Agent Requests

Overview

Agent Requests let AI agents and automated systems make changes through the Slash API with human approval. Write operations are not executed immediately — they create a pending request that must be approved before taking effect.

Setup

To use agent requests, create a read-only API key from the Slash dashboard under Settings > API Management. When a read-only API key makes a write request, the operation is automatically deferred for approval instead of being rejected.

How It Works

Your agent makes a write request to any API endpoint using a read-only API key
Instead of executing, the API returns a 403 with the request ID in the x-deferred-action-id header and an approval URL in the response body
An authorized user approves or rejects the request via the approval URL
If approved, the original request is executed and the result is available via the API

Example

curl -X POST "https://api.slash.com/card" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "Marketing Card", "type": "virtual"}'

Response:

HTTP/1.1 403 Forbidden
x-deferred-action-id: dfa_abc123

{"error": "Action requires approval: https://app.slash.com/home?modal=/deferred-action/dfa_abc123"}

The x-deferred-action-id header contains the request ID. The error message includes a URL where an authorized user can review and approve the request.

Checking Request Status

curl "https://api.slash.com/agent-request/dfa_abc123" \
  -H "X-API-Key: $API_KEY"

{
  "id": "dfa_abc123",
  "status": "pending",
  "display": {
    "title": "Create Virtual Card",
    "sections": [
      { "label": "Card Name", "value": "Marketing Card" },
      { "label": "Type", "value": "Virtual" }
    ]
  },
  "createdAt": "2026-03-05T07:00:00.000Z"
}

Status Values

Status	Description
`pending`	Awaiting approval
`approved`	Approved, execution starting
`running`	Currently executing
`executed`	Successfully executed
`rejected`	Rejected by approver
`expired`	Expired before approval
`failed`	Execution failed

When status is executed, the response includes a result field containing the response that the original API call would have returned:

{
  "id": "dfa_abc123",
  "status": "executed",
  "display": { ... },
  "result": {
    "id": "card_xyz789",
    "name": "Marketing Card",
    "status": "active"
  },
  "createdAt": "2026-03-05T07:00:00.000Z"
}

Update webhook List agent requests

⌘I

Overview

Entities

Legal Entity

Account

Account Authorization Webhooks

Virtual Account

Transaction

Transfer Money

Card

Card Group

Invoice

Invoice Series

Expense Report

Customer

Contact

Merchant

Webhooks

Agent Requests

Analytics

Tokens

Agent Requests

Overview

Setup

How It Works

Example

Checking Request Status

Status Values

​Overview

​Setup

​How It Works

​Example

​Checking Request Status

​Status Values

Overview

Setup

How It Works

Example

Checking Request Status

Status Values