Approval Policies
Configure TTLs, trusted callers, quorum requirements, and other policy settings for your approval workflow.
Policies let you control how approval requests are handled. You can set default TTLs, mark certain callers as trusted (bypassing notifications), configure quorum requirements for multi-approver scenarios, and more.
Policies are configured per-approver through the dashboard settings. Some policies (like quorum) are configured per-integration (e.g., per-repository for GitHub or Bitbucket).
Default TTL
The default TTL determines how long a request stays pending when the caller does not specify a TTL. Configure this in Settings → Preferences.
// When a caller omits ttl_seconds:
POST /api/v1/approvals/request
{
"action": "Run database migration"
// no ttl_seconds specified
}
// The approver's default_ttl_seconds is used (e.g., 3600 = 1 hour)
// If no default is set, the system default is 86400 (24 hours)Trusted Callers
Mark specific API keys as "trusted callers" in your preferences. Trusted callers may have different notification behavior or reduced friction for certain action types. This is useful when you have internal services that frequently request approvals and you want to streamline the experience.
Configure trusted callers in Settings → Preferences → Trusted Callers.
Quorum Rules
For Git integrations (GitHub, Bitbucket, GitLab), you can configure quorum requirements — the number of approvals required before a PR or merge request can proceed. For example:
- Quorum of 1 — Any single approver can approve (default).
- Quorum of 2 — Two different approvers must approve before the commit status turns green.
Quorum is configured per-repository in the integration settings (e.g., Bitbucket repo config or GitLab project config).
Branch Protection Patterns
For Git integrations, you can specify which branches require SignedApproval checks. Common patterns:
main — exact match
release/* — all release branches
production — exact match
** — all branches (not recommended)Configure branch patterns in each integration's repository settings.
Quiet Hours
Quiet hours suppress push notifications during a configured time window (e.g., 10 PM to 7 AM). Requests are still created and visible in the dashboard — only the push notification is suppressed.
See Quiet Hours for detailed configuration.