> ## Documentation Index > Fetch the complete documentation index at: https://paymanai.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Ask whether the account owner has approved a frozen operation yet > A state and a clock, for the app that is waiting. ## OpenAPI ````yaml /api-reference/openapi.yaml get /connect/approvals/{ref} openapi: 3.0.3 info: title: Payman Connect API version: 0.1.0 description: >- The HTTP contract behind Payman Connect: exchange a customer's consent for a grant, send actions against the accounts it reaches, and follow an approval to its receipt. Every call carries your app key, and every call after the exchange carries the grant. Non-2xx responses share one `ApiError` envelope. Most integrations never write these calls: the SDK speaks them for you. servers: - url: https://api.paygent.payman.ai description: Production - url: http://localhost:8891 description: A local stack security: - bearerAuth: [] tags: - name: Connect description: >- Third-party access. A registered app presents its app key together with a grant token its customer consented to; the pair reaches exactly the one deployment the grant names, and nothing else on this API. paths: /connect/approvals/{ref}: parameters: - name: ref in: path required: true schema: $ref: '#/components/schemas/ConnectApprovalRef' description: The frozen operation's handle, as the runtime minted it. get: tags: - Connect summary: Ask whether the account owner has approved a frozen operation yet description: A state and a clock, for the app that is waiting. operationId: getConnectApproval responses: '200': description: The ticket's state content: application/json: schema: $ref: '#/components/schemas/ConnectApprovalPoll' '400': $ref: '#/components/responses/BadRequest' '401': description: Invalid Connect credentials (`invalid_connect_credentials`) content: application/json: schema: $ref: '#/components/schemas/ApiError' '403': description: The grant does not carry the `interact` scope (`insufficient_scope`) content: application/json: schema: $ref: '#/components/schemas/ApiError' '404': description: >- Unknown, expired, or belonging to another deployment or another owner (`approval_not_available`) — one status for all of them, so refs cannot be sorted into "exists" and "does not". content: application/json: schema: $ref: '#/components/schemas/ApiError' '409': description: The deployment is paused (`deployment_paused`) content: application/json: schema: $ref: '#/components/schemas/ApiError' '429': $ref: '#/components/responses/TooManyRequests' '502': description: The agent could not answer content: application/json: schema: $ref: '#/components/schemas/ApiError' security: - connectAppKey: [] connectGrant: [] components: schemas: ConnectApprovalRef: type: string pattern: ^pgtk_[A-Za-z0-9_-]{43}$ minLength: 48 maxLength: 48 example: pgtk_9Qv2mB7fJ0xkLpR4sTuVwXyZa1b2c3d4e5f6g7h8i9j description: >- An approval ticket's public handle: `pgtk_` and 43 characters of unpadded base64url — 32 bytes of CSPRNG, minted by the runtime and by nothing else. ConnectApprovalPoll: type: object required: - ref - state - expiresAt description: >- The app-facing view of a ticket: a state and a clock. Deliberately carries no operation detail at all — see `getConnectApproval`. properties: ref: $ref: '#/components/schemas/ConnectApprovalRef' state: $ref: '#/components/schemas/ConnectApprovalState' expiresAt: type: string nullable: true description: When the ticket lapses. ISO-8601 UTC, `Z`-suffixed. approvalUrl: type: string description: >- Payman's approval page for this ticket, on the console origin. Present only while `state` is `pending` — a link to a page that can only say "this is over" is worse than no link — and absent on a deployment with no `CONSUMER_CONSOLE_URL`, which degrades to an approval with no button rather than to a failed request. executable: type: boolean description: >- Whether approval executes the payment server-side, fixed when the ticket was frozen. `false` means `executionStatus` will never appear on this ticket — completion arrives through the resumed conversation (or your replay), so stop polling for a receipt and say the agent behind the connection is completing it. executionStatus: type: string enum: - succeeded - failed - unknown description: >- The receipt, once the bank has answered. Absent while the submission is in flight — and forever, when `executable` is false. providerTransactionId: type: string description: The provider's opaque reference. Only beside an outcome. executedAt: type: string description: When the bank answered. ISO-8601 UTC. ApiError: type: object required: - category - code - message description: >- The envelope every non-2xx response uses. `code` is a stable slug a client can match on exactly; `message` is safe to show a user as-is. properties: category: $ref: '#/components/schemas/ApiErrorCategory' code: type: string example: agent_not_configured message: type: string example: Configure this agent before sending it messages. details: type: object additionalProperties: true nullable: true description: >- Structured context — field errors, the agent's own status, and so on. ConnectApprovalState: type: string enum: - pending - approved - declined - expired - consumed description: What an app may learn about a ticket. Five values, and nothing else. ApiErrorCategory: type: string description: >- Fixed taxonomy, matching K2's so a client that already handles K2 errors handles these too. enum: - VALIDATION - AUTH - PERMISSION - NOT_FOUND - CONFLICT - RATE_LIMIT - UPSTREAM - TIMEOUT - INTERNAL responses: BadRequest: description: The request failed validation content: application/json: schema: $ref: '#/components/schemas/ApiError' TooManyRequests: description: >- Rate limited (`rate_limited`). `details` carries the limit, the window and how long until it reopens. content: application/json: schema: $ref: '#/components/schemas/ApiError' securitySchemes: connectAppKey: type: apiKey in: header name: x-paygent-connect-app-key description: >- A Connect app key (`pgc_app_…`), identifying the registered third-party app. Always presented together with `connectGrant` — the pair is one credential, and either half alone is refused. Accepted on the `/connect/*` surface only. connectGrant: type: apiKey in: header name: x-paygent-connect-grant description: >- A Connect grant token (`pgc_grant_…`): one user's consent for the presenting app to reach one deployment. Every failure mode — missing, malformed, revoked, expired, or paired with the wrong app key — answers the same 401 `invalid_connect_credentials`. ````