# List Institution Callback Requests

> Coming soon, upon request — this feature is turned on for your tenant by the Aurea team. [Contact us](https://www.aureahub.com/contact)

What Aurea asked your endpoint, newest first: each request's status, attempts and the decisive answer's hash.

## Overview

- `status` and `operationId` narrow it; up to `limit` (1–200, default 50) in `requests`; the next page with `before`, the last `id` you read (`400` `INSTITUTION_CALLBACK_INVALID`, field `before`, for an id that is not one of your requests).
- `kind`: `operation` or `approval` (tests are not kept). `point`: the signing point (an approval request's is `null`). `operationId`, `approvalId`.
- `status`: `pending` (asked again from `nextPollAt`), then once — `approved`, `rejected` (`REJECT`, or for a signature an answer that is not valid), `ignored` (an approval request's `IGNORE`), `expired` (its `deadlineAt` passed), `failed` (no usable answer at the first ask, where the fallback decided; or an approval request's answer that decided nothing) or `cancelled` (its operation cancelled, your callback or your approvals switched off, or the approval request closed).
- `attempts`; `lastOutcome` — the last attempt's: `approve`, `reject`, `retry`, `ignore`, `answer_invalid:` and the check that failed, `timeout`, `unreachable`, `bad_status`, `blocked_url`, `signer_…`; or how it ended: `deadline`, `operation_cancelled`, `callback_off`, `approval_closed`, `approvals_off`, `approver_unavailable`, `approval_refused:` and the approval refusal's code in lower case. `reason`: your answer's code.
- `answerSha256`: SHA-256 (hex) of the decisive signed answer, which Aurea keeps with the request. `decidedAt`; `consumedAt`: when the approval was used by its signature.
- `held`: an operation waited for it (`202` `awaiting_callback`); `resultStatus`: the HTTP status that operation's call answered once it went on, else `null`.
- For `owner`, `tenantadmin`, `non_signing_admin`, `auditor`, `security_admin` and `security_auditor`, on their own tenant. [Institution Callback & Co-Signer](https://docs.aureahub.com/docs/guide-institution-callback.md).

## Endpoint

### `GET /v1/admin/tenants/{id}/institution-callback/requests`

Authentication: bearer token required.

The requests asked of the tenant's callback, newest first.

**Path parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | yes | Tenant UUID |

**Query parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `status` | string | no | `pending`, `approved`, `rejected`, `ignored`, `expired`, `failed` or `cancelled` |
| `operationId` | string (uuid) | no | One operation's requests |
| `limit` | integer | no | 1–200, default 50 |
| `before` | string (uuid) | no | The last `id` of the previous page |

**Responses**

`200` OK

```json
{
  "requests": [
    {
      "id": "8a3e5c71-2d9b-4f06-b1e8-4c7a9d2f6e15",
      "environment": "production",
      "kind": "operation",
      "point": "custodial_transfer",
      "operationId": "1d7a3c52-8e4b-4f19-a0c6-2b9e7d5f3a18",
      "approvalId": null,
      "status": "approved",
      "attempts": 3,
      "nextPollAt": null,
      "deadlineAt": "2026-10-16T09:20:00.000Z",
      "lastOutcome": "approve",
      "reason": "reviewed",
      "answerSha256": "00d0298793c8b360dc9cab667056afcfe73f021639683f64ba9a84e844b10791",
      "decidedAt": "2026-10-14T09:31:04.552Z",
      "consumedAt": "2026-10-14T09:31:05.010Z",
      "held": true,
      "resultStatus": 201,
      "createdAt": "2026-10-14T09:20:00.214Z"
    }
  ]
}
```

**Example request**

```bash
curl "https://api.aureahub.com/v1/admin/tenants/6f1e2d3c-4b5a-4968-8776-a5b4c3d2e1f0/institution-callback/requests?status=pending" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```

---

Web version: https://docs.aureahub.com/#institution-callback-requests