Ga naar inhoud
buildinglinksbuildinglinks

Approve an application

POST
/api/v1/onboarding/applications/{id}/approve
curl --request POST \
  --url https://example.com/api/v1/onboarding/applications/example/approve \
  --header 'Content-Type: application/json' \
  --cookie bl_authority_session=<bl_authority_session> \
  --data '{ "roles": [ "example" ], "kvk_verified": true, "note": "example" }'

After the signatory signed, the reviewer confirms in the KvK register that the signer may represent the organisation (kvk_verified). The participant enters the registry and is offered its membership credential over DCP. The authority must have witnessed the participant’s did:webvh log.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string

The id of the application.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
roles

The roles to grant, within the signed mandate; default: all of them.

Array<string> | null
kvk_verified

The reviewer confirms that the signer is authorised to represent the organisation according to the KvK register.

boolean
note
string | null

Example generated

{
  "roles": [
    "example"
  ],
  "kvk_verified": true,
  "note": "example"
}

Responses

Section titled “Responses”

200

Section titled “200”

OK.

Media typeapplication/json

An application as the API shows it: documents the JSON built in [application_json].

object
did
required
string
slug
required
string
name
required
string
legal_name
required
string
kvk_number
required
string
contact_email
string | null
requested_roles

Ignored with an invite: its roles count.

Array<string>
dsp_endpoint
required
string
dataplane_url
string | null
color
string | null
invite_code
string | null
signatory_name

Person authorised to sign on behalf of the organisation (KvK).

string | null
signatory_email
string | null
key_storage
One of:
null
id
required
string
state
required

awaiting_signature, pending, approved or rejected.

string
roles
required

The roles asked for, or those of the invite; after approval the granted ones.

Array<string>
granted_roles

Approved only.

Array<string> | null
reason

Why it was rejected.

string | null
decided_by
string | null
decided_at
string | null format: date-time
created_at
required
string format: date-time
submitted_at
required
string format: date-time
review

The check of the reviewer: kvk_verified, verified_by, verified_at, note, signer.

object | null
signing

The latest signing request of the signatory.

object | null

Example generated

{
  "did": "example",
  "slug": "example",
  "name": "example",
  "legal_name": "example",
  "kvk_number": "example",
  "contact_email": "example",
  "requested_roles": [
    "example"
  ],
  "dsp_endpoint": "example",
  "dataplane_url": "example",
  "color": "example",
  "invite_code": "example",
  "signatory_name": "example",
  "signatory_email": "example",
  "key_storage": {
    "source": "example",
    "non_exportable": true
  },
  "id": "example",
  "state": "example",
  "roles": [
    "example"
  ],
  "granted_roles": [
    "example"
  ],
  "reason": "example",
  "decided_by": "example",
  "decided_at": "2026-04-15T12:00:00Z",
  "created_at": "2026-04-15T12:00:00Z",
  "submitted_at": "2026-04-15T12:00:00Z",
  "review": "example",
  "signing": "example"
}

400

Section titled “400”

Not confirmed in the KvK register, a role outside the mandate, or a key that can be exported for a write role.

Media typeapplication/json

The body of every failed call to a management API.

object
error
required
object
code
required

Stable, machine-readable: invalid_request, unauthenticated, forbidden, not_found, conflict, upstream_unavailable, unavailable, internal, or a more specific code of the operation.

string
message
required

For people; may change between versions.

string

Example 

{
  "error": {
    "code": "not_found",
    "message": "unknown negotiation"
  }
}

401

Section titled “401”

No valid session, DPoP-bound token or API key.

Media typeapplication/json

The body of every failed call to a management API.

object
error
required
object
code
required

Stable, machine-readable: invalid_request, unauthenticated, forbidden, not_found, conflict, upstream_unavailable, unavailable, internal, or a more specific code of the operation.

string
message
required

For people; may change between versions.

string

Example 

{
  "error": {
    "code": "not_found",
    "message": "unknown negotiation"
  }
}

403

Section titled “403”

The caller lacks the role this operation needs; or a change with the session cookie came from a page of another site (cross_site_request, decisions #83).

Media typeapplication/json

The body of every failed call to a management API.

object
error
required
object
code
required

Stable, machine-readable: invalid_request, unauthenticated, forbidden, not_found, conflict, upstream_unavailable, unavailable, internal, or a more specific code of the operation.

string
message
required

For people; may change between versions.

string

Example 

{
  "error": {
    "code": "not_found",
    "message": "unknown negotiation"
  }
}

404

Section titled “404”

Not found.

Media typeapplication/json

The body of every failed call to a management API.

object
error
required
object
code
required

Stable, machine-readable: invalid_request, unauthenticated, forbidden, not_found, conflict, upstream_unavailable, unavailable, internal, or a more specific code of the operation.

string
message
required

For people; may change between versions.

string

Example 

{
  "error": {
    "code": "not_found",
    "message": "unknown negotiation"
  }
}

409

Section titled “409”

Not signed yet, not pending, or the did:webvh log is not witnessed yet.

Media typeapplication/json

The body of every failed call to a management API.

object
error
required
object
code
required

Stable, machine-readable: invalid_request, unauthenticated, forbidden, not_found, conflict, upstream_unavailable, unavailable, internal, or a more specific code of the operation.

string
message
required

For people; may change between versions.

string

Example 

{
  "error": {
    "code": "not_found",
    "message": "unknown negotiation"
  }
}