The signed CMS envelope of an approval

GET /api/v1/approvals/{number}/envelope

https://app.tanba-ooh.kz/api/v1/approvals/{number}/envelope

Scope read:approvals. Verify it against the media file with the published root.

Authentication

API key in the Authorization header, or a console session.

Scope: read:approvals

Parameters

Name	In	Type	Required	Description	Example
`number`	path	string	yes	Approval number.	`TNB-2026-000123`

Responses

200 DER-encoded CMS.

`application/pkcs7-signature`

Errors

Errors are problem documents (application/problem+json) with a stable code.

Status	Meaning
401	No valid session or API key (`unauthenticated`, `session_expired`, `invalid_api_key`).
403	The role or the key's scope does not allow this (`forbidden`, `key_scope_denied`, `key_route_denied`).
404	Nothing there, or not visible to the caller.
default	An error as a problem document.

Code samples

curl

curl 'https://app.tanba-ooh.kz/api/v1/approvals/TNB-2026-000123/envelope' \
  -H 'Authorization: Bearer YOUR_API_KEY'

Python

import requests

response = requests.get(
    "https://app.tanba-ooh.kz/api/v1/approvals/TNB-2026-000123/envelope",
    headers={
        "Authorization": "Bearer YOUR_API_KEY",
    },
)
print(response.status_code, response.text)

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("GET", "https://app.tanba-ooh.kz/api/v1/approvals/TNB-2026-000123/envelope", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer YOUR_API_KEY")
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()
	data, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.Status, string(data))
}