waitForApproval

The waitForApproval step pauses workflow execution until a human approves or rejects the request. Use it when the decision is yes or no. The step returns approved: true or false and renders approve/reject controls in Kibana and in external notifications. Approvers respond from the workflow execution view or an external notification.

For free-form or multi-field input, use waitForInput instead. For the end-to-end human-in-the-loop pattern, refer to Human-in-the-loop.

Schema convention. In each schema table on this page, the Location column indicates where each parameter sits in the YAML:

• top level: Alongside type and name, at the top of the step or trigger definition.
• `with`: Inside the step's with: block.
• `on`: Inside the trigger's on: block.

Use with.channels to notify approvers outside Kibana. Slack is the only built-in channel. Notifications include one-click approve and reject links. Responders can act without signing in to Kibana.

Slack content comes from the step-level with.message plus the generated approve and reject actions.

To turn off external resume, set both hitlExternalResume.enabled keys in kibana.yml (both default to true). For the exact settings, refer to Human-in-the-loop.

After someone responds, the step output has this shape:

response:
  approved: true
respondedBy: "..."

1. or false
2. Who responded

Downstream steps typically gate on {{ steps.<step_name>.output.response.approved }}.

While waiting for a response, the step stays in the WAITING_FOR_INPUT state. How the step resolves depends on the response it receives:

• Approve finishes the step successfully with response.approved: true.
• Decline also finishes the step successfully, but with response.approved: false. Declining does not fail the step or cancel the workflow, so you must branch on the decision (for example, with an if guard on output.response.approved) to stop downstream work.
• No response fails the step. By default, the step times out after 24h, whether or not you configure an external channel. Override this with a top-level timeout.

- name: request_approval
  type: waitForApproval
  timeout: 24h
  with:
    message: "Approve isolation for {{ event.alerts[0].host.name }}?"
    approveLabel: Approve
    rejectLabel: Decline
    channels:
      slack:
        connector-id: my-slack-webhook-connector
      slack_api:
        connector-id: my-slack-api-connector
        channels: ["C0123456789"]

- name: isolate
  type: http
  if: "steps.request_approval.output.response.approved : true"
  connector-id: "edr-connector"
  with:
    method: "POST"
    url: "https://edr.example.com/isolate"
    body:
      host: "{{ event.alerts[0].host.name }}"

• Human-in-the-loop pattern: External resume and design guidance.
• waitForInput step: Collect structured input with a custom JSON Schema.
• Flow control steps: Other flow-control types you'll often combine with approval gates.
• If step: Typical gate around the post-approval action.