POST /admin/migrations/:id/items/:itemId/approve
Approve a migration item for import. Optionally override the target environments or bucket classification at approval time. Auth:migration_reviewer permission + a recent step-up verification (5-minute window)
Class B reveal (since 2026-10-05). This action also passes the reveal chokepoint: the caller’s own membership must be Owner or Admin (an Admin also needs the Owner-granted migration_reviewer delegation, checked first), the ONE secret.migration verification is consumed by the chokepoint itself (one verification per action), the per-person reveal budget is charged (60 per 5 minutes: 429 reveal_budget_exceeded, or 503 reveal_budget_unavailable when it cannot be counted), and a plaintext.reveal audit entry is written before anything is decrypted or changed (503 reveal_audit_unavailable if it cannot be). A missing verification answers 403 with "code": "reveal_step_up_required", "requires_step_up": true, "action_scope": "secret.migration" and "allowed_methods": ["passkey", "2fa"].
Step-up is enforced server-side: the platform checks for a recent re-authentication by the signed-in user. No step-up token or header is sent on this request. To create a verification first, the user re-authenticates with a second factor, passing "action_scope": "secret.migration" in the body: POST /auth/2fa/verify-step-up (authenticator-app code), POST /auth/passkey/verify-step-up (passkey, challenge from POST /auth/passkey/authenticate-options), or POST /auth/2fa/webauthn/verify-step-up (security key or passkey, challenge from POST /auth/2fa/webauthn/step-up-options). An emailed code does not satisfy this gate. If no recent verification exists, this endpoint returns 403 with { "error": "Recent step-up verification required for this action", "requires_step_up": true, "max_age_minutes": 5, "action_scope": "secret.migration", "allowed_methods": ["passkey", "2fa"] }.
Request body (all optional)
Response
409 if the item is not in pending_review status.
Returns 400 with { "error": "target_environments contains duplicate environment names" } if target_environments names the same environment more than once.