# Update an order approval

```http
PUT https://secure.yoprint.com/v2/api/store/{team_slug}/v2/sales_order/{hash_id}/approval/{hash_id2}
```

- API version: v2
- Operation ID: `v2_public_order_approval_update`
- Section: Sales › [Sales order approvals](https://developer.yoprint.com/reference/sales-order-approvals.md)
- Web page: https://developer.yoprint.com/reference/sales-order-approvals/v2-order-approval-update/
- Authentication: `Authorization: Bearer YOUR_API_KEY`

Changes the notes of an approval that is not completed yet. `{hash_id2}` is the approval's `id`. The answer is the approval. `{hash_id}` is the order's `id` (for example `V4keXwwxMQyXw7`); the `ord_` unique key is not accepted here.

## Permission

Any member of the team.

## Business rules

- Only on published orders, and only while the approval is not completed: "No Permission - you cannot edit a completed approval".

## Side effects

- Sends nothing to the customer. Customer Portal pages the order's customer has open refresh (a live update, not an email).

## Path parameters

- `team_slug` (string, required): Your team slug, shown as Team ID next to your API key in Profile. Example `your-team`.
- `hash_id` (string, required): The sales order's or quote's `id` (a hash id). The `ord_` unique key and the order number do not work here. Example `V4keXwwxMQyXw7`.
- `hash_id2` (string, required): The approval's `id` (a hash id). Example `xTKi8BqFVVmlL6`.

## Request body

Content type `application/json`, required.

Fields:

- `notes_from_customer` (string, optional): The customer's note.
- `notes_to_customer` (string, optional): The note shown to the customer.

### Example request

```bash
curl -X PUT 'https://secure.yoprint.com/v2/api/store/your-team/v2/sales_order/V4keXwwxMQyXw7/approval/xTKi8BqFVVmlL6' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'X-Yoprint-Decimal-Format: exact-v1' \
  -H 'Content-Type: application/json' \
  -d '{
    "notes_to_customer": "Updated proof attached."
  }'
```

## Response

`200` Successful response.

Fields:

- `data` (object, required): An approval.
  - `id` (string, required)
  - `status` (string | null, required): `pending` (created, not emailed), `sent-to-customer`, `viewed-by-customer`, `need-changes` or `completed` (approved). When it was completed without a `status`, the Record answer shows `null` and later reads show `""`.
  - `type` (string, required): `order` for a whole-order approval, `job` for an artwork approval. One of: `"order"`, `"job"`.
  - `approved_by` (string, optional): `contact` when a contact of the order's customer answered in the customer portal (see `approved_by_contact_id`), `user` when a team member recorded the answer (as Record the customer's answer does), `customer` otherwise, including before any answer. One of: `"contact"`, `"user"`, `"customer"`.
  - `approved_by_contact_id` (string | null, optional): The contact who answered in the customer portal, or null (always null when a team member recorded the answer).
  - `approved_by_user` (string | null, optional): The team member who recorded the answer, or null.
  - `completed` (boolean, optional): true once the customer (or you, for them) answered: approved or changes needed.
  - `completed_at` (string (date-time) | null, optional): When the customer answered. ISO 8601 with offset, or null.
  - `created_at` (string (date-time) | null, optional): Created. ISO 8601 with offset, or null.
  - `customer_last_viewed_contact_id` (string | null, optional): The contact who last opened it in the customer portal, or null when that isn't known.
  - `customer_last_viewed_date` (string (date-time) | null, optional): When the customer last opened it. ISO 8601 with offset, or null.
  - `items` (array of objects, optional): Job approvals: the mockups under review.
  - `job_id` (string | null, optional)
  - `notes_from_customer` (string | null, optional)
  - `notes_to_customer` (string | null, optional)
  - `order_id` (string, optional)
  - `order_scoped_id` (string, optional)
  - `signature` (string | null, optional): The signer's typed name.
- `status` (integer, required)
- `success` (boolean, required)

Example response:

```json
{
  "data": {
    "approved_by": "customer",
    "approved_by_contact_id": null,
    "approved_by_user": null,
    "completed": false,
    "created_at": "2026-11-03T09:00:00+00:00",
    "customer_last_viewed_contact_id": null,
    "customer_last_viewed_date": null,
    "id": "xTKi8BqFVVmlL6",
    "notes_to_customer": "Updated proof attached.",
    "order_id": "V4keXwwxMQyXw7",
    "order_scoped_id": "SO1001",
    "status": "sent-to-customer",
    "type": "order"
  },
  "status": 200,
  "success": true
}
```

## Errors

- `401` The API key is missing or wrong (`unauthenticated`).
- `403` You are not allowed to do this. `api_access_not_in_plan`: your team's plan doesn't include API access (Pro and above, with an active subscription or trial), so every request answers this until the team upgrades. When your role lacks the permission the operation needs, the body is only `{"message": "Insufficient Permission"}`. Other refusals use the error envelope, with `unauthorized` or `user_is_not_authorized`.
- `404` Not found. `page_not_found`: the team slug is unknown, you are not a member of the team, or an id in the path is not one of this team's. `code: null`, with a message that starts "No query results for": there is no record with that id.
- `422` The request was refused and changed nothing. `validation_failed` lists what to fix in `error.fields`; other codes name a business rule, explained in `error.message`. A few checks answer with only `{"message": "..."}`. An operation that calls another service (a payment provider, a carrier, an accounting app) can answer `connect_timeout` ("Please retry again") when that service does not answer in time: the change may or may not have happened there, so read the record back before you retry.
  - When: The approval is completed, or the order is a draft or a Shopify order. Fix: Create a new approval instead.

## Related

- [Get an order approval](https://developer.yoprint.com/reference/sales-order-approvals/v2-order-approval-show.md): `GET /v2/api/store/{team_slug}/v2/sales_order/{hash_id}/approval/{hash_id2}`