Approve or decline a suspended tool call

curl --request POST \
  --url https://neo.api.projectdiscovery.io/api/v1/tasks/{id}/approve \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "decision": "decline",
  "metadata": {
    "feedback": "Prioritize the authentication flow and add rollback steps."
  },
  "tool_call_id": "call_plan_review_123"
}
'

import requests

url = "https://neo.api.projectdiscovery.io/api/v1/tasks/{id}/approve"

payload = {
    "decision": "decline",
    "metadata": { "feedback": "Prioritize the authentication flow and add rollback steps." },
    "tool_call_id": "call_plan_review_123"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    decision: 'decline',
    metadata: {feedback: 'Prioritize the authentication flow and add rollback steps.'},
    tool_call_id: 'call_plan_review_123'
  })
};

fetch('https://neo.api.projectdiscovery.io/api/v1/tasks/{id}/approve', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://neo.api.projectdiscovery.io/api/v1/tasks/{id}/approve",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'decision' => 'decline',
    'metadata' => [
        'feedback' => 'Prioritize the authentication flow and add rollback steps.'
    ],
    'tool_call_id' => 'call_plan_review_123'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://neo.api.projectdiscovery.io/api/v1/tasks/{id}/approve"

	payload := strings.NewReader("{\n  \"decision\": \"decline\",\n  \"metadata\": {\n    \"feedback\": \"Prioritize the authentication flow and add rollback steps.\"\n  },\n  \"tool_call_id\": \"call_plan_review_123\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://neo.api.projectdiscovery.io/api/v1/tasks/{id}/approve")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"decision\": \"decline\",\n  \"metadata\": {\n    \"feedback\": \"Prioritize the authentication flow and add rollback steps.\"\n  },\n  \"tool_call_id\": \"call_plan_review_123\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://neo.api.projectdiscovery.io/api/v1/tasks/{id}/approve")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"decision\": \"decline\",\n  \"metadata\": {\n    \"feedback\": \"Prioritize the authentication flow and add rollback steps.\"\n  },\n  \"tool_call_id\": \"call_plan_review_123\"\n}"

response = http.request(request)
puts response.read_body

{
  "success": true,
  "code": "approval_target_mismatch",
  "error": "<string>",
  "stream_id": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "turnstile_site_key": "<string>"
}

Tasks

Approve or decline a suspended tool call

Submits an approval decision for a task whose agent stream is suspended waiting for user input (for example, plan_review or ask_question).

approve: for plan_review, executes the approved plan and continues in the same task stream.
decline: for plan_review, requests a revision rather than cancelling the task. Interactive clients should send the pending tool_call_id as correlation/reconciliation metadata and provide revision guidance in metadata.feedback. The planner resumes all suspended iterations with that feedback and creates a revised plan that is also approval-gated. Interactive clients should require metadata.feedback to be a string whose trimmed value is non-empty.
ask_question: continues to accept answers in metadata.answers.

To cancel the task terminally, use POST /api/v1/tasks/{id}/abort; a plan_review decline is not terminal cancellation.

For suspended streams, the endpoint atomically transitions the stream from suspended to resuming (CAS guard) to prevent double-approve. When the pending approval target is available, tool_call_id must exactly match it and is validated in the same atomic transition; mismatches are rejected. Legacy suspended tasks without a stored target may still resume without this check. For active streams with in-tool timeout approval (ask_question), the endpoint forwards the decision to the Bun agent’s in-memory waiter.

Agent-side failures, including an approval target mismatch detected after forwarding, are returned with HTTP 200 and {success: false, error: "..."} so clients can inspect the response body. HTTP 409 is reserved for the pre-forward no pending approval guard.

POST

api

tasks

{id}

approve

Approve or decline a suspended tool call

curl --request POST \
  --url https://neo.api.projectdiscovery.io/api/v1/tasks/{id}/approve \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "decision": "decline",
  "metadata": {
    "feedback": "Prioritize the authentication flow and add rollback steps."
  },
  "tool_call_id": "call_plan_review_123"
}
'

import requests

url = "https://neo.api.projectdiscovery.io/api/v1/tasks/{id}/approve"

payload = {
    "decision": "decline",
    "metadata": { "feedback": "Prioritize the authentication flow and add rollback steps." },
    "tool_call_id": "call_plan_review_123"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    decision: 'decline',
    metadata: {feedback: 'Prioritize the authentication flow and add rollback steps.'},
    tool_call_id: 'call_plan_review_123'
  })
};

fetch('https://neo.api.projectdiscovery.io/api/v1/tasks/{id}/approve', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://neo.api.projectdiscovery.io/api/v1/tasks/{id}/approve",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'decision' => 'decline',
    'metadata' => [
        'feedback' => 'Prioritize the authentication flow and add rollback steps.'
    ],
    'tool_call_id' => 'call_plan_review_123'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://neo.api.projectdiscovery.io/api/v1/tasks/{id}/approve"

	payload := strings.NewReader("{\n  \"decision\": \"decline\",\n  \"metadata\": {\n    \"feedback\": \"Prioritize the authentication flow and add rollback steps.\"\n  },\n  \"tool_call_id\": \"call_plan_review_123\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://neo.api.projectdiscovery.io/api/v1/tasks/{id}/approve")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"decision\": \"decline\",\n  \"metadata\": {\n    \"feedback\": \"Prioritize the authentication flow and add rollback steps.\"\n  },\n  \"tool_call_id\": \"call_plan_review_123\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://neo.api.projectdiscovery.io/api/v1/tasks/{id}/approve")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"decision\": \"decline\",\n  \"metadata\": {\n    \"feedback\": \"Prioritize the authentication flow and add rollback steps.\"\n  },\n  \"tool_call_id\": \"call_plan_review_123\"\n}"

response = http.request(request)
puts response.read_body

{
  "success": true,
  "code": "approval_target_mismatch",
  "error": "<string>",
  "stream_id": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "turnstile_site_key": "<string>"
}

Authorizations

Authorization

string

header

required

JWT authentication token

Path Parameters

string<uuid>

required

Task ID

Body

application/json

Decision payload for a pending tool call. For plan_review, approve executes the approved plan in the same task stream, while decline asks the planner to revise it using metadata.feedback. The revised plan requires approval again. Terminal task cancellation uses the task abort endpoint instead. ask_question answers remain supported in metadata.answers.

decision

enum<string>

required

Whether to approve or decline the pending tool call. Declining a plan_review requests a revision; it does not cancel the task.

Available options:

approve,

decline

agent_id

string

Agent ID to resume (optional, resolved from stream metadata if omitted)

metadata

object

Additional data passed to the resumed tool. Use answers for ask_question. For a declined plan_review, use feedback with revision guidance; interactive clients should require a string whose trimmed value is non-empty.

run_id

string

Agent run ID (optional, resolved from stream metadata if omitted)

tool_call_id

string

Exact pending tool call to approve. When target metadata is available, this value is matched atomically with the suspended approval and a mismatch is rejected. It remains optional only for compatibility with legacy suspended tasks that have no stored target.

Response

Approval processing result. success: false reports an agent-side failure such as a target mismatch without changing the HTTP 200 status.

success

boolean

required

code

enum<string>

Stable machine-readable reason when approval failed

Available options:

approval_target_mismatch,

approval_not_suspended,

approval_invalid_feedback,

approval_metadata_unavailable,

approval_metadata_invalid,

approval_expired,

agent_not_found,

redis_unavailable,

approval_state_unavailable,

active_stream_registration_failed,

agent_unavailable

error

string

Error message if approval failed

stream_id

string

ID of the resumed stream