> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # Review a pipeline definition's authority before approval > What an approver reads before approving a definition's protected sections: exactly which authority it declares, how that compares with the approved authority runs fall back to, the default-branch run it was read from, and whether the approve route would accept it now. Requires pipelines.read. Read-only. Literal values that can carry a credential (a stage's with: settings, a service's env values, a webhook URL's path and query) are withheld, and the stored pipeline YAML is never returned. ## OpenAPI ````yaml https://platform.ankra.app/openapi.json get /api/v1/org/pipelines/definitions/{id}/review openapi: 3.1.0 info: title: FastAPI version: 0.1.0 servers: - url: https://platform.ankra.app security: [] tags: - name: Clusters description: Create, inspect and manage clusters, and the stacks deployed on them. - name: Managed Clusters description: Provider-managed control planes, driven through one common surface. - name: Imported Clusters description: Clusters that already existed and were connected to Ankra. - name: Cluster Access description: Kubeconfigs, service-account tokens and per-cluster access grants. - name: Kubernetes description: Read and act on the Kubernetes objects inside a cluster. - name: AWS Clusters description: >- Provision and manage self-managed k3s / kubeadm clusters on AWS EC2 in your own VPC. - name: DigitalOcean Clusters description: Provision and manage DigitalOcean Kubernetes clusters. - name: Hetzner Clusters description: Provision and manage Hetzner Kubernetes clusters. - name: OVH Clusters description: Provision and manage OVH Kubernetes clusters. - name: Scaleway Clusters description: Provision and manage Scaleway Kapsule clusters. - name: UpCloud Clusters description: Provision and manage UpCloud Kubernetes clusters. - name: Applications description: Deploy, configure and observe applications across the fleet. - name: Pipelines description: Pipeline definitions and the approval of the authority they declare. - name: Backups description: >- Backup vaults, restore points, protection posture and captures for stacks and application deployments; a completed capture is not a verified restore. - name: Stack Profiles description: Reusable stack definitions, their versions and sharing. - name: Services description: >- Versioned service packages and explicit sharing. Runtime admission is separate from publication. - name: Charts description: Browse the chart catalogue behind stacks and addons. - name: Helm description: Helm registries, credentials and the charts they expose. - name: Executions description: Long-running platform executions and their jobs. - name: Operations description: Cancel in-flight cluster operations and their jobs. - name: Chat description: Conversational sessions, plans and confirmable actions. - name: AI Agent Runs description: Autonomous agent runs and their outcomes. - name: AI Tickets description: The AI ticket board, its sync connections and settings. - name: AI Playbooks description: Reusable playbooks the AI lanes execute. - name: AI Conditions description: Conditions that gate AI autonomy. - name: AI Remediation description: >- The organisation's auto-remediation policy: what the AI lanes may fix by themselves, and who approves the rest. - name: AI Engineering Handoffs description: Work the AI lanes escalate to a human engineer. - name: AI Environment description: The environment and base stacks AI demos deploy into. - name: Security description: Findings, advisories, SBOMs, compliance and posture. - name: Cost description: Cluster and fleet cost, rate cards and cost settings. - name: Decisions description: >- The decision ledger behind the Security and Cost queues: proposals a surface computed, the approve and set-aside decisions people took on them, and the receipts of running them. - name: Billing description: Subscription and spend caps. - name: Organisation description: Members, invitations, audit logs and organisation settings. - name: Account Tokens description: Personal access tokens for the API and CLI. - name: Credentials description: The shared credential store. - name: AWS Credentials description: >- AWS credentials: access keys or CloudFormation-onboarded STS roles for cost, EKS and self-managed provisioning. - name: Azure Credentials description: Azure credentials and SSH keys. - name: DigitalOcean Credentials description: DigitalOcean credentials and SSH keys. - name: Hetzner Credentials description: Hetzner credentials and SSH keys. - name: OVH Credentials description: OVH credentials and SSH keys. - name: Scaleway Credentials description: Scaleway credentials. - name: UpCloud Credentials description: UpCloud credentials and SSH keys. - name: Data Source Credentials description: Credentials for metrics and log sources. - name: DNS Credentials description: Credentials for DNS providers. - name: Object Storage Buckets description: >- Buckets Ankra creates and manages on an organisation's own provider credentials. - name: DNS description: DNS zones and records, including custom organisation zones. - name: Cloudflare description: Cloudflare domains and the credentials behind them. - name: Variables description: Organisation- and cluster-scoped variables. - name: SOPS description: Encrypt and decrypt values with the organisation SOPS config. - name: Alerts description: Alert integrations and ingest credentials. - name: Notifications description: Notification routes and their delivery targets. - name: Support description: Support tickets. - name: AI Settings description: Organisation AI provider, model catalog and per-function model settings paths: /api/v1/org/pipelines/definitions/{id}/review: get: tags: - Pipelines summary: Review a pipeline definition's authority before approval description: >- What an approver reads before approving a definition's protected sections: exactly which authority it declares, how that compares with the approved authority runs fall back to, the default-branch run it was read from, and whether the approve route would accept it now. Requires pipelines.read. Read-only. Literal values that can carry a credential (a stage's with: settings, a service's env values, a webhook URL's path and query) are withheld, and the stored pipeline YAML is never returned. operationId: reviewPipelineDefinitionToken parameters: - name: id in: path required: true schema: type: string format: uuid responses: '200': description: The definition's reviewed authority. content: application/json: schema: $ref: '#/components/schemas/PipelineDefinitionReview' '401': description: Authentication required '403': description: Missing pipelines.read '404': description: No such definition in the organisation '422': description: Malformed definition id '500': description: Internal error security: - BearerAuth: [] components: schemas: PipelineDefinitionReview: type: object additionalProperties: false required: - definition_id - protected_hash - approved_hash - approved_at - approved_by - spec_hash - status - current_definition_id - repository - head - baseline - entries properties: definition_id: type: string format: uuid protected_hash: type: string description: >- Identity of the definition's protected sections; empty for a definition recorded before they were assessed. approved_hash: type: string description: protected_hash once an administrator approved it, otherwise empty. approved_at: type: - string - 'null' format: date-time approved_by: type: string description: Ankra user id of the approver, empty when unapproved. spec_hash: type: string description: >- Identity of the reviewed content. Definitions are stored by content, so it never changes for an id. status: type: string enum: - approvable - not_current - already_approved - nothing_to_approve - not_assessed - unreadable description: >- Whether POST /org/pipelines/definitions/{id}/approve should be offered now. Evidence read at one moment: the approve route re-checks inside its own transaction. current_definition_id: type: - string - 'null' format: uuid description: >- The definition a fresh push to the default branch would take its authority from. repository: type: object additionalProperties: false required: - id - provider - owner - name - default_branch properties: id: type: string format: uuid provider: type: string owner: type: string name: type: string default_branch: type: string head: description: >- The newest default-branch run that executed the definition; null when none did. anyOf: - type: 'null' - type: object additionalProperties: false required: - run_id - run_number - head_sha - trigger_ref - created_at properties: run_id: type: string format: uuid run_number: type: integer head_sha: type: string trigger_ref: type: string created_at: type: string format: date-time baseline: description: >- The approved authority runs fall back to while the definition is unapproved; null when nothing else was ever approved. anyOf: - type: 'null' - $ref: '#/components/schemas/PipelineDefinitionApproval' entries: type: array items: $ref: '#/components/schemas/PipelineDefinitionReviewEntry' PipelineDefinitionApproval: type: object additionalProperties: false required: - definition_id - protected_hash - approved_hash - approved_at - approved_by properties: definition_id: type: string format: uuid protected_hash: type: string description: >- Identity of the definition's protected sections; empty for a definition recorded before they were assessed. approved_hash: type: string description: protected_hash once an administrator approved it, otherwise empty. approved_at: type: - string - 'null' format: date-time approved_by: type: string description: Ankra user id of the approver, empty when unapproved. PipelineDefinitionReviewEntry: type: object additionalProperties: false required: - section - path - value - is_withheld - change properties: section: type: string description: >- The protected section: permissions, secrets, credentials, fork_policy, network, stage, runs_on, resources, timeout, cache, with, gate, approval, agent, webhook, external, environments or services. path: type: string description: >- Where the value sits. Every name is quoted; keyed list members are named by their key. value: type: string description: >- The declared value. Empty when withheld, except a webhook URL, which shows its origin. is_withheld: type: boolean description: >- True for a literal that can carry a credential (a with: setting, a service env value, a webhook URL). The value is never returned; change is still computed from it. change: type: string enum: - added - changed - unchanged - removed description: >- How the value compares with the approved authority runs fall back to. securitySchemes: BearerAuth: bearerFormat: PAT scheme: bearer type: http ````