POST /v1/escalations/{escalation_id}/resolve

Resolve a third-party escalation. Escalation is a Pro+ decision path for scopes listed in requires_escalation_for.

When you need this

When /check returns decision: "escalate" inside a scope result, the matching scope requires approval from the configured escalation target before the action may proceed.

The escalation flow:

1. /check returns decision: "escalate" with an escalation_id
2. Your app routes the request to the approver shown by escalation_to
3. Call POST /v1/escalations/{escalation_id}/resolve with resolution: "approved" or "rejected"
4. If approved, re-call /check with the same authorization_id, scope, and resource — it returns allow once and consumes the approval
5. If rejected, re-call /check — it returns deny with reason: "escalation_rejected"

Escalations expire after 24 hours.

Request

POST /v1/escalations/esc_01HXZ.../resolve
Authorization: Bearer allowly_l1_s001_...
Content-Type: application/json

{
  "resolution": "approved",
  "resolved_by": "manager:8821",
  "note": "Approved for this candidate only."
}

Response — changed

The first successful resolution creates an escalation.resolve receipt.

{
  "escalation_id": "esc_01HXZ...",
  "status": "approved",
  "resolved_by": "manager:8821",
  "resolved_at": "2026-04-21T14:33:17.000Z",
  "receipt": {
    "status": "pending",
    "receipt_id": "rcp_01HXZESCALATION...",
    "ready_at_estimate": "2026-04-21T14:33:18.000Z",
    "url": "https://api.allowly.ai/v1/receipts/rcp_01HXZESCALATION..."
  }
}

Response — same resolution repeated

Resolving the same escalation with the same resolution is idempotent and returns receipt: null.

{
  "escalation_id": "esc_01HXZ...",
  "status": "approved",
  "resolved_by": "manager:8821",
  "resolved_at": "2026-04-21T14:33:17.000Z",
  "receipt": null
}

Nonce-like behavior

Important

Only resolve escalations after an approver actually approves or rejects the request. Never auto-approve escalations server-side — the escalation path exists for cases where the user authorization is valid but the action needs a separate authority.