> For the complete documentation index, see [llms.txt](https://timechain.gitbook.io/neucron/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://timechain.gitbook.io/neucron/api-references/intent-approvals-and-policy.md).

# Intent, Approvals & Policy

MFA and approval gates for sensitive actions, plus spending / whitelist policies.

* Authorize intents (OTP, password, passkey)
* Approvals queue
* Create & update policies

## Get Approvals

> List pending approval intents for the current user/business.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Intent, Approvals & Policy","description":"MFA and approval gates for sensitive actions, plus spending / whitelist policies.\n\n- Authorize intents (OTP, password, passkey)\n- Approvals queue\n- Create & update policies"}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[{"BearerAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Access token from `POST /auth/login` or `POST /auth/signup`. Also send header `X-Identifier: NEUCRON`. For business APIs, include `X-Neucron-Business-ID`."}}},"paths":{"/intent/approvals":{"get":{"tags":["Intent, Approvals & Policy"],"summary":"Get Approvals","description":"List pending approval intents for the current user/business.","operationId":"intent-policy_get_approvals","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"array","items":{"type":"object","additionalProperties":true}}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}]}}}}
```

## Authorize Approval

> Approve or decline an approval-type intent.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Intent, Approvals & Policy","description":"MFA and approval gates for sensitive actions, plus spending / whitelist policies.\n\n- Authorize intents (OTP, password, passkey)\n- Approvals queue\n- Create & update policies"}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[{"BearerAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Access token from `POST /auth/login` or `POST /auth/signup`. Also send header `X-Identifier: NEUCRON`. For business APIs, include `X-Neucron-Business-ID`."}}},"paths":{"/intent/{intentId}/authorize":{"post":{"tags":["Intent, Approvals & Policy"],"summary":"Authorize Approval","description":"Approve or decline an approval-type intent.","operationId":"intent-policy_authorize_approval","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"intentId","in":"path","required":true,"description":"Intent ID.","schema":{"type":"string"}},{"name":"intentID","in":"query","required":false,"description":"Intent ID (query form used by some clients).","schema":{"type":"string"}},{"name":"type","in":"query","required":true,"description":"Use `approval` or `mfa`.","schema":{"type":"string"}},{"name":"method","in":"query","required":false,"description":"MFA method when type is `mfa`.","schema":{"type":"string"}},{"name":"requestID","in":"query","required":false,"description":"Passkey/OTP request ID when required.","schema":{"type":"string"}},{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":true,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","properties":{"action":{"type":"string","description":"`APPROVED` / `DECLINED` (approvals) or MFA action."},"otp":{"type":"string","description":"OTP code for MFA."},"password":{"type":"string","description":"Password for MFA."},"requestID":{"type":"string","description":"Request ID for passkey MFA."}}}}}}}}}}
```

## Get Intent State

> Get current state of an intent (MFA / approval progress).

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Intent, Approvals & Policy","description":"MFA and approval gates for sensitive actions, plus spending / whitelist policies.\n\n- Authorize intents (OTP, password, passkey)\n- Approvals queue\n- Create & update policies"}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[{"BearerAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Access token from `POST /auth/login` or `POST /auth/signup`. Also send header `X-Identifier: NEUCRON`. For business APIs, include `X-Neucron-Business-ID`."}}},"paths":{"/intent/{intentId}":{"get":{"tags":["Intent, Approvals & Policy"],"summary":"Get Intent State","description":"Get current state of an intent (MFA / approval progress).","operationId":"intent-policy_get_intent_state","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"intentId","in":"path","required":true,"description":"Intent ID.","schema":{"type":"string"}},{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}]}}}}
```

## Get Policy

> Fetch intent/spending policies for the business.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Intent, Approvals & Policy","description":"MFA and approval gates for sensitive actions, plus spending / whitelist policies.\n\n- Authorize intents (OTP, password, passkey)\n- Approvals queue\n- Create & update policies"}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[{"BearerAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Access token from `POST /auth/login` or `POST /auth/signup`. Also send header `X-Identifier: NEUCRON`. For business APIs, include `X-Neucron-Business-ID`."}}},"paths":{"/intent/policy":{"get":{"tags":["Intent, Approvals & Policy"],"summary":"Get Policy","description":"Fetch intent/spending policies for the business.","operationId":"intent-policy_get_policy","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"array","items":{"type":"object","additionalProperties":true}}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"scope","in":"query","required":false,"description":"Policy scope filter.","schema":{"type":"string"}},{"name":"enabled","in":"query","required":false,"description":"Filter by enabled flag.","schema":{"type":"boolean"}},{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}]}}}}
```

## Create Policy

> Create a new intent/spending policy.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Intent, Approvals & Policy","description":"MFA and approval gates for sensitive actions, plus spending / whitelist policies.\n\n- Authorize intents (OTP, password, passkey)\n- Approvals queue\n- Create & update policies"}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[{"BearerAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Access token from `POST /auth/login` or `POST /auth/signup`. Also send header `X-Identifier: NEUCRON`. For business APIs, include `X-Neucron-Business-ID`."}}},"paths":{"/intent/policy":{"post":{"tags":["Intent, Approvals & Policy"],"summary":"Create Policy","description":"Create a new intent/spending policy.","operationId":"intent-policy_create_policy","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":true,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","properties":{"policy":{"type":"object","additionalProperties":true,"description":"Policy definition payload."}},"required":["policy"]}}}}}}}}
```

## Update Policy

> Update an existing policy.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Intent, Approvals & Policy","description":"MFA and approval gates for sensitive actions, plus spending / whitelist policies.\n\n- Authorize intents (OTP, password, passkey)\n- Approvals queue\n- Create & update policies"}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[{"BearerAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Access token from `POST /auth/login` or `POST /auth/signup`. Also send header `X-Identifier: NEUCRON`. For business APIs, include `X-Neucron-Business-ID`."}}},"paths":{"/intent/policy/{policyId}":{"put":{"tags":["Intent, Approvals & Policy"],"summary":"Update Policy","description":"Update an existing policy.","operationId":"intent-policy_update_policy","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"policyId","in":"path","required":true,"description":"Policy ID.","schema":{"type":"string"}},{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":true,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","properties":{"policy":{"type":"object","additionalProperties":true,"description":"Updated policy fields."}},"required":["policy"]}}}}}}}}
```

## Update Whitelist Entry Status

> Enable or disable a whitelist entry.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Intent, Approvals & Policy","description":"MFA and approval gates for sensitive actions, plus spending / whitelist policies.\n\n- Authorize intents (OTP, password, passkey)\n- Approvals queue\n- Create & update policies"}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[{"BearerAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Access token from `POST /auth/login` or `POST /auth/signup`. Also send header `X-Identifier: NEUCRON`. For business APIs, include `X-Neucron-Business-ID`."}}},"paths":{"/intent/whitelist/{entryId}":{"put":{"tags":["Intent, Approvals & Policy"],"summary":"Update Whitelist Entry Status","description":"Enable or disable a whitelist entry.","operationId":"intent-policy_update_whitelist_entry_status","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"entryId","in":"path","required":true,"description":"Whitelist entry ID.","schema":{"type":"string"}},{"name":"status","in":"query","required":true,"description":"New status.","schema":{"type":"string"}},{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":false,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}}}
```