> ## Documentation Index
> Fetch the complete documentation index at: https://docs.causeloop.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Decide a pending review

> Requires the `reviews.write` permission + CSRF. Resolves a review exactly once: the update only applies while `decision` is still null, so a second decision attempt on an already-decided review returns 409 rather than silently overwriting the first reviewer's call. Writes an `audit_log` row (tenant schema) (`review_decision`) recording the decision and notes. 404 if the review does not exist.



## OpenAPI

````yaml /api-reference/openapi.json patch /remediation/reviews/{review_id}
openapi: 3.1.0
info:
  title: CL MVP Product API
  description: >-
    The Causeloop MVP Product API is a deliberately small, explicitly
    allowlisted HTTP surface: `services/api/product_app.py` enumerates every one
    of the 44 published (method, path) operations drawn from seven routers, and
    only those operations are mounted onto this app -- everything else defined
    in the underlying routers (and the entire legacy research surface in
    `services/api/main.py`) is not exposed here. Staff (employee) and
    tenant-user sessions are separate cookie-based principals with no shared
    session table; mutating requests are protected by a double-submit CSRF
    cookie/header pair. See `/api-reference/authentication` for session and CSRF
    details, and `/api-reference/errors-and-conventions` for shared error shapes
    and status-code conventions.
  version: 1.0.0
servers: []
security: []
tags:
  - name: Auth
    description: >-
      Staff (employee) and tenant-user session lifecycle: login/logout,
      current-identity reads, invitation acceptance, and the public pre-login
      workspace directory.
  - name: Staff Onboarding
    description: >-
      The Onboarding Portal surface used to create, provision, ingest data for,
      train, activate, and go-live a tenant. Every operation requires an
      authenticated employee session; mutations additionally require the
      `onboarding_admin` control role (`support_readonly` employees can read but
      not write).
  - name: Insights
    description: >-
      Tenant-facing reads of materialized insight collections (themes, severity,
      issues, fishbone, and related model outputs) produced by the training and
      materialization pipeline.
  - name: Members
    description: Read-only tenant member directory.
  - name: Sources
    description: Tenant-facing source-connector registration and file-upload ingest.
  - name: Remediation
    description: >-
      Tenant-scoped corrective action plans (CAPs), human-in-the-loop issue
      reviews, the tenant audit trail, and the branded Excel export.
  - name: Health & Observability
    description: >-
      Unauthenticated liveness/readiness probes and the employee-only Prometheus
      metrics scrape endpoint.
paths:
  /remediation/reviews/{review_id}:
    patch:
      tags:
        - Remediation
      summary: Decide a pending review
      description: >-
        Requires the `reviews.write` permission + CSRF. Resolves a review
        exactly once: the update only applies while `decision` is still null, so
        a second decision attempt on an already-decided review returns 409
        rather than silently overwriting the first reviewer's call. Writes an
        `audit_log` row (tenant schema) (`review_decision`) recording the
        decision and notes. 404 if the review does not exist.
      operationId: decide_review_remediation_reviews__review_id__patch
      parameters:
        - name: review_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Review Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DecideReviewRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReviewRecord'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    DecideReviewRequest:
      properties:
        decision:
          type: string
          enum:
            - approved
            - rejected
            - escalated
          title: Decision
        notes:
          anyOf:
            - type: string
            - type: 'null'
          title: Notes
      type: object
      required:
        - decision
      title: DecideReviewRequest
    ReviewRecord:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        target_type:
          type: string
          title: Target Type
        target_id:
          type: string
          title: Target Id
        decision:
          anyOf:
            - type: string
            - type: 'null'
          title: Decision
        notes:
          anyOf:
            - type: string
            - type: 'null'
          title: Notes
        reviewed_by_email:
          anyOf:
            - type: string
            - type: 'null'
          title: Reviewed By Email
        created_at:
          type: string
          title: Created At
        updated_at:
          type: string
          title: Updated At
      type: object
      required:
        - id
        - target_type
        - target_id
        - decision
        - notes
        - reviewed_by_email
        - created_at
        - updated_at
      title: ReviewRecord
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError

````