Approval workflow

POST https://api.eventzero.io/api/v2/events/{eventId}/{type}/{recordId}/submit    # manager+ or assigned supplier → sets submitted
POST https://api.eventzero.io/api/v2/events/{eventId}/{type}/{recordId}/review    # manager+ → sets reviewed (+ feedback)
POST https://api.eventzero.io/api/v2/events/{eventId}/{type}/{recordId}/approve   # manager+ → sets approved

• Submit — a manager or an assigned supplier hands the record to the event team. Sets submitted: true.
• Review — a manager checks the record and can attach free-text feedback, which the supplier sees. Sets reviewed: true.
• Approve — a manager signs the record off. Sets approved: true; the record now counts in the event's carbon calculation.

curl -X POST https://api.eventzero.io/api/v2/events/<eventId>/flights/<recordId>/review \
  -H "Authorization: Bearer <accessToken>" \
  -H "Content-Type: application/json" \
  -d '{"feedback": "Passenger count looks high — please confirm against the manifest."}'

The workflow flags and feedback are server-controlled: writing them directly through create/update is silently ignored — the transitions are the only way to change them.

12 of the 16 record types support the workflow. The remaining types don't track submission state — their records are plain CRUD, and the transition endpoints don't exist for them (calling one returns 404).