2xx, and no money moves until someone approves.
List what is held
GET /approvals lists what is held, showing pending holds by default.
Approve or deny
POST /approvals/{approvalId}/approve releases the original payment. POST /approvals/{approvalId}/deny cancels it.
status now approved and resolvedAt set:
Approving clears only the gate you own. If the payment also breached a gate owned by someone else, it stays held until that owner acts too. When several breached gates share one owner, they merge into one hold that lists every reason, and the highest breached limit is the one you are clearing.