Reject an employee advance request

Operation ID: rejectEmployeeAdvanceRequest

Group: Accounting › Employee Advances

POST /accounting/employee-advances/{id}/reject

Retry-safe: A write that accepts Idempotency-Key: repeating a request with the same key replays the stored answer instead of executing twice.

Rejects an employee advance request. The rejection goes through your tenant's approval policy, and the response is the status that results.

Only a request in 'pendingApproval' can be rejected. For any other status, the request fails with STATUS_CONFLICT.

A rejected request is kept, with its number and audit trail. The employee can change it and resubmit it with PATCH accounting/employee-advances/:id. To remove it, use DELETE accounting/employee-advances/:id.

Parameters

Name	In	Type	Required	Description
`Api-Version`	header	string · v1	yes	The API version this request targets, named by its public identifier. Required on every request; omitting it, or naming a version this company does not have, is answered with 400. This document describes version `v1`.
`Idempotency-Key`	header	string	no	An opaque caller-chosen string (1-255 characters) that makes this request safe to retry. Repeating the same key with an identical request body replays the original response instead of re-executing - but only once that original request succeeded; a failed attempt re-executes on retry. Repeating the key with a different body is answered with 422. A key still in flight is answered with 409 - as is a key whose original request was interrupted before it finished, for a few minutes afterwards, until that attempt is presumed dead. A completed response stays replayable for 24 hours. The key is scoped to the caller, not to the action: reusing it for a different action is answered with 409 or 422 rather than treated independently. On read actions this header is ignored. On write actions that cannot offer the guarantee it is answered with `400 IDEMPOTENCY_NOT_SUPPORTED` rather than silently ignored.
`id`	path	string	yes	Id (a UUID) of the advance request; bound from the :id path segment. Example: `"b81f4a22-6d90-4c53-8e17-9f2a4b6c8d05"`.

Request body

Required, application/json: rejectEmployeeAdvanceRequestInput.

Field	Type	Required	Description
`reviewMessage`	string	no	Why the request is being rejected. Recorded as the request's decisionNote and shown to the requester. Omit to leave no note. Example: `"Trip was cancelled"`.

{
  "reviewMessage": "Trip was cancelled"
}

Response

200 Success

Under data (rejectEmployeeAdvanceRequestOutput):

Field	Type	Required	Description
`status`	string	yes	Status after the operation. The workflow decides it, so it is read back rather than assumed. Example: `"rejected"`.

{
  "data": {
    "status": "rejected"
  },
  "diagnostics": [
    {
      "code": "<code>",
      "message": "<message>",
      "severity": "error",
      "path": [
        "<path>"
      ],
      "details": "<details>"
    }
  ]
}

Response headers

Idempotency-Replayed — Present and true only when this response replays a previously stored one for the same Idempotency-Key, rather than reflecting a live execution. Absent on a live response - never sent as false.

Errors

Code	Status
`NOT_FOUND`	400
`STATUS_CONFLICT`	400
`APPROVAL_FAILED`	400
`IDEMPOTENCY_KEY_CONFLICT`	409
`IDEMPOTENCY_PAYLOAD_MISMATCH`	422

Statuses

400 — Invalid request or business failure. Codes: NOT_FOUND, STATUS_CONFLICT, APPROVAL_FAILED
401 — The request carries no valid access token.
403 — Not authorized
404 — Not found
409 — The Idempotency-Key is still being processed by another request.
422 — The Idempotency-Key was already used with a different request payload.
429 — Too many requests from this client address. The response has no body and no Retry-After header.
500 — Internal server error