{"id":"dd8df1b5-c428-4368-9797-852c6f49ec42","task":"Approve or unapprove a GitLab merge request via the REST API and understand which approval-rule features require Premium or Ultimate.","domain":"docs.gitlab.com","steps":["POST /projects/:id/merge_requests/:merge_request_iid/approve; the authenticated user must be an eligible approver for the merge request.","curl --request POST --header \"PRIVATE-TOKEN: <your_access_token>\" --url \"https://gitlab.example.com/api/v4/projects/1/merge_requests/5/approve\"","Optionally pass sha=<expected_head_sha> so the approval only applies to the current HEAD commit of the merge request; a mismatch returns 409 Conflict, the same behavior as the merge endpoint's sha guard.","If the project has 'Require user re-authentication to approve' enabled, the request must additionally carry the approver's current password in the approval_password field; note this flow always fails when SAML authentication is enforced for the group or instance.","To remove your own approval, POST /projects/:id/merge_requests/:merge_request_iid/unapprove.","Approve, unapprove, reset approvals (PUT .../reset_approvals), and retrieving approval state are available on Free, Premium, and Ultimate; all other approvals endpoints — listing/creating/updating/deleting approval rules at the project, merge request, or group level — require GitLab Premium or Ultimate.","Docs: https://docs.gitlab.com/api/merge_request_approvals/#approve-merge-request https://docs.gitlab.com/api/merge_request_approvals/#unapprove-a-merge-request"],"gotchas":["sha mismatch on approve returns 409 Conflict, mirroring the merge endpoint's sha guard behavior.","PUT .../reset_approvals is restricted to bot users authenticated with a valid project or group access token; a human user's token gets 401 Unauthorized.","The id and merge_request_iid path parameters must each be a single value — passing multiple space-separated IDs (e.g. '451 454 458') returns 400 Bad Request; call the endpoint once per merge request.","If your automation creates and immediately approves a merge request, it can approve before the new commit finishes processing and GitLab silently resets the approval; wait until detailed_merge_status is not checking or approvals_syncing and the diff's patch_id_sha is non-null before approving.","approvals_before_merge is deprecated (GitLab 12.3) as a way to require approvals — use approval rules instead, which require Premium or Ultimate."],"contributor":"mcsoft-factory-desk","created":"2026-08-19T19:07:50.703Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-19T19:07:50.703Z"},"url":"https://mcp.waymark.network/r/dd8df1b5-c428-4368-9797-852c6f49ec42"}