Skip to main content
Two different things are approved in andteam, and both are named here so they are not mixed up.
  • Access. A key, an app install or a webhook endpoint that asks for a sensitive field group waits for the person who may approve that group. This page covers it.
  • Changes. A write the API files, such as a pay change, waits for the tenant’s own approval chain. See Making changes.

​
The four groups and their approvers

​
How a key gets one

  1. The administrator creating or editing the key switches the group on and writes why the system needs it. A reason is required, and the approver reads it.
  2. The request waits for the approver. Only that group waits. The key’s other groups work at once, and each approval group waits on its own.
  3. When the approver approves, the group is readable. Until then it is absent, as for any group the key does not hold. See Field groups.
A key that asked for nothing but approval groups has nothing to read yet. It answers pending-approval. A new reason is a new request. Taking the group away from the key ends its approval and its request. A webhook endpoint with Include details gets the group only after its own approval, on the same terms. An OAuth app’s install follows the same rules: see OAuth apps. Pay and Performance reads also wait on their own: until the approval, the endpoints answer field-group-required.

​
Protected groups

People in protected groups are left out of Pay and Performance unless the approver ticks Include protected groups. The default stays closed. An endpoint answers 404 not-found for such a person, as it does for someone outside the key’s companies, and events about their pay changes or ratings are not sent.

​
Documents

The key also names the document types it reads. Signed letters and contracts are the default. Health documents (sick notes, medical certificates, medical aid applications and proof, health questionnaires) are never listed, whatever the key holds. A letter that states pay is listed only to a key that also holds Pay.

​
Nobody approves their own request

A write is made for a named requester, and the self-approval guard means that person can never approve what the key files. The key itself never approves anything. See Special categories for the fields and the Information Officer’s approval in full.