> ## Documentation Index > Fetch the complete documentation index at: https://docs.solya.app/llms.txt > Use this file to discover all available pages before exploring further. # Toggle the active status of an approval policy > Sets the `isActive` flag on an approval policy. This is the only way to activate or deactivate a policy — `isActive` is not editable via `PUT /api/approval-policies/{id}`. Returns 404 when the policy does not exist or belongs to another organization. Requires `intelligenceLayer.configure` permission. ## OpenAPI ````yaml /openapi.json patch /api/approval-policies/{id}/status openapi: 3.0.3 info: contact: email: dev@solya.io name: Solya Team description: >- # Solya API Solya is a fashion retail inventory management platform for buyers and merchandisers. This API exposes all capabilities needed to manage the inventory lifecycle: catalog browsing, risk detection, plan creation (Restock / Markdown / Rebalance), analytics queries, and data-platform operations. ## Authentication Three authentication schemes are supported: | Scheme | Header | Use case | |---|---|---| | **BearerAuth** | `Authorization: Bearer ` | Human users via the Solya web app (NextAuth session) | | **InternalBearerAuth** | `Authorization: Bearer ` | Internal jobs and cron tasks (static token per service) | | **ServiceAccountToken** | `Authorization: Bearer solya_sa_*` | LLM agents and programmatic clients (opaque token created via Settings) | All endpoints except `GET /api/health` require one of the above. See [Agent authentication guide](/docs/api/AGENT_AUTH.md) for the Service Account token flow. ## Response format Every endpoint returns an `ActionResponse` envelope: **Success:** ```json { "success": true, "data": { ... } } ``` **Error:** ```json { "success": false, "errorCode": "PLAN_NOT_FOUND", "error": "Human-readable message" } ``` The `errorCode` is a stable machine-readable string (see common error codes below). The `error` field is for human display only and may change between versions. ## Pagination List endpoints accept `page` (1-indexed, default 1) and `pageSize` (default 20, max 100). Responses include a `total` field with the total number of matching records. ``` GET /api/shops?page=2&pageSize=50 → { "success": true, "data": { "data": [...], "total": 120, "page": 2, "pageSize": 50 } } ``` ## Common error codes | HTTP status | errorCode | Meaning | |---|---|---| | 401 | `UNAUTHORIZED` | Token missing, expired, or invalid | | 403 | `FORBIDDEN` | Token valid but lacks the required permission or scope | | 404 | `NOT_FOUND` | Requested resource does not exist | | 409 | `BUSINESS_RULE_VIOLATION` | Business rule blocked the operation (see response details) | | 422 | `VALIDATION_ERROR` | Input failed Zod schema validation | | 429 | `RATE_LIMIT_EXCEEDED` | Rate limit hit (100 req/min per token) | | 500 | `INTERNAL_ERROR` | Unexpected server error | ## Rate limiting Default limit: **100 requests per minute** per authentication token. When the limit is exceeded the API returns HTTP 429 with `errorCode: "RATE_LIMIT_EXCEEDED"`. Agents should implement exponential back-off and respect the `Retry-After` header when present. ## Further reading See the [Agent guide](/docs/api/AGENT_GUIDE.md) for end-to-end workflows, call-chaining patterns, and anti-patterns to avoid. license: name: Proprietary url: https://solya.app/terms title: Solya API version: 1.0.0 x-ai-context: >- Solya is a fashion retail inventory management platform for retailers. Core concepts: - **Organization** (tenant): every endpoint is scoped by organizationId extracted from the token. - **Shop**: a physical point of sale belonging to the organization. - **ProductVariant**: a SKU — a product variant with size and color. - **Plan**: a Restock / Markdown / Rebalance grouping PlanItems to orchestrate inventory decisions. Typical agent workflow: 1. List the organization's shops — GET /api/shops 2. List variants at risk (stockout, overstock, slow-mover) — GET /api/inventory/risks 3. Create a plan — POST /api/restock-plans, /api/markdown-plans, or /api/rebalance-plans 4. Add items to the plan — POST /api/restock-plans/{planId}/items (or equivalent for other plan types) 5. Validate / submit the plan via the corresponding action endpoint Auth: use a Service Account token (see /docs/api/AGENT_AUTH.md). The token is created by an org admin via Settings and has the format solya_sa_<43 base64url chars>. All responses follow the ActionResponse envelope: - Success: { success: true, data: T } - Error: { success: false, errorCode: string, error: string } Use the errorCode field to drive retry logic or surface user-facing messages. servers: - description: Current environment url: https://app.solya.app security: - BearerAuth: [] tags: - description: >- Health and liveness endpoints. Use GET /api/health to verify the service is reachable before starting a workflow. No authentication required. name: System - description: >- Physical points of sale belonging to the organization. Supports listing, creation, update, and deactivation. Shops are referenced by all Plan types (Restock, Markdown, Rebalance) and by every inventory analytics endpoint. name: Shops - description: >- Product brands configured for the organization. Brands are used to filter catalog queries and analytics. Supports CRUD operations. name: Brands - description: >- The product catalog: style-level entities grouping one or more ProductVariants. Supports listing with rich filter options (brand, family, gender, season) and individual retrieval. name: Products - description: >- SKU-level product entities (a Product with a specific size and color). Variants are the atomic unit referenced by PlanItems, inventory risk alerts, and analytics queries. name: Variants - description: >- Curated product groupings used for seasonal assortment management. A Collection groups Variants and can be referenced when creating or filtering Plans. name: Collections - description: >- Current on-hand stock records per Variant per Shop. Used to understand the live inventory position before creating a restock or rebalance plan. name: Inventory Items - description: >- AI-detected inventory risk signals: stockout risk, overstock, slow-movers, and displaced stock. The primary input for agents building recommendation-driven plans. Supports filtering by shop, brand, risk type, and severity. name: Inventory Risks - description: >- AI-generated restock quantity recommendations per Variant per Shop. Consumed by agents to pre-populate Restock plan items. Based on sales velocity, stock coverage, and lead time. name: Recommendations - Restock - description: >- AI-generated markdown discount recommendations for slow-moving or overstock Variants. Consumed by agents to pre-populate Markdown plan items. Includes recommended discount rate and expected clearance timeline. name: Recommendations - Markdown - description: >- AI-generated stock transfer recommendations between shops to balance supply with demand. Consumed by agents to pre-populate Rebalance plan items. name: Recommendations - Rebalance - description: >- Historical sales transaction lines at the Variant + Shop + date level. Used by analytics and by the AI recommendation engine. Supports date-range and multi-dimensional filtering. name: Sales Lines - description: >- Purchase order lines tracking inbound stock from suppliers. Combined with stock and sales data to compute forward coverage and restock needs. name: Order Lines - description: >- Inventory movement records (transfers, returns, adjustments). Used to reconcile the stock ledger and audit stock changes between shops. name: Movement Lines - description: >- Running stock balance log per Variant per Shop. Provides a point-in-time view of stock levels and is the source of truth for coverage computations. name: Stock Ledger - description: >- Rebalance plans orchestrate stock transfers between shops. Supports creating plans, adding Variant items with proposed transfer quantities, reviewing, and submitting. Business rules are evaluated on item addition. name: Plans - Rebalance - description: >- Restock plans (order plans) orchestrate purchase orders to suppliers. Supports creating sessions, adding Variant items with proposed order quantities, reviewing totals, and submitting. Integrates with the order plan workflow. name: Plans - Restock - description: >- Autocomplete and typeahead search endpoints for catalog dimensions: products, brands, shops, sizes, families, genders, and more. Designed for fast UI search (low latency, small result sets). Use catalog list endpoints for full paginated access. name: Search - description: >- Manage file-based data ingestion: upload CSV/XLSX files, poll ingestion status, list historical ingestion runs, and trigger batch reprocessing. Used by the data team to import POS data and catalog updates. name: Data Platform - File Ingestions - description: >- Organization-level configuration for the data platform: data source connections, POS integration settings, and ingestion schedules. Requires elevated permissions. name: Data Platform - Settings - description: >- Configuration of automated inventory alerts: threshold-based rules that monitor stock levels, sales velocity, and coverage gaps. Supports CRUD for alert definitions; alert evaluation runs are triggered by the data platform scheduler. name: Data Platform - Alerts - description: >- Endpoints designed for LLM agents and programmatic clients. These endpoints expose agent-optimized response shapes. Authenticate with a Service Account token (format: solya_sa_*) created via Settings → API Tokens. name: Agent externalDocs: description: >- Complete guide for LLM agents and programmatic clients: authentication, pagination patterns, ActionResponse interpretation, call chaining, business rule error handling. url: /docs/api/AGENT_GUIDE.md paths: /api/approval-policies/{id}/status: patch: tags: - Approval Policies summary: Toggle the active status of an approval policy description: >- Sets the `isActive` flag on an approval policy. This is the only way to activate or deactivate a policy — `isActive` is not editable via `PUT /api/approval-policies/{id}`. Returns 404 when the policy does not exist or belongs to another organization. Requires `intelligenceLayer.configure` permission. operationId: toggleApprovalPolicyStatus parameters: - in: path name: id required: true schema: description: Unique identifier of the approval policy (UUID) minLength: 1 type: string requestBody: content: application/json: examples: sample: summary: Deactivate a policy value: isActive: false schema: properties: isActive: description: >- The desired active state — true to activate, false to deactivate type: boolean required: - isActive type: object required: true responses: '200': content: application/json: examples: sample: summary: Policy after deactivation value: actionFamily: RESTOCK_PLAN createdAt: '2026-01-10T08:00:00.000Z' createdBy: user-uuid-1 id: policy-uuid-1 isActive: false name: High-value restock approval organizationId: org-uuid-1 scopeActorTypes: [] scopeBrandIds: [] scopeCollections: [] scopeShopIds: - shop-uuid-1 scopeSupplierIds: [] scopeWorkflowIds: [] thresholdMetric: PLAN_TOTAL_VALUE thresholdValue: 50000 updatedAt: '2026-06-05T12:00:00.000Z' updatedBy: user-uuid-1 schema: properties: data: properties: actionFamily: description: >- Action family this policy applies to (e.g. RESTOCK, MARKDOWN), or null for a transversal policy that matches all families enum: - RESTOCK_PLAN - REBALANCE_PLAN - MARKDOWN_PLAN - PRE_SEASON_PLAN - RECOMMENDATION - WORKFLOW - SUPPLIER_RETURN_PLAN - SUPPLIER_EXCHANGE_PLAN nullable: true type: string createdAt: description: ISO 8601 timestamp when the policy was created format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string createdBy: description: Keycloak user ID of the creator, or null if unknown nullable: true type: string id: description: Unique identifier of the approval policy (UUID) type: string isActive: description: >- Whether this policy is currently active and evaluated at plan-validate time. Not editable via PUT /api/approval-policies/{id} — use PATCH /api/approval-policies/{id}/status to toggle. type: boolean name: description: Human-readable name of the policy type: string organizationId: description: ID of the organization that owns this policy type: string scopeActorTypes: description: >- Actor types this policy fires for — empty array means all actors (USER + WORKFLOW). Non-empty restricts to the listed actor types. items: enum: - USER - WORKFLOW - SCENARIO_GENERATOR - SYSTEM - API_TOKEN type: string type: array scopeBrandIds: description: >- Brand IDs this policy is restricted to — empty array means all brands (transversal) items: type: string type: array scopeCollections: description: >- Collection slugs this policy is restricted to — empty array means all collections (transversal) items: type: string type: array scopeShopIds: description: >- Shop IDs this policy is restricted to — empty array means all shops (transversal) items: type: string type: array scopeSupplierIds: description: >- Supplier IDs this policy is restricted to — empty array means all suppliers (transversal) items: type: string type: array scopeWorkflowIds: description: >- Workflow definition IDs this policy fires for — empty array means all workflows. Non-empty restricts to plans created by one of the listed workflow definitions. items: type: string type: array thresholdMetric: description: >- Metric evaluated against thresholdValue. One of: PLAN_TOTAL_VALUE (monetary sum of all items, default), PLAN_TOTAL_QUANTITY (unit count), VARIANT_QUANTITY (max quantity for any single variant), SHOP_QUANTITY (max quantity for any single shop). enum: - PLAN_TOTAL_VALUE - PLAN_TOTAL_QUANTITY - VARIANT_QUANTITY - SHOP_QUANTITY type: string thresholdValue: description: >- Numeric threshold that triggers the approval requirement when the plan metric crosses it (unit depends on thresholdMetric) type: number updatedAt: description: >- ISO 8601 timestamp of the last update, or null if never updated format: date-time nullable: true pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ type: string updatedBy: description: >- Keycloak user ID of the last updater, or null if never updated nullable: true type: string required: - id - organizationId - name - actionFamily - thresholdValue - thresholdMetric - isActive - scopeShopIds - scopeBrandIds - scopeSupplierIds - scopeCollections - scopeActorTypes - scopeWorkflowIds - createdAt - updatedAt - createdBy - updatedBy type: object success: enum: - true type: boolean required: - success - data type: object description: Successful response '400': description: Validation error — invalid body '401': description: Unauthorized — caller lacks the required permission '404': description: Approval policy not found or belongs to another organization '500': description: Internal server error security: - BearerAuth: [] components: securitySchemes: BearerAuth: bearerFormat: JWT description: >- User session token issued by NextAuth. For human users accessing Solya via the web application. scheme: bearer type: http ````