Skip to main content
POST
Error
This endpoint is available in Bifrost Enterprise only.
Required Permissions How permissions work

Authorizations

Authorization
string
header
required

Management API authentication for /api/* endpoints. Use the Authorization header with Bearer <token>, where <token> is one of:

  • a Bifrost management API key,
  • a dashboard session token issued by POST /api/session/login,
  • base64 of <admin-username>:<admin-password> (legacy equivalent of BasicAuth).

Virtual keys (sk-bf-*) and the x-api-key header are not accepted on management APIs - the sole exception is GET /api/governance/virtual-keys/quota, which is virtual-key-only.

Authentication alone is not sufficient in Bifrost Enterprise: each operation page shows a Required Permissions table (Resource:Operation, for example Dashboard:View) above its Authorizations section, and the caller's RBAC role or management API key scopes must include what it lists, otherwise the request is rejected with 403 Forbidden.

A local admin — authenticated with the admin password, or any caller on a deployment with dashboard auth disabled — bypasses these checks and can call every management endpoint.

OSS setup lock. On Bifrost OSS, while dashboard auth is not active (no admin account, or auth disabled), every management endpoint except the public ones (/health, /api/version, /api/session/is-auth-enabled, /api/session/login, ...) requires the operator's setup token in the X-Bifrost-Setup-Token header, in place of Authorization. The token is set with setup_token in config.json or the BIFROST_SETUP_TOKEN environment variable. A missing header returns 401, a wrong token 403. The header stops working once dashboard auth is enabled. The dashboard instead trades the token once for an HttpOnly bifrost_setup_session cookie via POST /api/session/setup. See Required permissions for how permissions are derived and which endpoints are exempt.

Path Parameters

request_id
string
required

Budget request ID

Body

application/json

Optional approver overrides for a budget increase request. amount, mode and cycles default to the requested values.

amount
number

Amount in dollars to approve. Must be greater than 0.

mode
enum<string>

cycles keeps the override active for cycles reset windows starting with the current one. forever keeps it active until it is removed.

Available options:
cycles,
forever
cycles
integer

Number of reset windows the override stays active for. Must be 1-120 when the effective mode is cycles, where the effective mode is this body's mode, else the requested mode. Ignored when the effective mode is forever, and ignored with add_keep_lifetime when the budget has an active override.

note
string

Optional note shown with the decision.

Maximum string length: 2000
override_strategy
enum<string>

How to combine the approval with an active override on the budget. Empty or add adds the amount and returns 409 when the lifetimes differ. replace replaces the active override. add_keep_lifetime adds the amount and keeps the active override's mode and remaining cycles.

Available options:
,
add,
replace,
add_keep_lifetime

Response

Request approved and override applied

A budget increase request, with the target budget's current state.

id
string
requester_user_id
string
requester_name
string
requester_email
string
target_kind
enum<string>
Available options:
virtual_key,
access_profile
virtual_key_id
string

Set when target_kind is virtual_key.

access_profile_id
integer

Set when target_kind is access_profile.

target_name
string

Name of the virtual key or access profile.

budget_id
string
amount
number

Requested amount in dollars.

mode
enum<string>

Requested duration mode.

Available options:
cycles,
forever
cycles
integer

Requested number of cycles.

reason
string
status
enum<string>
Available options:
pending,
approved,
denied,
cancelled
decided_by_user_id
string
decided_by_user_name
string
decision_note
string
approved_amount
number
approved_mode
enum<string>

Duration mode actually applied.

Available options:
cycles,
forever
approved_cycles
integer

Number of cycles actually applied.

created_at
string<date-time>
decided_at
string<date-time>
budget
object

The target budget's current state.

live_reload
enum<string>

retrying when the approval is saved but applying it to live governance state failed and is being retried in the background. Omitted otherwise.

Available options:
retrying