How to require approval and set guardrails for agents ​

Give each agent its own API key, then set guardrails on that key: a daily post limit, a monthly X spend cap, and requireApproval. With approval required, every post the key creates waits in pending_approval until a teammate approves it. Guardrails are enforced by the API, so they hold for the SDKs, CLI, MCP server and raw REST alike.

What guardrails can I set on a key? ​

Send null to remove a cap. Fields you leave out stay unchanged. A key with any guardrail set is called a guarded key.

How do I set guardrails? ​

1. Sidebar > API Keys.
2. Create a key, or open an existing one.
3. Set the daily post limit, the monthly X spend cap and "require approval".
4. Save. The change applies to the next request.

// Run this with an unrestricted key or a dashboard session, never with the guarded key.
await socifyr.workspaces.updateApiKey('ws_123', 'key_456', {
  dailyPostLimit: 10,
  monthlyXSpendCentsCap: 500, // $5.00
  requireApproval: true,
})

curl -X PUT https://api.socifyr.com/api/workspaces/ws_123/api-keys/key_456 \
  -H "Authorization: Bearer $SOCIFYR_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{"dailyPostLimit": 10, "monthlyXSpendCentsCap": 500, "requireApproval": true}'

The CLI has no API key commands. Use the dashboard or REST.

The Python SDK has no API key methods. Use REST or the TypeScript SDK.

Not available to the agent, by design. A guarded key cannot manage API keys,
so an agent cannot lift its own limits. Set guardrails from the dashboard.

The update response:

{ "success": true, "data": { "success": true, "id": "key_456" } }

What can a guarded key still do? ​

A guarded key is deny-by-default. It can call only routes that are marked safe: creating and reading content, bulk scheduling, editing its own drafts, submitting a draft for approval, deleting and retrying its own posts, media upload and reads, analytics reads, AI generation, usage, listing workspaces and connections, and GET /users/me.

It cannot approve or reject posts, manage keys, members, webhooks or settings, refresh or reconnect accounts, or see billing. Any other route returns:

{
  "success": false,
  "error": "This API key has guardrails and cannot call this endpoint — use a dashboard session or an unrestricted key",
  "statusCode": 403
}

Two more rules apply to guarded keys. They can modify only posts they created themselves, and they can edit only while the post is still a draft.

What happens when an agent posts with requireApproval? ​

The post is created with all its channels, then held. The response says so:

{
  "success": true,
  "data": {
    "success": true,
    "uploadId": "6a05032a84584482ace13d5f",
    "status": "pending_approval",
    "message": "This API key requires approval — the post is pending review before it publishes."
  }
}

The agent's tools do not change. post_text, the CLI and the SDK all return normally; the post just does not go out. Scheduled and bulk posts follow the same rule.

A key with requireApproval cannot publish a draft directly, publish now, approve or reject. It can only submit a draft with POST /api/content/:id/submit-for-approval. Quota for the daily limit and X cap is reserved when a post leaves draft, not when it is approved.

How do I review and approve a post? ​

1. Sidebar > Content. Open the post waiting for review.
2. Check the text, media and accounts.
3. Click Approve to publish it (or schedule it, if it has a time), or Reject
   to send it back to draft.
Editors, admins and owners can approve. Contributors cannot.

# Approve: moves pending_approval to draft, then publishes or schedules it
curl -X POST https://api.socifyr.com/api/content/6a05032a84584482ace13d5f/approve \
  -H "Authorization: Bearer $SOCIFYR_ADMIN_KEY"

# Reject: sends it back to draft
curl -X POST https://api.socifyr.com/api/content/6a05032a84584482ace13d5f/reject \
  -H "Authorization: Bearer $SOCIFYR_ADMIN_KEY"

# Submit one of your own drafts for review
curl -X POST https://api.socifyr.com/api/content/6a05032a84584482ace13d5f/submit-for-approval \
  -H "Authorization: Bearer $SOCIFYR_AGENT_KEY"

None of them has an approve, reject or submit method today. Approve in the
dashboard or call the REST endpoints above.

Reject and submit return { "success": true, "data": { "success": true, "id": "...", "status": "draft" } } (status is pending_approval after a submit). Approve returns the same acknowledgement as publishing a draft, with a requestId to poll.

What errors can I get, and how do I fix them? ​

FAQ ​

Which roles can approve? ​

post.approve belongs to Owner, Admin and Editor. Contributors can create posts but not approve. See team and roles.

Do guardrails apply to dashboard users? ​

No. They are per key and apply only to requests that authenticate with that key.

Where do I use this with an agent? ​

Create one key per agent and connect it as in Use Socifyr from Claude. The content agent walkthrough uses a guarded key end to end.

Next steps ​

• API keys and guardrails in the dashboard
• Save and publish drafts
• REST reference: API keys
• Error reference