> ## Documentation Index > Fetch the complete documentation index at: https://developers.portao3.com.br/llms.txt > Use this file to discover all available pages before exploring further. # /realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/wallets/{walletId}/transactions/{transactionId}/spend-review ## OpenAPI ````yaml /api-reference/banking.openapi.json get /realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/wallets/{walletId}/transactions/{transactionId}/spend-review openapi: 3.0.3 info: title: Banking version: 1.0.0 description: >- Portão 3 banking API. Generated by tools/openapi from code (routes + security) and the hand-written spec (request/response bodies). Banking attaches a zod validationSchema at the route; request bodies are resolved from it (object + array roots). Responses have no presenter layer, so they stay tier=unknown. Confidence tiers: generated:typed=107 copied:manual=7 unknown=79. servers: - url: https://api.banking.v2.portao3.com.br/ description: production - url: https://api.banking.dev.3pers.com.br/ description: development security: - bearerAuth: [] tags: - name: Accounts - name: Wallets - name: Cards - name: PIX - name: PIX Keys (DICT) - name: PIX Charges - name: PIX Automatic - name: PIX Initiation (Open Finance) - name: PIX Infractions (MED) - name: Boleto - name: Boleto Charges - name: TED - name: Transfers - name: Transactions - name: Cashback - name: Currency Codes - name: Reversals paths: /realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/wallets/{walletId}/transactions/{transactionId}/spend-review: get: tags: - Transactions summary: >- /realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/wallets/{walletId}/transactions/{transactionId}/spend-review operationId: >- getRealmsByRealmIdOrganizationsByOrganizationIdAccountsByAccountIdWalletsByWalletIdTransactionsByTransactionIdSpendReview parameters: - name: realmId in: path required: true schema: type: string - name: organizationId in: path required: true schema: type: string - name: accountId in: path required: true schema: type: string - name: walletId in: path required: true schema: type: string - name: transactionId in: path required: true schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object properties: spendReview: description: >- The stored review state, or null when the transaction was never submitted. type: object properties: status: anyOf: - type: string enum: - PENDING_APPROVAL - APPROVED - DECLINED description: >- Where an after-the-fact spend review of a transaction stands. - type: string source: anyOf: - type: string enum: - PAYMENT description: >- Marks a review that was never submitted through SPEND_REVIEW at all. - type: string description: >- Set to PAYMENT when the transaction was created by a payment (PIX, boleto or P2P) that was already approved before it was made. Such transactions are approved from the start and can never be submitted for spend review. Their custom fields REMAIN EDITABLE, so a document that only exists after the purchase — a fiscal receipt — can still be attached; a review without this field (one a person opened or approved) locks them instead. policyRequestId: type: string description: The approval-engine request this review is tracked by. policyId: type: string description: The business policy that governed the review. autoApproved: type: boolean description: >- Present only when the review was approved automatically by the matched policy. requester: type: object properties: userId: type: string name: type: string email: type: string required: - userId - name - email description: Who submitted the transaction for review. requestedAt: anyOf: - type: string - type: string format: date-time approvalExpiresAt: anyOf: - type: string - type: string format: date-time description: >- The review deadline; after it the review is declined with `declineOutcome: "EXPIRED"`. decidedAt: anyOf: - type: string - type: string format: date-time declineOutcome: anyOf: - type: string enum: - DENIED - CANCELED - EXPIRED description: Why a spend review ended DECLINED. - type: string description: Only when `status` is `DECLINED`. decisionReason: type: string description: The reviewer's free-text reason, when one was given. required: - status - requestedAt nullable: true policy: description: >- The governing SPEND_REVIEW policy — the same advisory shape pix/boleto/transfer-request creates return. `{ actions: { autoAction: "APPROVE" } }` means no policy matched (no review needed). `null` when the transaction is not submittable right now (PENDING_APPROVAL / APPROVED): nothing was evaluated. type: object properties: id: type: string realmId: type: string organizationId: type: string context: type: string enum: - PAYMENT - SPEND_REVIEW - TRAVEL description: The business surface a policy governs. name: type: string description: type: string order: type: number description: Evaluation sorts ascending; first match wins. status: type: string enum: - ACTIVE - DISABLED - ARCHIVED description: >- `ARCHIVED` is a soft delete: terminal, set only through the archive endpoint, and never evaluated against a transaction. conditions: type: object properties: logic: type: string enum: - AND - OR groups: type: array items: type: object properties: logic: type: string enum: - AND - OR dependsOn: type: array items: type: string items: type: array items: type: object properties: operator: type: string description: >- Same ConditionOperator union the security rules use (incl. LLM_EVALUATE). field: type: string maskType: type: string dynamicFieldValue: type: string value: {} required: - operator - field required: - logic - items description: >- An EMPTY array matches unconditionally — the catch-all/default policy. required: - logic - groups createdAt: anyOf: - type: string - type: string format: date-time updatedAt: anyOf: - type: string - type: string format: date-time actions: type: object properties: hierarchy: type: boolean description: >- true = approvals resolve one-by-one in array order. autoAction: type: string enum: - APPROVE - DENY - NONE description: >- What happens when a policy matches: - `APPROVE` — allowed outright, no policy-request - `DENY` — refused outright - `NONE` — an approval flow is required (`approvals` must be non-empty) moveBalance: type: object properties: addBalance: type: boolean fromAccountId: type: string description: Required when `addBalance` is true. fromWalletId: type: string description: Required when `addBalance` is true. required: - addBalance approvals: type: array items: type: object properties: type: type: string enum: - USER - GROUP id: type: string description: >- userId when type=USER, identity groupId when type=GROUP. name: type: string required: - id - type description: >- A participant as RENDERED on a read: the persisted spec plus the display name resolved at read time. `name` is never accepted on input and never persisted — a request body carrying it is rejected. It is optional on the way out: a participant whose name cannot be resolved is returned without one. description: >- Non-empty when autoAction=NONE; empty/absent otherwise. required: - autoAction description: >- Evaluation response — a **pure read**. A match returns the whole matched policy; NO match returns exactly `{ actions: { autoAction: "APPROVE" } }`. Callers key off `actions.autoAction` and must tolerate every other field being absent. `approvals[]` carries each participant's display name, resolved at read time exactly as the business-policy CRUD reads do. The name is best-effort: a participant that cannot be resolved keeps its `{type, id}` and omits `name`. required: - actions nullable: true required: - spendReview - policy description: >- Whether a transaction is submittable for spend review right now, and what would happen if it were submitted. components: securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT ````