`contractorOps.timesheets.review`

Approve or return submitted time entries in a single atomic review, for one pay period (periodId) or for one contractor's hours outside a pay period (contractorId). Supply decisions with hoursId, expectedRevision and decision, a review reason, and idempotencyKey. A decision on a mistake the contractor reported in approved hours also carries the correctionId and decides approved or declined; approving it applies the corrected values, and declining leaves the entry as approved. Approval never sends money.

POST/api/v1/accounting/contractorOps.timesheets.review

Permissions

accounting:readaccounting:write

Who can call it

admin, finance

Retries

Idempotency key required

MCP

accounting_contractor_ops_timesheets_review

Fields

periodIdstring (ID)
The ID of a contractor pay period.
contractorIdstring (ID)
The ID of a contractor, from contractors.list.
idempotencyKeystringRequired
Any unique text you generate once per intended change, so a retried request only happens once. Send it as the Idempotency-Key header instead if you prefer; if you send both they must match.
8–200 characters
reasonstringRequired
A short note saying why, kept in the record's history.
3–1000 characters
decisionsarray of objectsRequired
1–200 items

curl https://app.getoatmilk.com/api/v1/accounting/contractorOps.timesheets.review \
  -H "Authorization: Bearer $OATMILK_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
  "reason": "Synthetic example from the docs",
  "decisions": [
    {
      "hoursId": "1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
      "expectedRevision": 3,
      "decision": "approved"
    }
  ],
  "periodId": "4d5e6f7a-8b9c-4d0e-8f1a-2b3c4d5e6f7a"
}'

const response = await fetch("https://app.getoatmilk.com/api/v1/accounting/contractorOps.timesheets.review", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.OATMILK_API_KEY}`,
    "Content-Type": "application/json",
    "Idempotency-Key": crypto.randomUUID(),
  },
  body: JSON.stringify({
    "reason": "Synthetic example from the docs",
    "decisions": [
      {
        "hoursId": "1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
        "expectedRevision": 3,
        "decision": "approved"
      }
    ],
    "periodId": "4d5e6f7a-8b9c-4d0e-8f1a-2b3c4d5e6f7a"
  }),
});
const { data, error } = await response.json();
if (!response.ok) throw new Error(`${error.code}: ${error.message}`);
console.log(data);

import os
import uuid

import requests

response = requests.post(
    "https://app.getoatmilk.com/api/v1/accounting/contractorOps.timesheets.review",
    headers={
        "Authorization": f"Bearer {os.environ['OATMILK_API_KEY']}",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    json={
        "reason": "Synthetic example from the docs",
        "decisions": [
            {
                "hoursId": "1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
                "expectedRevision": 3,
                "decision": "approved",
            },
        ],
        "periodId": "4d5e6f7a-8b9c-4d0e-8f1a-2b3c4d5e6f7a",
    },
    timeout=30,
)
payload = response.json()
if not response.ok:
    raise RuntimeError(f"{payload['error']['code']}: {payload['error']['message']}")
print(payload["data"])

Response

{
  "data": { … }
}

Try it

Checks your input with this action’s real schema and answers like the API, with synthetic data. No key needed, and nothing changes.

Input

POST/api/v1/accounting/contractorOps.timesheets.review

curl https://app.getoatmilk.com/api/v1/accounting/contractorOps.timesheets.review \
  -H "Authorization: Bearer $OATMILK_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
  "reason": "Synthetic example from the docs",
  "decisions": [
    {
      "hoursId": "1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
      "expectedRevision": 3,
      "decision": "approved"
    }
  ],
  "periodId": "4d5e6f7a-8b9c-4d0e-8f1a-2b3c4d5e6f7a"
}'

const response = await fetch("https://app.getoatmilk.com/api/v1/accounting/contractorOps.timesheets.review", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.OATMILK_API_KEY}`,
    "Content-Type": "application/json",
    "Idempotency-Key": crypto.randomUUID(),
  },
  body: JSON.stringify({
    "reason": "Synthetic example from the docs",
    "decisions": [
      {
        "hoursId": "1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
        "expectedRevision": 3,
        "decision": "approved"
      }
    ],
    "periodId": "4d5e6f7a-8b9c-4d0e-8f1a-2b3c4d5e6f7a"
  }),
});
const { data, error } = await response.json();
if (!response.ok) throw new Error(`${error.code}: ${error.message}`);
console.log(data);

import os
import uuid

import requests

response = requests.post(
    "https://app.getoatmilk.com/api/v1/accounting/contractorOps.timesheets.review",
    headers={
        "Authorization": f"Bearer {os.environ['OATMILK_API_KEY']}",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    json={
        "reason": "Synthetic example from the docs",
        "decisions": [
            {
                "hoursId": "1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
                "expectedRevision": 3,
                "decision": "approved",
            },
        ],
        "periodId": "4d5e6f7a-8b9c-4d0e-8f1a-2b3c4d5e6f7a",
    },
    timeout=30,
)
payload = response.json()
if not response.ok:
    raise RuntimeError(f"{payload['error']['code']}: {payload['error']['message']}")
print(payload["data"])

Fields

Example

Try it