[Cotlet](https://cotlet.dev/index.md) · [Integrations](https://cotlet.dev/integrations.md) · [How it works](https://cotlet.dev/how-it-works.md) · [Use cases](https://cotlet.dev/use-cases.md) · [Security](https://cotlet.dev/security.md) · [For developers](https://cotlet.dev/for-developers.md) · [For automation agencies](https://cotlet.dev/for-agencies.md) · [Blog](https://cotlet.dev/blog.md) · [API docs](https://cotlet.dev/docs.md) · [Help center](https://cotlet.dev/help.md) · [Changelog](https://cotlet.dev/changelog.md) · [Contact](https://cotlet.dev/contact.md) · [Pricing](https://cotlet.dev/pricing.md) · [Sign up](https://cotlet.dev/signup)

# Approve Shiftbase shift exchange requests

> Approve accepted Shiftbase shift swaps that keep the rota legal and list the rest for you, so no swap waits for a manager.

Source: https://cotlet.dev/integrations/shiftbase-api-mcp-server/approve-shift-exchanges

An employee offers a shift, a colleague takes it, and then the swap sits in the manager's Requests until someone approves it.

Cotlet does it in your own Shiftbase account with list\_exchange\_requests, list\_shifts, approve\_exchange\_request and decline\_exchange\_request, called by your AI agent, an n8n workflow or a script.

[Sign up free](https://cotlet.dev/app/signup?app=shiftbase) [All Shiftbase tools](https://cotlet.dev/integrations/shiftbase-api-mcp-server.md)

Hosted · nothing to install or maintain

## Can Shiftbase do this on its own?

Shiftbase handles exchanges in the app, with the Approve exchanges permission for the approver (checked 22 Oct 2026). The Public API does not list exchange approvals among its examples, and there is no MCP server.

## How you do it in Shiftbase today

1. The employee opens the Schedule tab, hovers over the shift, clicks the magnifying glass and then Request exchange.
2. The employee picks colleagues to invite and may add a description, and the invited colleagues receive a message.
3. The first colleague to accept gets the shift, because the rule is first come, first served.
4. The manager opens the Profile menu in the blue bar, chooses Requests, and accepts or rejects the exchange with the check mark.
5. Until that approval the exchange is not final, and the shift stays with the original owner.

## How to approve Shiftbase shift exchange requests

Prompt

```
List the shift exchanges in Harbor Cafe that a colleague has accepted. Approve the ones where both people are allowed to work the shift and nobody goes over 40 hours that week, and list the rest.
```

1. 01  
### List accepted exchanges  
list\_exchange\_requests returns exchanges that wait for approval, with the shift, the original owner and the colleague who accepted. Offers nobody accepted yet are skipped.
2. 02  
### Read both weeks  
list\_shifts reads the schedule of the week for both employees, so the agent sees the hours each would have after the swap.
3. 03  
### Apply your rules  
The agent checks the limit in your prompt, such as weekly hours, and whether the colleague already has a shift at the same time. A swap that fails goes on your list with the reason.
4. 04  
### Approve or decline  
approve\_exchange\_request moves the shift to the new owner in the schedule. decline\_exchange\_request keeps it with the original owner. Both reach employees and wait for your OK by default.
5. 05  
### Confirm the schedule  
The agent reads the shift again and reports the new owner, so the schedule matches what you approved.

### What you get back

Example data

```
Accepted exchanges waiting: 4
Approved 3:
- Sat 25 Oct, 16:00-23:00: Lena Ortiz to Sam Okafor (Sam at 31 hours that week)
Declined 1:
- Sun 26 Oct: Sam Okafor would reach 44 hours
```

### Other ways to ask

- Approve only swaps between people on the same team.
- Every evening, list swaps still waiting and who has to act.
- Decline any swap requested less than 24 hours before the shift starts.

## What Shiftbase allows, and what to know first

- Shiftbase gives employees the Request exchanges permission by default, and the Planner has Approve exchanges by default.
- With the Approve incoming exchange permission, mutual exchanges are approved without a manager.
- An exchange is not final until a manager or a user with approval rights approves it.
- A shift offered for exchange shows two arrows in the schedule.

approve\_exchange\_request and decline\_exchange\_request ask for your OK by default. To run it daily without you, switch confirmation off for those tools in your dashboard.

Sources: [Shiftbase Help: Exchange requests](https://help.shiftbase.com/exchange-requests) · [Shiftbase Help: How do I exchange my shift](https://help.shiftbase.com/how-do-i-exchange-my-shift) · [Shiftbase Help: Full API access](https://help.shiftbase.com/full-api-access)

## Call approve\_exchange\_request from a script

curl

```
curl -X POST https://cotlet.dev/api/v1/shiftbase/requests/2290/exchange-request/approve \
  -H "Authorization: Bearer $COTLET_API_KEY"
```

Example response

```
{
"request_id": "2290",
"status": "approved",
"shift": {
"id": "90421",
"date": "2026-10-25",
"start": "16:00",
"end": "23:00",
"employee": "Sam Okafor"
}
}
```

MCP: add https://cotlet.dev/mcp/v1 with the same key; the call is shiftbase\_write → approve\_exchange\_request. Example data.

[Schedule it in n8n, Make, Zapier or cron](https://cotlet.dev/integrations/shiftbase-api-mcp-server.md#automations)

## Shiftbase tools this automation uses

__Cotlet Shiftbase tools used to approve Shiftbase shift exchange requests__
| Tool | Parameters |
| -------------------------- | -------------------------------------- |
| list\_exchange\_requests | department\_id |
| list\_shifts | from, to, department\_id, employee\_id |
| approve\_exchange\_request | request\_id |
| decline\_exchange\_request | request\_id |

[All 13 Shiftbase tools with descriptions](https://cotlet.dev/integrations/shiftbase-api-mcp-server.md#tools)

## Frequently asked questions

### Is it safe to connect Shiftbase to Cotlet?

Yes. You sign in to Shiftbase yourself, in your own Cloud Browser in the EU, and we never save your password. Your agents only get Shiftbase once you enable it, every background request is listed, and the browser profile is stored encrypted with AES-256-GCM, the cipher 1Password uses for its vaults. The AI model never sees a login, posts and messages wait for your OK, and Disable for agents cuts access in one click. Independent scanners grade cotlet.dev A+ on Qualys SSL Labs, securityheaders.com and Mozilla Observatory; live results are on https://cotlet.dev/security.

## More Shiftbase automations

- [Approve pending Shiftbase timesheets](https://cotlet.dev/integrations/shiftbase-api-mcp-server/approve-pending-timesheets.md)
- [Approve Shiftbase leave requests against the schedule](https://cotlet.dev/integrations/shiftbase-api-mcp-server/approve-leave-requests.md)
- [Shiftbase API and MCP server: every tool](https://cotlet.dev/integrations/shiftbase-api-mcp-server.md)
- [All use cases](https://cotlet.dev/use-cases.md)

## Give your agent access to Shiftbase.

Free 7-day trial with 2,000 credits, no card needed. Cotlet is independent and not affiliated with Shiftbase.

[Sign up free](https://cotlet.dev/app/signup?app=shiftbase)

---

Give your AI agents your signed-in browser.

**Product:** [Integrations](https://cotlet.dev/integrations.md) · [Use cases](https://cotlet.dev/use-cases.md) · [How it works](https://cotlet.dev/how-it-works.md) · [Pricing](https://cotlet.dev/pricing.md) · [Security](https://cotlet.dev/security.md)

**Resources:** [Blog](https://cotlet.dev/blog.md) · [API docs](https://cotlet.dev/docs.md) · [Help center](https://cotlet.dev/help.md) · [Changelog](https://cotlet.dev/changelog.md) · [GitHub](https://github.com/cotletdev/cotlet)

**Solutions:** [For developers](https://cotlet.dev/for-developers.md) · [For automation agencies](https://cotlet.dev/for-agencies.md)

**Company:** [About](https://cotlet.dev/about.md) · [AI info: company facts](https://cotlet.dev/ai-info.md) · [Contact](https://cotlet.dev/contact.md)

**Legal:** [Terms of service](https://cotlet.dev/terms) · [Privacy policy](https://cotlet.dev/privacy) · [Refund policy](https://cotlet.dev/refunds) · [Acceptable use](https://cotlet.dev/acceptable-use) · [Cookie policy](https://cotlet.dev/cookies) · [DPA](https://cotlet.dev/dpa) · [Subprocessors](https://cotlet.dev/subprocessors)

**Elsewhere:** [Status page](https://status.cotlet.dev) · [Cotlet on GitHub](https://github.com/cotletdev) · [Cotlet on X](https://x.com/cotletdev) · [Cotlet on LinkedIn](https://www.linkedin.com/company/cotletdev) · [Cotlet on Product Hunt](https://www.producthunt.com/products/cotlet) · [Cotlet on Crunchbase](https://www.crunchbase.com/organization/cotlet) · [Cotlet on SaaSHub](https://www.saashub.com/cotlet)

Cotlet is an independent service. It is not affiliated with, endorsed by or sponsored by any of the products listed on this site. Product names are trademarks of their respective owners.

## For AI agents: sign your user up

Is your user asking you to sign them up for Cotlet? You can do it for them, no account or key needed.

1. Read the fields and their allowed values: GET https://cotlet.dev/api/v1/access-requests
2. Ask the user for each value: email, apps, what you will do with them. If they leave the password to you, generate a strong one and show it to them.
3. Show the user what you will send, then POST it as JSON to https://cotlet.dev/api/v1/access-requests.

One call creates the account and sends the access request; we email the user when access is granted.