> ## Documentation Index
> Fetch the complete documentation index at: https://docs.andteam.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Approvals

> Four groups wait for a named approver, and nobody approves their own request.

Two different things are approved in andteam, and both are named here so they are not mixed up.

* **Access.** A key, an app install or a webhook endpoint that asks for a sensitive field group waits for
  the person who may approve that group. This page covers it.
* **Changes.** A write the API files, such as a pay change, waits for the tenant's own approval chain.
  See [Making changes](https://docs.andteam.com/guides/writes.md).

## The four groups and their approvers

| Group | Approver | Why that person |
| - | - | - |
| **Special categories** | The Information Officer | Special personal information under POPIA. |
| **Documents** | The Information Officer | A signed letter or form can carry an ID number, an address or bank details. |
| **Pay** | A holder of the Sign off payroll permission | Pay is confidential, but it is not a special category. The person who judges it already sees the whole payroll. |
| **Performance** | A performance admin | A rating drives pay and exits. |

## How a key gets one

1. The administrator creating or editing the key switches the group on and writes **why the system needs
   it**. A reason is required, and the approver reads it.
2. The request waits for the approver. **Only that group waits.** The key's other groups work at once,
   and each approval group waits on its own.
3. When the approver approves, the group is readable. Until then it is **absent**, as for any group the
   key does not hold. See [Field groups](https://docs.andteam.com/concepts/field-groups.md).

A key that asked for nothing but approval groups has nothing to read yet. It answers
[`pending-approval`](https://docs.andteam.com/api/problems/pending-approval). A new reason is a new request. Taking the group
away from the key ends its approval and its request. A webhook endpoint with Include details gets the
group only after its own approval, on the same terms. An OAuth app's install follows the same rules:
see [OAuth apps](https://docs.andteam.com/guides/oauth-apps.md).

Pay and Performance reads also wait on their own: until the approval, the endpoints answer
[`field-group-required`](https://docs.andteam.com/api/problems/field-group-required).

## Protected groups

People in protected groups are left out of **Pay and Performance** unless the approver ticks **Include
protected groups**. The default stays closed. An endpoint answers 404 `not-found` for such a person, as it
does for someone outside the key's companies, and events about their pay changes or ratings are not
sent.

## Documents

The key also names the document types it reads. Signed letters and contracts are the default. Health
documents (sick notes, medical certificates, medical aid applications and proof, health questionnaires)
are never listed, whatever the key holds. A letter that states pay is listed only to a key that also
holds Pay.

## Nobody approves their own request

A write is made for a named requester, and the self-approval guard means that person can never approve
what the key files. The key itself never approves anything.

See [Special categories](https://docs.andteam.com/concepts/special-categories.md) for the fields and the Information Officer's
approval in full.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.