`put_claims_auto_approval_mode`

Changes data · you confirm first Idempotent

Calls PUT /api/claims/auto-approval/mode as the signed-in person · REST reference

Switch claim auto-approval OFF, SHADOW or ENFORCE

Sets the mode on the platform organization, from the sweep's next pass — within about two minutes, with no restart. ENFORCE starts approving and crediting clinics without a person, for the trusted clinics only; SHADOW records what ENFORCE would do and moves no money; OFF stops both. The mode in force is read first: re-stating it writes nothing — no audit row, and when and by whom it was set are kept — and answers the settings as they stand. PLATFORM STAFF holding execute:ApproveVoucherCommand whom the DAL answers hold execute:UpdateOrgCommand as platform authority (canChange on the read); anyone else is refused 403 before anything is read or written. Written on the caller's own credential, so the DAL's audit row names the person, with the mode before and after.

Arguments

Argument	Type		Description
`body`JSON	object	required	The request body, as a JSON object. Its fields are listed below.

Fields of `body`

Field	Type		Description
`mode`	"OFF" \| "SHADOW" \| "ENFORCE"	required	What the claim auto-approval sweep does with each CLAIMED voucher. OFF decides nothing. SHADOW decides each claim by the rules and records the decision on the delivery trail, approving nothing. ENFORCE approves, with no person, every claim the rules pass from a clinic Pawsitive Future trusts, at the amount the rules propose, and records every hold. A claim the rules hold waits for a reviewer exactly as it would with the switch OFF.

Example call

A client sends this over the MCP session; Claude and other agents build it for you. The values are placeholders — the shape is real.

json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "put_claims_auto_approval_mode",
    "arguments": {
      "body": {
        "mode": "OFF"
      }
    }
  }
}

Confirmation

The client shows the person the exact request and waits. Nothing runs until they tick Make this change. See Reading and changing.

Result

On success (HTTP 200) the tool returns one text item holding the API's JSON, pretty-printed.

The settings after the change, or as they stand when the mode was already in force.

json

{
  "canChange": true,
  "mode": "OFF",
  "modeChangedAt": 1,
  "modeChangedBy": "11111111-1111-4111-8111-111111111111",
  "modeChangedByName": "string",
  "policy": {
    "auditSampleRate": 1,
    "checks": [
      "READABLE"
    ],
    "confidenceFloor": 1,
    "coverage": [
      {}
    ],
    "version": "string"
  },
  "trustedClinics": [
    {
      "name": "string",
      "orgId": "11111111-1111-4111-8111-111111111111",
      "trustedAt": 1,
      "trustedBy": "11111111-1111-4111-8111-111111111111",
      "trustedByName": "string"
    }
  ]
}

Fields

Field	Type	Description
`canChange`	boolean	Whether this caller may change the mode and the trusted clinics, computed by the server from the same rule the two PUTs gate on: platform staff whom the DAL answers hold `execute:UpdateOrgCommand` as platform authority — a global grant held through the platform organization, the test both settings are written under. An organization's own grant of it, the platform organization's included, is not that. Offer the controls only when it is true; a PUT from anyone else answers 403.
`mode`	"OFF" \| "SHADOW" \| "ENFORCE"	What the claim auto-approval sweep does with each CLAIMED voucher. OFF decides nothing. SHADOW decides each claim by the rules and records the decision on the delivery trail, approving nothing. ENFORCE approves, with no person, every claim the rules pass from a clinic Pawsitive Future trusts, at the amount the rules propose, and records every hold. A claim the rules hold waits for a reviewer exactly as it would with the switch OFF.
`modeChangedAt`	integer \| null	When the mode last changed to the value it holds, epoch milliseconds; null if it never has.
`modeChangedBy`	string (uuid) \| null	The user who last changed the mode; null when it never changed, or no person did.
`modeChangedByName`	string \| null	`modeChangedBy` by name, first and last; null when there is none, or that user is no longer on record or has no name.
`policy`	object	What the rules decide by — read-only, fixed per policy version, which every decision is recorded under. ENFORCE pays the covered lines the policy recognises, never more than the invoice's total, capped at the voucher's payout cap; every check must pass and each holds on failure, none denies.
`policy.auditSampleRate`	number	The share of claims, 0 to 1, held for an independent check whatever else they pass.
`policy.checks`	array of "READABLE" \| "ARITHMETIC" \| "ENTERED_TOTAL" \| "NO_INJECTION" \| "LINES_CLASSIFIED" \| "CORE_PROCEDURE" \| … (14 values)	Every check, in the order a decision lists them.
`policy.confidenceFloor`	number	The least confidence, 0 to 1, the invoice reading must carry to approve.
`policy.coverage`	array of object
`policy.coverage[].ceilingCents`	integer \| null	The most one line of it pays, in CENTS; null for no limit.
`policy.coverage[].core`	boolean	The procedure itself — every claim bills exactly one.
`policy.coverage[].covered`	boolean	Paid at all. A line the policy does not recognise is never paid and holds the claim.
`policy.coverage[].id`	string	The category, e.g. SPAY, NEUTER, ANESTHESIA, PAIN_MEDICATION, PREOP, E_COLLAR.
`policy.version`	string
`trustedClinics`	array of object	Every trusted service provider, by name.
`trustedClinics[].name`	string
`trustedClinics[].orgId`	string (uuid)
`trustedClinics[].trustedAt`	integer \| null	When it was trusted, epoch milliseconds.
`trustedClinics[].trustedBy`	string (uuid) \| null	The user who trusted it; null when no person did.
`trustedClinics[].trustedByName`	string \| null	`trustedBy` by name, first and last; null when no person trusted it, or that user is no longer on record or has no name.

When it fails

A failed call returns isError: true with the API's message as text. A change the person declines, or lets time out, also comes back this way and nothing changes.

400: mode is missing or not exactly one of OFF, SHADOW, ENFORCE (mode must be one of OFF, SHADOW, ENFORCE). Nothing is written.
403: The caller is not platform staff, holds no execute:ApproveVoucherCommand, or does not hold execute:UpdateOrgCommand as platform authority — the caller canChange is false for (Access denied. Missing required permission.). Nothing is read or written: the one DAL call a refusal makes is that question.
404: The platform organization does not exist (Organization not found or already deleted).

What the model is shown

This is the tool exactly as the server lists it in tools/list. The description starts with the REST call it makes.

json

{
  "name": "put_claims_auto_approval_mode",
  "description": "PUT /api/claims/auto-approval/mode — Sets the mode on the platform organization, from the sweep's next pass — within about two minutes, with no restart. ENFORCE starts approving and crediting clinics without a person, for the trusted clinics only; SHADOW records what ENFORCE would do and moves no money; OFF stops both. The mode in force is read first: re-stating it writes nothing — no audit row, and when and by whom it was set are kept — and answers the settings as they stand. PLATFORM STAFF holding `execute:ApproveVoucherCommand` whom the DAL answers hold `execute:UpdateOrgCommand` as platform authority (`canChange` on the read); anyone else is refused 403 before anything is read or written. Written on the caller's own credential, so the DAL's audit row names the person, with the mode before and after.\n\nThis changes data. The person is asked to confirm it before it runs, and nothing happens if they decline.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "body": {
        "type": "string",
        "description": "The JSON request body: { mode*: one of \"OFF\" | \"SHADOW\" | \"ENFORCE\" (What the claim auto-approval sweep does with each CLAIMED voucher.) }"
      }
    },
    "required": [
      "body"
    ]
  },
  "annotations": {
    "readOnlyHint": false,
    "destructiveHint": true,
    "idempotentHint": true,
    "openWorldHint": false
  }
}

put_claims_auto_approval_mode

Arguments

Fields of body

Example call

Result

Fields

When it fails

`put_claims_auto_approval_mode`

Fields of `body`