forms.manage`	Export chosen form submissions as a CSV file, through a single-use download link. Needs the data export permission. Returns a download link.
`widgets_launchers_save` Save a widget launcher	`widgets_launchers_save_prepare`, `POST /api/v1/approvals/widgets-launchers-save`	`forms.manage`	Create or change one launcher and its exact ordered widget choices. Name is the button text; each optional choice label falls back to the saved widget name. Saving closes publication; publish separately after the read-only preview. The approval names the allowed website and each selected service.
`widgets_launchers_publish` Publish or close a widget launcher	`widgets_launchers_publish_prepare`, `POST /api/v1/approvals/widgets-launchers-publish/{id}`	`forms.manage`	Publish or close this exact launcher. Publishing makes the currently eligible services available immediately; closing keeps its configuration and returns an unavailable state on its link.
`widgets_launchers_delete` Remove a widget launcher	`widgets_launchers_delete_prepare`, `POST /api/v1/approvals/widgets-launchers-delete/{id}`	`forms.manage`	Remove this launcher and close its public link. Its widgets and their customer records are retained. This cannot be undone. Cannot be undone.

Settings

Grant: settings:execute.

Operation	Prepare	Permission	What the person approves
`settings_save` Change settings	`settings_save_prepare`, `POST /api/v1/approvals/settings-save`	`settings.manage`	Change settings in one group: company identity, address and tax registration, invoicing defaults, language and formats, PDF, the sender name and address, reminders or file limits. The logo is set in Pepper.
`settings_reset` Reset a settings section	`settings_reset_prepare`, `POST /api/v1/approvals/settings-reset`	`settings.manage`	Reset one settings section to its factory values. Cannot be undone.
`settings_number_sequence` Change a number sequence	`settings_number_sequence_prepare`, `POST /api/v1/approvals/settings-number-sequence/{id}`	`settings.manage`	Change the number pattern of a document type. Issued numbers never change; a next number below one already used is refused.
`settings_role_save` Save a role	`settings_role_save_prepare`, `POST /api/v1/approvals/settings-role-save`	`users.manage`	Save a custom role or change any role’s desks and start desk. Built-in permissions stay fixed. Desk-list changes sign out affected people; start-only changes do not.
`settings_role_delete` Delete a role	`settings_role_delete_prepare`, `POST /api/v1/approvals/settings-role-delete/{id}`	`users.manage`	Delete a custom role that nobody holds. Cannot be undone.
`settings_tax_create` Add a tax rate	`settings_tax_create_prepare`, `POST /api/v1/approvals/settings-tax-create`	`settings.manage`	Add a tax rate that documents can use. Issued documents keep the rate they were issued with.
`settings_tax_update` Change a tax rate	`settings_tax_update_prepare`, `POST /api/v1/approvals/settings-tax-update/{id}`	`settings.manage`	Change a tax rate's name, category, default or active state. Supply its displayed version from settings_tax_catalog. Saved documents keep their tax choices.
`settings_tax_reorder` Move a tax rate	`settings_tax_reorder_prepare`, `POST /api/v1/approvals/settings-tax-reorder/{id}`	`settings.manage`	Move a tax rate up or down in the list people choose from. Supply its displayed version from settings_tax_catalog.
`settings_tax_delete` Remove tax rate	`settings_tax_delete_prepare`, `POST /api/v1/approvals/settings-tax-delete/{id}`	`settings.manage`	Delete an unused tax rate; retire a referenced one without removing its evidence. Supply its displayed version from settings_tax_catalog. Cannot be undone.
`settings_item_category_create` Add an item category	`settings_item_category_create_prepare`, `POST /api/v1/approvals/settings-item-category-create`	`settings.manage`	Add an item category.
`settings_item_category_update` Change an item category	`settings_item_category_update_prepare`, `POST /api/v1/approvals/settings-item-category-update/{id}`	`settings.manage`	Rename an item category or switch it off. Items keep it.
`settings_email_template` Change an email template	`settings_email_template_prepare`, `POST /api/v1/approvals/settings-email-template/{id}`	`settings.manage`	Change the subject and text of one email template in one language. Use the template variables Pepper lists.
`settings_email_template_reset` Reset an email template	`settings_email_template_reset_prepare`, `POST /api/v1/approvals/settings-email-template-reset/{id}`	`settings.manage`	Put one email template back to Pepper's default text. Cannot be undone.
`settings_suppression_lift` Lift a blocked address	`settings_suppression_lift_prepare`, `POST /api/v1/approvals/settings-suppression-lift/{id}`	`settings.manage`	Lift a blocked address so Pepper sends to it again. The ledger keeps the row as lifted, with who lifted it and when.
`settings_bank_create` Add a bank account	`settings_bank_create_prepare`, `POST /api/v1/approvals/settings-bank-create`	`settings.manage`	Add a bank account that invoices show for payment. Each bank change is approved on its own. Decided on its own.
`settings_bank_update` Change a bank account	`settings_bank_update_prepare`, `POST /api/v1/approvals/settings-bank-update/{id}`	`settings.manage`	Change a bank account, or make it the default. Invoices issued before keep the details they were issued with. Each bank change is approved on its own. Decided on its own.
`backups_create` Make a backup	`backups_create_prepare`, `POST /api/v1/approvals/backups-create`	`settings.manage`	Make a full encrypted backup now. A person downloads it from Settings > Backups; the file never leaves Pepper through an AI client.
`backups_delete` Delete a backup	`backups_delete_prepare`, `POST /api/v1/approvals/backups-delete`	`settings.manage`	Delete one backup file. Cannot be undone.
`backups_schedule` Set the backup schedule	`backups_schedule_prepare`, `POST /api/v1/approvals/backups-schedule`	`settings.manage`	Set how often Pepper makes a backup and how many it keeps.
`intelligence_save` Change the AI suggestion settings	`intelligence_save_prepare`, `POST /api/v1/approvals/intelligence-save`	`settings.manage`	Switch the optional AI suggestions on or off, choose the features and set the daily limits. The provider key is entered in Pepper only.
`intelligence_test` Test the AI provider connection	`intelligence_test_prepare`, `POST /api/v1/approvals/intelligence-test`	`settings.manage`	Send one synthetic test to the AI provider with the saved key, as Test connection does. It counts toward the daily limit.
`workspaces_plan_save` Save a workspace plan	`workspaces_plan_save_prepare`, `POST /api/v1/approvals/workspaces-plan-save`	`settings.manage`	Add a hosted workspace plan, or save a new version of one. Workspaces on an earlier version keep it until moved.
`audit_export` Export the audit trail	`audit_export_prepare`, `POST /api/v1/approvals/audit-export`	`settings.manage`	Make a signed export of the audit trail with its checks, as a ZIP through a single-use download link. Returns a download link.
`audit_retention_save` Change the audit retention	`audit_retention_save_prepare`, `POST /api/v1/approvals/audit-retention-save`	`settings.manage`	Set how many days each class of audit events is kept, at least 365. Financial events are kept as the law requires.
`audit_prune` Remove expired audit events	`audit_prune_prepare`, `POST /api/v1/approvals/audit-prune`	`settings.manage`	Remove the audit events older than their retention now, as the nightly job does. The chain stays verifiable. Cannot be undone.
`audit_subject_report` Make a personal-data report	`audit_subject_report_prepare`, `POST /api/v1/approvals/audit-subject-report`	`settings.manage`	Make the personal-data report of one explicitly selected subject (customer, contact, lead, offer_member or customer_account) as a JSON file through a single-use download link. Customer accounts require current account-management access; choosing a Customer never grants access to other accounts. For the owner. Returns a download link.
`audit_subject_erase` Erase personal data	`audit_subject_erase_prepare`, `POST /api/v1/approvals/audit-subject-erase`	`settings.manage`	Erase the personal fields of one person record for a data request. Issued originals and financial figures stay. For the owner. Cannot be undone.
`settings_tax_class_create` Add tax class	`settings_tax_class_create_prepare`, `POST /api/v1/approvals/settings-tax-class-create`	`settings.manage`	Create an owner-configured tax class. Review the exact fields and current version. Saved document tax choices and originals stay unchanged. No jurisdiction is inferred.
`settings_tax_class_update` Edit tax class	`settings_tax_class_update_prepare`, `POST /api/v1/approvals/settings-tax-class-update/{id}`	`settings.manage`	Update an owner-configured tax class. Review the exact fields and current version. Saved document tax choices and originals stay unchanged. No jurisdiction is inferred.
`settings_tax_class_retire` Retire tax class	`settings_tax_class_retire_prepare`, `POST /api/v1/approvals/settings-tax-class-retire/{id}`	`settings.manage`	Retire an owner-configured tax class. Review the exact fields and current version. Saved document tax choices and originals stay unchanged. No jurisdiction is inferred. Cannot be undone.
`settings_tax_rule_create` Add tax rule	`settings_tax_rule_create_prepare`, `POST /api/v1/approvals/settings-tax-rule-create`	`settings.manage`	Create an owner-configured tax rule. Review the exact fields and current version. Saved document tax choices and originals stay unchanged. No jurisdiction is inferred.
`settings_tax_rule_update` Edit tax rule	`settings_tax_rule_update_prepare`, `POST /api/v1/approvals/settings-tax-rule-update/{id}`	`settings.manage`	Update an owner-configured tax rule. Review the exact fields and current version. Saved document tax choices and originals stay unchanged. No jurisdiction is inferred.
`settings_tax_rule_retire` Retire tax rule	`settings_tax_rule_retire_prepare`, `POST /api/v1/approvals/settings-tax-rule-retire/{id}`	`settings.manage`	Retire an owner-configured tax rule. Review the exact fields and current version. Saved document tax choices and originals stay unchanged. No jurisdiction is inferred. Cannot be undone.
`desks_update` Arrange a desk	`desks_update_prepare`, `POST /api/v1/approvals/desks-update/{id}`	`settings.manage`	Arrange an existing desk. Entries are its Pages. Reset restores default pages and clears the custom name. Page changes affect access, sign out assigned people and revoke agent connections, except owners, administrators and people with Everything. Everything cannot be renamed or arranged.