> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nxos.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Activate authorization

> Activate a PENDING authorization, flipping it to `ACTIVE` and stamping
`signedAt`. This is the self-service counterpart to back-office signing:
a broker that has captured the customer's authorization in its own app
(e.g. an in-app consent step) records that attestation here.

Restricted: your organization must be explicitly enabled for
self-activation, and `authorizedOrganizationId` must be your own org —
you may only activate grants made TO you, never between other parties.
Both fail with `403 forbidden`. The PENDING grant itself is created when
the customer org is created under you (`POST /v1/organizations`).

Idempotent: re-activating an already-`ACTIVE` grant returns it with
`200`. A grant that was never created or has been `REVOKED` returns
`404 authorization_not_found`.

Effect is immediate — once active, requests with `Nxos-On-Behalf-Of`
pointing at the granter will succeed for delegated operations.



## OpenAPI

````yaml POST /v1/authorizations/activate
openapi: 3.0.0
info:
  title: nxos API
  version: 1.0.0
  contact:
    name: nxos
    url: https://nxos.io
  description: |-
    The nxos platform API provides programmatic access to accounts, balances,
    quotes, and trades. All endpoints require API key authentication.
servers:
  - url: https://api.nxos.io
    description: Production
    variables: {}
  - url: https://api.sandbox.nxos.io
    description: Sandbox
    variables: {}
security: []
tags:
  - name: Accounts
  - name: Quotes
  - name: Beneficiaries
  - name: Fiat Payouts
  - name: Crypto Payouts
  - name: Sandbox Faucet
  - name: Nxosnet
  - name: Fees
  - name: Sub-Org Tiers
  - name: Funding Methods
  - name: Transactions
  - name: Organizations
  - name: Authorizations
  - name: Webhooks
    description: >-
      Register an HTTPS endpoint to receive events (organization verification
      and

      transaction status changes) instead of polling. Deliveries are signed;
      verify

      the `svix-signature` header before acting on an event.


      See the [Webhooks guide](https://docs.nxos.io/core-concepts/webhooks) for
      the

      delivery format, signature verification, retries, and broker behavior.
      Payload

      shapes are documented in the `…Event` models below.
paths:
  /v1/authorizations/activate:
    post:
      tags:
        - Authorizations
      description: |-
        Activate a PENDING authorization, flipping it to `ACTIVE` and stamping
        `signedAt`. This is the self-service counterpart to back-office signing:
        a broker that has captured the customer's authorization in its own app
        (e.g. an in-app consent step) records that attestation here.

        Restricted: your organization must be explicitly enabled for
        self-activation, and `authorizedOrganizationId` must be your own org —
        you may only activate grants made TO you, never between other parties.
        Both fail with `403 forbidden`. The PENDING grant itself is created when
        the customer org is created under you (`POST /v1/organizations`).

        Idempotent: re-activating an already-`ACTIVE` grant returns it with
        `200`. A grant that was never created or has been `REVOKED` returns
        `404 authorization_not_found`.

        Effect is immediate — once active, requests with `Nxos-On-Behalf-Of`
        pointing at the granter will succeed for delegated operations.
      operationId: Authorizations_activate
      parameters:
        - $ref: '#/components/parameters/ApiKeyAuth'
        - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActivateAuthorizationRequest'
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Authorization'
        '400':
          description: The server could not understand the request due to invalid syntax.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error400'
        '401':
          description: Access is unauthorized.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error401'
        '403':
          description: Access is forbidden.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error403'
        '404':
          description: The server cannot find the requested resource.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error404'
        '409':
          description: The request conflicts with the current state of the server.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error409'
        '429':
          description: Client error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error429'
        '500':
          description: Server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error500'
components:
  parameters:
    ApiKeyAuth:
      name: Authorization
      in: header
      required: true
      description: 'Bearer token. Format: `Bearer <api_key>`'
      schema:
        type: string
    IdempotencyKey:
      name: Idempotency-Key
      in: header
      required: false
      description: >-
        Unique key per logical operation. UUID v4 recommended. Max 255
        characters.
      schema:
        type: string
  schemas:
    ActivateAuthorizationRequest:
      type: object
      required:
        - grantingOrganizationId
        - authorizedOrganizationId
        - type
      properties:
        grantingOrganizationId:
          type: string
          description: Organization that granted the authorization (the customer).
        authorizedOrganizationId:
          type: string
          description: >-
            Organization that received the authorization (the broker). Must
            equal

            your API key's organization — you may only activate grants made to
            you.
        type:
          allOf:
            - $ref: '#/components/schemas/AuthorizationType'
          description: Type of grant to activate. Currently always `LOA`.
      description: Request body for `POST /v1/authorizations/activate`.
    Authorization:
      type: object
      required:
        - object
        - grantingOrganizationId
        - authorizedOrganizationId
        - type
        - status
        - signedAt
        - revokedAt
        - revokedReason
        - createdAt
        - updatedAt
      properties:
        object:
          type: string
          enum:
            - authorization
          description: Object type. Always `authorization`.
        grantingOrganizationId:
          type: string
          description: Organization that granted the authorization (the customer).
        authorizedOrganizationId:
          type: string
          description: >-
            Organization that received the authorization (the broker /
            platform).
        type:
          allOf:
            - $ref: '#/components/schemas/AuthorizationType'
          description: Type of grant. Currently always `LOA`.
        status:
          allOf:
            - $ref: '#/components/schemas/AuthorizationStatus'
          description: Current status — `PENDING`, `ACTIVE`, or `REVOKED`.
        signedAt:
          type: string
          allOf:
            - $ref: '#/components/schemas/dateTimeString'
          nullable: true
          description: >-
            ISO 8601 timestamp when the granter signed. `null` when the row is
            still `PENDING`.
        revokedAt:
          type: string
          allOf:
            - $ref: '#/components/schemas/dateTimeString'
          nullable: true
          description: >-
            ISO 8601 timestamp when the grant was revoked. `null` until
            revocation.
        revokedReason:
          type: string
          nullable: true
          description: >-
            Optional free-form reason captured at revocation time. `null` when
            not provided.
        createdAt:
          allOf:
            - $ref: '#/components/schemas/dateTimeString'
          description: >-
            ISO 8601 timestamp when the row was first created (usually when the
            LOA invitation was issued).
        updatedAt:
          allOf:
            - $ref: '#/components/schemas/dateTimeString'
          description: >-
            ISO 8601 timestamp of the most recent state change (signing or
            revocation).
      description: A cross-org authorization grant between two organizations.
      example:
        object: authorization
        grantingOrganizationId: org_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
        authorizedOrganizationId: org_b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5
        type: LOA
        status: REVOKED
        signedAt: '2025-12-01T10:30:00.000Z'
        revokedAt: '2026-03-15T14:30:00.000Z'
        revokedReason: Client off-boarded
        createdAt: '2025-12-01T10:30:00.000Z'
        updatedAt: '2026-03-15T14:30:00.000Z'
    Error400:
      type: object
      required:
        - error
      properties:
        error:
          $ref: '#/components/schemas/ErrorBody'
      description: Standard error response returned by all endpoints on failure.
      example:
        error:
          code: invalid_request
          message: The request body is malformed or missing required fields.
          requestId: req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
    Error401:
      type: object
      required:
        - error
      properties:
        error:
          $ref: '#/components/schemas/ErrorBody'
      description: Standard error response returned by all endpoints on failure.
      example:
        error:
          code: missing_api_key
          message: No Authorization header provided.
          requestId: req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
    Error403:
      type: object
      required:
        - error
      properties:
        error:
          $ref: '#/components/schemas/ErrorBody'
      description: Standard error response returned by all endpoints on failure.
      example:
        error:
          code: forbidden
          message: Your organization is not enabled for this action.
          requestId: req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
    Error404:
      type: object
      required:
        - error
      properties:
        error:
          $ref: '#/components/schemas/ErrorBody'
      description: Standard error response returned by all endpoints on failure.
      example:
        error:
          code: not_found
          message: The requested resource was not found.
          requestId: req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
    Error409:
      type: object
      required:
        - error
      properties:
        error:
          $ref: '#/components/schemas/ErrorBody'
      description: Standard error response returned by all endpoints on failure.
      example:
        error:
          code: quote_expired
          message: The quote has expired.
          requestId: req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
    Error429:
      type: object
      required:
        - error
      properties:
        error:
          $ref: '#/components/schemas/ErrorBody'
      description: Standard error response returned by all endpoints on failure.
      example:
        error:
          code: rate_limited
          message: 'Rate limit exceeded: 1000 requests per minute. Retry in 23 seconds.'
          requestId: req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
    Error500:
      type: object
      required:
        - error
      properties:
        error:
          $ref: '#/components/schemas/ErrorBody'
      description: Standard error response returned by all endpoints on failure.
      example:
        error:
          code: internal_error
          message: An unexpected server error occurred.
          requestId: req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
    AuthorizationType:
      type: string
      enum:
        - LOA
      description: >-
        Type of cross-org authorization. Today the only value is `LOA` (Letter
        of Authorization), which lets the authorized organization act on the
        granter's behalf via the platform API when the `Nxos-On-Behalf-Of`
        header is set.
    AuthorizationStatus:
      type: string
      enum:
        - PENDING
        - ACTIVE
        - REVOKED
      description: >-
        Lifecycle status of an authorization grant.


        - `PENDING`  — Row exists, the granter has not signed yet. The
        authorized org cannot act on the granter's behalf.

        - `ACTIVE`   — Granter has signed (`signedAt` is set). The authorized
        org may act on the granter's behalf when the `Nxos-On-Behalf-Of` header
        is set.

        - `REVOKED`  — Previously active or pending, then revoked by either
        party. Kept for audit; never reverts to `ACTIVE`.
    dateTimeString:
      type: string
      description: ISO 8601 timestamp string.
    ErrorBody:
      type: object
      required:
        - code
        - message
        - requestId
      properties:
        code:
          allOf:
            - $ref: '#/components/schemas/ErrorCode'
          description: Machine-readable error code.
        message:
          type: string
          description: Human-readable error message.
        requestId:
          type: string
          description: Unique identifier for this request, useful for debugging.
    ErrorCode:
      type: string
      enum:
        - missing_api_key
        - authentication_failed
        - invalid_api_key
        - forbidden
        - swap_direction_not_allowed
        - sub_org_tier_not_available
        - service_not_enabled
        - not_found
        - organization_not_found
        - account_not_found
        - quote_not_found
        - beneficiary_not_found
        - transaction_not_found
        - funding_method_not_found
        - authorization_not_found
        - nxosnet_handle_not_found
        - sub_org_tier_not_found
        - quote_expired
        - quote_already_used
        - beneficiary_already_archived
        - beneficiary_not_archived
        - beneficiary_blocked
        - nxosnet_not_enabled
        - nxosnet_handle_taken
        - chain_send_failed
        - idempotency_key_in_use
        - idempotency_request_in_flight
        - invalid_request
        - insufficient_funds
        - validation_error
        - share_token_invalid
        - verification_import_unsupported
        - verification_required
        - rate_limited
        - webhooks_unavailable
        - internal_error
      description: All possible error codes returned by the API.

````