> ## Documentation Index
> Fetch the complete documentation index at: https://help.abacusdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Approve a library share

> Approve a pending org-library share.

Org admin. Makes the schema or batch visible org-wide (schema = view; batch = full edit). Mods auto-approve their own shares at create time.


## OpenAPI

````yaml POST /api/v2/library/shares/{id}/approve/
openapi: 3.1.0
info:
  title: Abacus Docs API
  version: 1.0.0
  description: |
    REST + SSE surface for Abacus Docs on the same host as the web app
    (`https://abacusdocs.com`). Paths are `/api/v2/…`.

    Authenticate with an organisation API key (`sk-abacus-*`) as a Bearer
    token, or an Auth0 access token. Cross-tenant reads return **404**, not
    403. Page-based lists use `?page=` and `?page_size=`.

    Extraction, reprocess, schema tests, and chat turns spend credits.
    See the help centre Credits pages for rates.
  contact:
    name: Abacus Docs
    url: https://abacusdocs.com/contact
servers:
  - url: https://abacusdocs.com
    description: Production (Extract)
security: []
paths:
  /api/v2/library/shares/{id}/approve/:
    post:
      tags:
        - v2/library
      summary: Approve a pending share request (mod-only)
      description: >-
        Only callable when the share is in PENDING state and the caller is an
        org moderator or ``is_superuser``. Idempotent failures (already
        APPROVED, already terminal) return 400 with the state error.
      operationId: v2_library_shares_approve_create
      parameters:
        - in: path
          name: id
          schema:
            type: integer
          required: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OrgLibraryShareDecisionRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrgLibraryShare'
          description: ''
        '400':
          content:
            application/json:
              schema:
                type: object
                additionalProperties: {}
          description: ''
        '403':
          content:
            application/json:
              schema:
                type: object
                additionalProperties: {}
          description: ''
        '404':
          content:
            application/json:
              schema:
                type: object
                additionalProperties: {}
          description: ''
      security:
        - extractApiKey: []
        - bearerAuth: []
        - cookieAuth: []
components:
  schemas:
    OrgLibraryShareDecisionRequest:
      type: object
      description: |-
        Body for the decision endpoints (approve / reject / revoke / kick).

        All four endpoints accept the same shape — an optional ``note``.
        The note ends up on the saved ``OrgLibraryShare.note`` column.
      properties:
        note:
          type: string
          maxLength: 500
    OrgLibraryShare:
      type: object
      description: |-
        Output projection for an ``OrgLibraryShare`` row.

        Composed for both the list endpoint and as the response body of
        every mutation endpoint, so the SPA can re-render the row from a
        POST response without a follow-up GET. ``content_object_summary``
        is computed via ``SerializerMethodField`` because the underlying
        target is a generic FK — a normal nested serializer doesn't fit.
      properties:
        id:
          type: integer
          readOnly: true
        content_type:
          type: string
          readOnly: true
        object_id:
          type: integer
          readOnly: true
        content_object_summary:
          oneOf:
            - $ref: '#/components/schemas/_ContentObjectSummary'
            - type: 'null'
          readOnly: true
        state:
          allOf:
            - $ref: '#/components/schemas/StateEnum'
          readOnly: true
        shared_by:
          oneOf:
            - $ref: '#/components/schemas/_Actor'
            - type: 'null'
          readOnly: true
        decided_by:
          oneOf:
            - $ref: '#/components/schemas/_Actor'
            - type: 'null'
          readOnly: true
        decided_at:
          type:
            - string
            - 'null'
          format: date-time
          readOnly: true
        note:
          type: string
          readOnly: true
        created_at:
          type: string
          format: date-time
          readOnly: true
        updated_at:
          type: string
          format: date-time
          readOnly: true
      required:
        - content_object_summary
        - content_type
        - created_at
        - decided_at
        - decided_by
        - id
        - note
        - object_id
        - shared_by
        - state
        - updated_at
    _ContentObjectSummary:
      type: object
      description: |-
        Tiny shape: just enough to render a share row in the UI.

        For ``Struct`` rows: ``{"id", "slug", "name", "status"}`` (slug is
        the SPA-routing key). For ``Batch`` rows: ``{"id", "name",
        "status"}``. ``kind`` distinguishes them when the SPA wants a
        single discriminator field; it mirrors ``content_type.model``.
      properties:
        id:
          type: integer
        kind:
          type: string
        name:
          type: string
        slug:
          type: string
        status:
          type: string
      required:
        - id
        - kind
        - name
    StateEnum:
      enum:
        - pending
        - approved
        - rejected
        - revoked
        - kicked
      type: string
      description: |-
        * `pending` - Pending
        * `approved` - Approved
        * `rejected` - Rejected
        * `revoked` - Revoked
        * `kicked` - Kicked
    _Actor:
      type: object
      description: Compact user projection for ``shared_by`` / ``decided_by`` fields.
      properties:
        id:
          type:
            - integer
            - 'null'
        email:
          type:
            - string
            - 'null'
          format: email
      required:
        - id
  securitySchemes:
    extractApiKey:
      type: http
      scheme: bearer
      bearerFormat: API Key
      description: |
        Organisation API key from Settings → API / `/api/keys/`. The secret is
        shown once. Send `Authorization: Bearer sk-abacus-…`. One active key
        per organisation. Ingest (`/api/v2/ingest/*`) refuses API keys — that
        surface is Auth0-only with `ingest:read` / `ingest:write` scopes.
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >
        Auth0 access token for a signed-in user. Send `Authorization: Bearer
        <token>`.

        The SPA and desktop agent use this. Prefer an organisation API key for

        server-to-server integrations.
    cookieAuth:
      type: apiKey
      in: cookie
      name: sessionid
      description: |
        Django session cookie from a browser login. Present so the web app can
        call `/api/v2` without a header. Do not rely on this for integrations.

````