Four-eyes approval

In regulated industries, external communication is not something one person sends out alone. With four-eyes approval somebody prepares an incident or a maintenance, and a second person approves it before anything appears on the status page or reaches subscribers.

Available on the Business plan.

The one rule

Whoever creates something cannot approve it themselves. Everything else follows from that — including the fact that a workspace of one cannot use it. Invite somebody first, then the setting becomes available.

Setting it up

Under Status Pages → your page → Display → Four-eyes approval you choose separately what it applies to:

  • Maintenances — planned work. An approval loop costs nothing here, because nobody is waiting anyway.
  • Incidents — think twice about this one. During a live outage the announcement then waits for a colleague, and at three in the morning it may wait a while.

Both switch independently, both off by default.

How it runs

  1. Somebody creates an incident or a maintenance. It enters the queue automatically — there is no button to forget.
  2. Every other member of the workspace gets an email with a direct link.
  3. One of them opens it and picks Approve or Send back.

Approve publishes immediately: it appears on the status page, the affected components show the disruption, and subscribers and chat channels are notified if that was switched on.

Send back requires a reason. The entry stays invisible and the author sees what to change. Once it is fixed, Submit again sends it back for approval and the colleagues are notified once more. Through the API the reason is in approval_note.

What happens meanwhile — which is nothing

An entry waiting for approval is held back everywhere:

  • not on the status page, not in the history
  • no page of its own, not even through the direct link
  • not in the RSS feed and not in the calendar feed
  • no email, SMS or webhook to subscribers
  • no message in Slack, Teams, Discord or Google Chat
  • the affected components stay as they are
  • updates you add in the meantime go nowhere either
  • a maintenance does not start, not even automatically; once approved it starts at its planned time, or at once if that has passed

Those last two are why the rule holds. A notification going out while the page stays empty would have published the incident through the back door.

Only the first publication

Once an incident is approved, the updates after it need no further approval. If two people agree there is a disruption, reporting on it should not block again at every interim note.

That is a deliberate choice against the stricter reading. If your audit genuinely requires every single message to be approved, talk to us.

The escape hatch

For incidents — not maintenances — there is Publish without approval. You have to say why it cannot wait, and the reason lands in the audit log with your name on it.

That is by design, not a loophole. Four-eyes approval with no escape hatch means that at the first outage in the middle of the night, somebody switches the whole setting off — and then there is no trail at all. The audit value comes from the exception being recorded, not from it being impossible.

Maintenances do not have it: planned work can always wait for a colleague.

Through the API

Entries created through the API queue up the same way. The response tells you in is_published and is_awaiting_approval; for incidents it also says so in words in message:

{
  "data": {
    "is_published": false,
    "is_awaiting_approval": true,
    "approval_state": "pending"
  },
  "message": "Created, but held for approval: ..."
}

Check is_published in your pipeline, not just the status code. You get 201 whether or not the entry was actually published.

Four-eyes approval is switched on and off in the dashboard only, and approving is deliberately not available through the API — it is a human decision, and a token allowed to approve would be a fourth eye that is not one.

If you move to a smaller plan

New entries stop queueing up. Entries already waiting can still be approved — otherwise they would sit invisible forever. The setting can also be switched off again on any plan.