routes to approve and deny