Skip to main content
PATCH
cURL

Authorizations

X-API-Key
string
header
required

API key authentication for public API requests.

Keys come in two flavors:

  • Legal-entity-scoped keys are pinned to a single legal entity. Minted via the dashboard under a specific entity; every request acts on that entity.
  • User-scoped keys are pinned to a user and span every legal entity that user has access to. Every request made with a user-scoped key (except GET /legal-entity, which lists the legal entities the user can access) must include an x-legal-entity header naming the legal entity the request is operating on. Requests without the header are rejected with 400. The authenticated user must have an active permission role on the supplied legal entity, otherwise the request is rejected with 403.

Query Parameters

The legal entity ID. Required if authenticating with access to multiple legal entities.

Body

application/json
action
enum<string>
required

The action to perform on the expense reports.

Available options:
approve,
reject,
cancel
expenseReportIds
string[]
required

List of expense report IDs to act on.

reviewedByUserId
string

Required for approve and reject actions. The user ID of the admin performing the action.

cancelledByUserId
string
deprecated

Deprecated and ignored. The acting user is derived from your credentials. For the cancel action, bearer tokens and user-scoped API keys can cancel only reports submitted by that user; legal-entity API keys must hold the reimbursements.approve permission and can cancel any pending report in the legal entity.

reason
string

Required for reject action. The reason for rejecting.

Response

OK

successCount
integer
required

The number of expense reports successfully acted on.

failedIds
string[]
required

IDs of expense reports that failed to be acted on.