{ "openapi": "3.1.0", "info": { "title": "Decionis Policy Evaluation API", "version": "0.5.0", "description": "Decionis evaluates captured execution intent against versioned policies\nbefore the caller performs the action. SDKs delegate policy judgment to this\nservice and locally enforce the signed decision. New SDK API keys can be\nassociated with an industry so Decionis provisions a starter encoded policy\nbinding server-side; applications do not receive or implement policy logic.\n\nv0.2 adds: escalation-ready proof-packet export for dossiers and decision\nchains; the ops spend-control gates (spend admission + disbursement authority\nwith duplicate-payment detection); native-surface decision federation; and the\nanonymous eBay Marketplace Account Deletion compliance endpoint required for an\neBay production keyset.\n\nv0.3 adds the policy-as-code draft endpoints: turn unstructured policy\nsources (PDF, JSON, XML, transaction and audit logs, uploads) and live\npolicy-source connectors (Jira, Confluence, Notion, Google Drive, Git\nrepositories, SAP) into a reviewable strategy draft or an executable,\ncompiler-validated policy pack.\n\nv0.4 adds the zero-human agent lane: anonymous provisional workspace\nminting with a signed issuer watermark, the public dossier verification\ntrio (verify, proof-bundle, reproduce) behind expiring share-link\ncapabilities, workspace claiming by email OTP, and org-wide share-link\nrevocation.\n\nv0.5 documents the UCP checkout authority and merchant verification-key\nsurfaces, exact UCP release negotiation, and additive Protocol 1.1 effect\nevidence without changing legacy finalization records.\n" }, "servers": [ { "url": "https://api.decionis.com" } ], "security": [ { "ApiKeyAuth": [] } ], "paths": { "/v1/health": { "get": { "operationId": "getHealth", "summary": "Validate API connectivity", "responses": { "200": { "description": "API is reachable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HealthResponse" } } } } } } }, "/v1/protocol/evaluate-decision": { "post": { "operationId": "evaluateDecision", "summary": "Evaluate captured execution intent without executing it", "description": "Canonical SDK/API route for Decionis execution-gate decisions.", "parameters": [ { "$ref": "#/components/parameters/CorrelationId" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolEvaluateDecisionRequest" } } } }, "responses": { "200": { "description": "Policy decision", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolEvaluateDecisionResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "429": { "$ref": "#/components/responses/Error" }, "500": { "$ref": "#/components/responses/Error" } } } }, "/v1/authority/enforce-and-bind": { "post": { "operationId": "enforceAndBindAgentAction", "summary": "Evaluate and bind one exact agent action to a single-use execution grant", "description": "Canonical Agent-Safe enforcement route. Decionis recomputes the SHA-256\nhash of the canonical execution intent, evaluates policy in ENFORCEMENT\nmode, and issues a short-lived Ed25519 execution grant only for an ALLOW\nevaluated in ENFORCEMENT mode. SHADOW records the same exact intent and\ndossier evidence without issuing an execution grant.\nWhen Idempotency-Key is supplied, it must exactly match the intent_id\nembedded in the signed intent; intent_id is the grant issuance boundary.\nESCALATE, REVIEW_REQUIRED, BLOCK, dependency errors, and binding errors\nnever receive a grant. A Presence approval is accepted only after\nDecionis verifies the action-bound request and sealed receipt directly\nwith Presence; approval then becomes evidence for a fresh policy\nevaluation, not authority by itself.\nWhen escalation.mode is MANAGED and policy returns ESCALATE, Decionis\npersists the original exact intent and orchestrates the policy-issued\nPresence ceremony. The response remains non-authorizing and carries a\nmanaged_escalation status locator; no ExecutionBinding or execution\ntoken exists until signed Presence evidence is independently verified\nand current policy is evaluated again.\n", "parameters": [ { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionAuthorityRequest" } } } }, "responses": { "200": { "description": "Bound policy decision; only ALLOW carries an execution token", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionAuthorityDecision" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "409": { "description": "Presence evidence failed verification or the idempotency key is already bound", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ErrorResponse" }, { "$ref": "#/components/schemas/ExecutionAuthorityDecision" } ] } } } }, "429": { "$ref": "#/components/responses/Error" }, "503": { "description": "Authority or grant store unavailable; no execution is authorized", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ErrorResponse" }, { "$ref": "#/components/schemas/ExecutionAuthorityDecision" } ] } } } } } } }, "/v1/authority/escalations/{escalationId}": { "parameters": [ { "name": "escalationId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "org_id", "in": "query", "required": false, "description": "Organization UUID. Required for platform-authenticated callers;\norganization API keys derive and enforce their organization from the\nauthenticated credential.\n", "schema": { "type": "string", "format": "uuid" } } ], "get": { "operationId": "getManagedAuthorityEscalation", "summary": "Read Decionis-managed Presence authorization status", "description": "Returns tenant-scoped orchestration state without exposing Presence\ncredentials, invitation locators, authentication assertions, or biometric\nmaterial. A normal execution grant is present only at GRANT_READY, after\nDecionis has independently verified Presence evidence and re-evaluated\ncurrent policy for the original exact intent.\n", "responses": { "200": { "description": "Current managed escalation state", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedEscalationStatus" } } } }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } } }, "delete": { "operationId": "cancelManagedAuthorityEscalation", "summary": "Cancel a pending Decionis-managed Presence escalation", "responses": { "200": { "description": "Cancelled or already-terminal managed escalation", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManagedEscalationStatus" } } } }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "409": { "$ref": "#/components/responses/Error" } } } }, "/v1/authority/presence-completions": { "post": { "operationId": "notifyManagedPresenceCompletion", "summary": "Notify Decionis that signed Presence proof may be ready", "description": "Service-to-service recovery hint. The body is never authorization.\nDecionis locates the tenant-bound escalation, fetches the signed Presence\ndossier, verifies it independently, and performs current-policy\nre-authorization before any grant can be issued. Duplicate notifications\nare idempotent.\n", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PresenceAuthorityCompletion" } } } }, "responses": { "202": { "description": "Completion hint accepted or idempotently replayed" }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "409": { "$ref": "#/components/responses/Error" } } } }, "/v1/execution/verify-token": { "post": { "operationId": "verifyAgentExecutionToken", "summary": "Verify an execution grant without consuming it", "description": "Verifies the Ed25519 signature, issuer, audience, lifetime, action,\nactor, tenant, and exact intent hash. This endpoint does not authorize\nexecution by itself because it does not atomically consume the grant.\n", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionTokenRequest" } } } }, "responses": { "200": { "description": "Valid grant", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionTokenResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "409": { "description": "Grant invalid, expired, or not bound to the supplied intent", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionTokenResponse" } } } }, "429": { "$ref": "#/components/responses/Error" }, "503": { "description": "Grant verification unavailable; no execution is authorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionTokenResponse" } } } } } } }, "/v1/execution/consume-token": { "post": { "operationId": "consumeAgentExecutionToken", "summary": "Compatibility alias for pre-commit claim and revalidation", "description": "Identical to `/v1/execution/claim-token` for execution-bound Decision\nDossiers. New adapters should use the explicit claim route and must\nfinalize the result after the downstream attempt.\n", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionClaimTokenRequest" } } } }, "responses": { "200": { "description": "Binding revalidated and nonce claimed; caller may execute once", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionClaimTokenResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "409": { "description": "Stale authorization, replay, binding mismatch, or unresolved state", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionTokenResponse" } } } }, "429": { "$ref": "#/components/responses/Error" }, "503": { "description": "Revalidation state or claim store unavailable; no execution is authorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionTokenResponse" } } } } } } }, "/v1/execution/claim-token": { "post": { "operationId": "claimExecutionBoundDossier", "summary": "Revalidate and atomically claim one execution-bound authorization", "description": "Required immediately before the downstream commit. Verifies the dossier\nsignature and complete execution binding, resolves current policy,\nsignal, and Presence state, then atomically claims the nonce and mutable\nconcurrency scope. Execution is authorized only when `should_execute`\nis `true`, `claim_token` is non-null, and `claim_lease_expires_at` is\nstill live at the downstream boundary. `valid` alone is diagnostic;\nin SHADOW it may describe hypothetical validity without execution\nauthority.\n", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionClaimTokenRequest" } } } }, "responses": { "200": { "description": "Authorization remains valid and the nonce is claimed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionClaimTokenResponse" } } } }, "409": { "description": "Structured fail-closed revalidation outcome", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionTokenResponse" } } } }, "503": { "description": "Current state cannot be resolved", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionTokenResponse" } } } } } } }, "/v1/execution/finalize-token": { "post": { "operationId": "finalizeExecutionBoundDossier", "summary": "Finalize a claimed downstream commit attempt", "description": "Records COMMITTED, FAILED, or INDETERMINATE. INDETERMINATE effects must\nbe reconciled and are never safe for automatic retry. A COMMITTED claim\nproves an attempt was finalized, but an effect is confirmed only when\ndigest-bound `effect_evidence` with status CONFIRMED is accepted. If the\nsigned grant expires after a successful claim, finalization may continue\nonly while the exact persisted claim token, nonce, correlation, and\ndatabase claim lease remain valid. An expired unclaimed grant is never\nexecution-eligible. A finalize request at or after the database-clock\nlease boundary fails closed and atomically records the claim as\nINDETERMINATE.\n", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionFinalizeRequest" } } } }, "responses": { "200": { "description": "Claim finalized and commit evidence recorded or queued for recovery", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionFinalizeResponse" } } } }, "400": { "description": "Invalid finalization or effect-evidence shape", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "409": { "description": "Invalid, replayed, non-claimed, or lease-expired authorization. An expired claim reports outcome INDETERMINATE and CLAIM_LEASE_EXPIRED. A corrupt claim missing its claimed scope is also forced INDETERMINATE and reports CLAIM_SCOPE_INVARIANT_VIOLATION.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionFinalizeResponse" } } } } } } }, "/v1/ucp/checkout/authorize": { "post": { "operationId": "authorizeUcpCheckout", "summary": "Evaluate and bind authority for one UCP checkout completion", "description": "Accepts a complete UCP checkout response envelope negotiated at either\n2026-04-08 or 2026-08-25. The seven UCP top-level checkout fields are\nrequired and extension members remain open. August responses must also\ncarry ucp.payment_handlers; line items retain their official required\nfields and quantity floor; checkout totals contain exactly one subtotal\nand one total. Historical April callers retain the original adapter's\noptional payment-handler compatibility. Missing, ambiguous, or\nunsupported material fails before policy evaluation.\n\nDecionis authorizes; the connected merchant system remains responsible\nfor execution. An ALLOW decision is not itself an execution grant. An\nauthoritative response may carry an exact-action grant that must be\nclaimed immediately before the merchant commits the checkout, then\nfinalized as COMMITTED, FAILED, or INDETERMINATE.\n", "parameters": [ { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UcpCheckoutAuthorizeRequest" } } } }, "responses": { "200": { "description": "UCP-shaped authority result; execution authority remains fail-closed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UcpCheckoutAuthorizeResponse" } } } }, "400": { "description": "Invalid or unsupported UCP checkout envelope or mandate evidence", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ErrorResponse" }, { "$ref": "#/components/schemas/UcpCheckoutAuthorizeResponse" } ] } } } }, "401": { "$ref": "#/components/responses/Error" }, "403": { "description": "Policy refused the completion or the credential lacks authority", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/ErrorResponse" }, { "$ref": "#/components/schemas/UcpCheckoutAuthorizeResponse" } ] } } } }, "409": { "description": "The supplied or retained authority material conflicts with the exact checkout action", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UcpCheckoutAuthorizeResponse" } } } }, "429": { "$ref": "#/components/responses/Error" }, "503": { "description": "Authority unavailable; no execution is authorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UcpCheckoutAuthorizeResponse" } } } } } } }, "/v1/ucp/signing-keys": { "post": { "operationId": "registerUcpMerchantSigningKey", "summary": "Register a merchant public key for UCP terms verification", "description": "Registers only the public half of an EC signing key. Private key\nmaterial is rejected. Requires policy:write or org:* scope.\n", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UcpSigningKeyRegistrationRequest" } } } }, "responses": { "201": { "description": "Public verification key registered", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UcpSigningKey" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } } }, "get": { "operationId": "listUcpMerchantSigningKeys", "summary": "List active and revoked UCP merchant verification keys", "parameters": [ { "$ref": "#/components/parameters/UcpOrgId" } ], "responses": { "200": { "description": "Merchant verification-key inventory", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UcpSigningKeyListResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" } } } }, "/v1/ucp/signing-keys/{kid}": { "delete": { "operationId": "revokeUcpMerchantSigningKey", "summary": "Revoke, but retain, a UCP merchant verification key", "description": "Revoked key metadata remains available for historical evidence verification.", "parameters": [ { "name": "kid", "in": "path", "required": true, "schema": { "type": "string", "minLength": 1, "maxLength": 200 } }, { "$ref": "#/components/parameters/UcpOrgId" } ], "responses": { "200": { "description": "Key revoked", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UcpSigningKeyRevocationResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" } } } }, "/v1/decisions/evaluate": { "post": { "operationId": "evaluateDecisionSdkAlias", "summary": "Evaluate captured execution intent through the SDK compatibility route", "deprecated": true, "description": "Backwards-compatible alias for SDKs before the canonical protocol route.", "parameters": [ { "$ref": "#/components/parameters/CorrelationId" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecisionRequest" } } } }, "responses": { "200": { "description": "Policy decision", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecisionResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "429": { "$ref": "#/components/responses/Error" }, "500": { "$ref": "#/components/responses/Error" } } } }, "/v1/dossiers/{decision_id}": { "get": { "operationId": "createDossier", "summary": "Persist or retrieve the Decision Dossier for a decision", "parameters": [ { "name": "decision_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Decision Dossier", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecisionDossier" } } } }, "404": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/decision-chains/{chain_id}": { "get": { "operationId": "getDecisionChain", "summary": "Retrieve workflow lineage for linked Decionis decisions", "description": "Returns the protocol-owned Decision Chain for a workflow. Decision\nChains link evaluated execution intents into a causal graph without\nexposing policy rules or application-side guardrail logic.\n", "parameters": [ { "name": "chain_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "org_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Decision Chain", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecisionChain" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/decision-chains/by-evaluation/{evaluation_id}": { "get": { "operationId": "getDecisionChainByEvaluation", "summary": "Retrieve authenticated workflow lineage by evaluation", "description": "Resolves the tenant-bound Decision Chain containing the specified\nevaluation. The credential organization must match `org_id`.\n", "parameters": [ { "name": "evaluation_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "org_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Decision Chain", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecisionChain" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/dossiers/{dossier_id}/proof-packet": { "get": { "operationId": "getDossierProofPacket", "summary": "Export a single Decision Dossier as a portable, signed proof packet", "description": "Returns an escalation-ready proof packet for one dossier: the dossier\npayload, policy snapshot, ledger anchor, the Ed25519 proof bundle, and a\ncryptographic verification result with verify instructions. Suitable for\nrefund/overcharge dispute escalation and audit.\n", "parameters": [ { "name": "dossier_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "org_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Signed proof packet", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecisionDossierProofPacket" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/dossiers/{dossier_id}/agent-action-capsule": { "get": { "operationId": "exportAgentActionCapsuleV04", "summary": "Export a Decision Dossier execution lifecycle as an Agent Action Capsule", "description": "Returns an org-scoped Agent Action Capsule pinned to\ndraft-mih-scitt-agent-action-capsule-04. The Capsule is a compatibility\nprojection; the Decision Dossier remains the canonical Decionis record.\nPlanned, dispatched, and confirmed effects are never inferred from an\nauthorization verdict alone. This release is self-attested and does not\nclaim SCITT transparency anchoring.\n", "parameters": [ { "name": "dossier_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "org_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Draft-04 Agent Action Capsule that passed Class 1 verification", "headers": { "x-decionis-aac-profile": { "schema": { "type": "string", "const": "draft-mih-scitt-agent-action-capsule-04" } }, "x-decionis-class1-verified": { "schema": { "type": "string", "const": "true" } } }, "content": { "application/agent-action-capsule+json": { "schema": { "$ref": "#/components/schemas/AgentActionCapsuleV04" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/dossiers/{dossier_id}/agent-action-capsule/producer-envelopes": { "get": { "operationId": "exportAgentActionCapsuleProducerEnvelopesV04", "summary": "Export independent COSE Producer Envelopes over a Capsule ID", "description": "Returns a Decionis JSON carrying structure for zero or more independent\ndraft-04 Producer Envelopes. Each envelope is a tagged COSE_Sign1 whose\nattached payload is the raw 32-byte Capsule ID. A valid signature\nauthenticates the returned public key; authorization of that key for the\nCapsule operator remains caller policy. Producer Envelopes are separate\nfrom SCITT registration statements and receipts.\n", "parameters": [ { "name": "dossier_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "org_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Independent Producer Envelope results", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentActionCapsuleProducerEnvelopeResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/dossiers/{dossier_id}/agent-action-capsule/scitt-registration": { "post": { "operationId": "registerAgentActionCapsuleWithScitt", "summary": "Asynchronously submit the current Capsule ID to an allowlisted Transparency Service", "description": "Creates an RFC 9943 Signed Statement over the raw Capsule ID and queues\noptional registration outside the authority hot path. The operation is\nidempotent by org, Capsule ID, and Transparency Service. A received but\nunverified receipt is persisted as `RECEIPT_UNVERIFIED` and never\nupgrades the record to anchored.\n", "parameters": [ { "name": "dossier_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "org_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Existing verified registration", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScittCapsuleRegistrationResponse" } } } }, "202": { "description": "Registration queued or awaiting receipt-profile verification", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScittCapsuleRegistrationResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } } }, "get": { "operationId": "getAgentActionCapsuleScittRegistration", "summary": "Read optional SCITT registration and receipt-verification status", "parameters": [ { "name": "dossier_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "org_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "capsule_id", "in": "query", "required": false, "description": "Immutable historical Capsule ID; defaults to the current lifecycle projection.", "schema": { "type": "string", "pattern": "^[0-9a-f]{64}$" } } ], "responses": { "200": { "description": "Registration status", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScittCapsuleRegistrationResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/dossiers/{dossier_id}": { "get": { "operationId": "getDecisionDossier", "summary": "Fetch one tenant-bound Decision Dossier", "description": "Returns the persisted Decision Dossier for an authenticated tenant. An\nENFORCEMENT-mode ESCALATE dossier carries `authority_requirement` only\nwhen a matched policy rule explicitly defines Presence authority and\nthe evaluation supplied a valid canonical `context.action_context`.\n", "parameters": [ { "name": "dossier_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "org_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Tenant-bound Decision Dossier", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolDecisionDossierResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/decision-chains/{chain_id}/proof-packet": { "get": { "operationId": "getDecisionChainProofPacket", "summary": "Retrieve an authenticated Decision Chain verification report", "description": "Legacy path retained for compatibility. Returns a bounded, point-in-time\nserver verification report covering the linked dossiers and chain\nintegrity known to Decionis. The compact response does not embed source\ndossier proof bundles or the canonical ledger hash path and has no\ntop-level signature. It is therefore not a portable or offline-verifiable\nproof artifact; independently verify the referenced dossiers and ledger\nevidence obtained from their authorized source.\n", "parameters": [ { "name": "chain_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "org_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Authenticated point-in-time Decision Chain verification report", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecisionChainProofPacket" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/ops/spend-admission/verify": { "post": { "operationId": "opsSpendAdmissionVerify", "summary": "Govern a spend request (Gate 1 — spend admission)", "description": "Evaluates an expense / vendor-payment / refund / credit request against the\nops spend-control vertical pack (approval threshold + dual authorization,\nvendor verification, refund/credit limits). Runs the full shared\nevaluate-decision pipeline and returns a signed dossier reference.\n", "parameters": [ { "$ref": "#/components/parameters/CorrelationId" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpsGateRequest" } } } }, "responses": { "200": { "description": "Ops gate verdict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpsGateVerdict" } } } }, "401": { "$ref": "#/components/responses/Error" }, "502": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/ops/disbursement-authority/verify": { "post": { "operationId": "opsDisbursementAuthorityVerify", "summary": "Govern a disbursement (Gate 2 — disbursement authority)", "description": "Evaluates a vendor payment at release time: authorized role, segregation of\nduties, dual authorization, and duplicate-payment detection (a vendor +\ninvoice/amount fingerprint compared against prior org evaluations in the\nlookback window).\n", "parameters": [ { "$ref": "#/components/parameters/CorrelationId" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpsGateRequest" } } } }, "responses": { "200": { "description": "Ops gate verdict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpsGateVerdict" } } } }, "401": { "$ref": "#/components/responses/Error" }, "502": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/surfaces/decisions": { "post": { "operationId": "federateSurfaceDecision", "summary": "Federate a native-surface decision into the shared audit ledger", "description": "Records a decision made by a Layer-A commerce surface (Amazon, eBay,\nShopify) into the cross-surface SHA-256 audit ledger. When the full signed\ndossier is included it is persisted and becomes retrievable + exportable as\na proof packet; otherwise only a ledger entry is appended (backward\ncompatible).\n", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SurfaceDecisionRequest" } } } }, "responses": { "200": { "description": "Federation result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SurfaceDecisionResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "502": { "$ref": "#/components/responses/Error" } } } }, "/ebay/marketplace-account-deletion": { "get": { "operationId": "ebayAccountDeletionChallenge", "summary": "eBay Marketplace Account Deletion validation challenge", "description": "Anonymous endpoint required for an eBay PRODUCTION keyset. eBay sends a\n`challenge_code`; the response is the hex SHA-256 of\nchallengeCode + verificationToken + endpointURL. Requires\nEBAY_VERIFICATION_TOKEN and EBAY_DELETION_ENDPOINT_URL to be configured.\nNo authentication — eBay sends no credentials.\n", "security": [], "parameters": [ { "name": "challenge_code", "in": "query", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Challenge response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EbayChallengeResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } } }, "post": { "operationId": "ebayAccountDeletionNotification", "summary": "eBay Marketplace Account Deletion notification", "description": "Anonymous endpoint that receives an eBay account-deletion notification and\nacknowledges it. Decionis stores no eBay consumer PII, so there is nothing\nto purge beyond acknowledgement.\n", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MarketplaceDeletionNotification" } } } }, "responses": { "200": { "description": "Acknowledged", "content": { "application/json": { "schema": { "type": "object", "properties": { "ok": { "type": "boolean" } } } } } } } } }, "/v1/policies/validate": { "post": { "operationId": "validatePolicy", "summary": "Validate an encoded policy document", "parameters": [ { "$ref": "#/components/parameters/CorrelationId" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Policy validation result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyValidationResponse" } } } } } } }, "/v1/protocol/policies/bundles": { "post": { "operationId": "encodePolicyBundle", "summary": "Submit a versioned policy bundle artifact for Decionis encoding", "description": "Use this endpoint only when an integration participates in policy\nauthoring. The SDK submits a reviewed policy bundle artifact to\nDecionis; it does not evaluate or enforce policy rules locally.\n", "parameters": [ { "$ref": "#/components/parameters/CorrelationId" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyBundle" } } } }, "responses": { "202": { "description": "Policy bundle accepted for encoding", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArtifactAcceptedResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/signals/envelopes": { "post": { "operationId": "ingestProtocolSignalEnvelope", "summary": "Ingest a versioned Protocol signal envelope", "description": "Persists an evidence-bearing signal for deterministic policy evaluation\nand material-signal revalidation. Semantic classifier metadata is input\nevidence only and cannot mint an authority verdict or execution grant.\n", "parameters": [ { "$ref": "#/components/parameters/CorrelationId" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolSignalEnvelope" } } } }, "responses": { "202": { "description": "Signal envelope accepted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArtifactAcceptedResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" } } } }, "/v1/orgs/{org_id}/policies/strategies/draft": { "post": { "operationId": "draftPolicyStrategy", "summary": "Draft a reviewable policy strategy from unstructured sources", "description": "Turns scattered policy material — pasted text and uploaded files\n(PDF, XLSX, XML, HTML, JSON, plain text such as transaction or audit\nlogs) plus optional live policy-source connectors (Jira, Confluence,\nNotion, Google Drive, Git repository, SAP) — into a strategy-shaped\nDecionis draft with clauses bucketed for automatic execution,\nescalation, and blocking. The draft is not persisted: review it, then\nencode the accepted version. Drafting is LLM-assisted when a provider\nis configured and falls back to deterministic extraction otherwise;\n`used_llm` reports which path ran. Requires an org API key with the\nADMIN role and the `autonomous:manage` or `org:*` scope.\n", "parameters": [ { "name": "org_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "$ref": "#/components/parameters/CorrelationId" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyDraftRequest" } } } }, "responses": { "200": { "description": "Non-persistent policy strategy draft", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyStrategyDraftResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "502": { "$ref": "#/components/responses/Error" } } } }, "/v1/orgs/{org_id}/policies/packs/draft": { "post": { "operationId": "draftPolicyPack", "summary": "Draft an executable policy pack from unstructured sources", "description": "Same inputs as the strategy draft, but the output is the executable\nDecionis policy pack — `{ name, all|any: [{field, op, value}], action }`\nrules. Every synthesized rule is validated through the rules compiler\nbefore it is returned; anything that cannot become an executable\npredicate is returned under `review`, never as a broken rule. The\ndraft is persisted for the org (`pack_id`) so it can be reviewed,\nedited, and finalized. Requires an org API key with the ADMIN role\nand the `autonomous:manage` or `org:*` scope.\n", "parameters": [ { "name": "org_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "$ref": "#/components/parameters/CorrelationId" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyDraftRequest" } } } }, "responses": { "200": { "description": "Persisted executable policy pack draft", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyPackDraftResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "502": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/shadow/evaluate-decision/reports": { "get": { "operationId": "listShadowEvaluateDecisionReports", "summary": "List shadow-mode decision evaluation reports", "description": "Returns protocol-owned shadow reports derived from saved\nevaluate-decision records. Reports summarize what Decionis would\ncontinue, stop, hand off, or review without exposing policy rules.\n", "parameters": [ { "name": "org_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "mode", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ], "default": "SHADOW" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 500, "default": 50 } }, { "name": "since", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } } ], "responses": { "200": { "description": "Shadow report list", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ShadowEvaluateDecisionReportsResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/shadow/evaluate-decision/reports/summary": { "get": { "operationId": "summarizeShadowEvaluateDecisionReports", "summary": "Summarize shadow-mode decision evaluation reports", "description": "Returns aggregate protocol-owned shadow report metrics for saved\nevaluate-decision records.\n", "parameters": [ { "name": "org_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "mode", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ], "default": "SHADOW" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 500, "default": 50 } }, { "name": "since", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } } ], "responses": { "200": { "description": "Shadow report summary", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ShadowEvaluateDecisionReportsSummaryResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" } } } }, "/v1/analytics/events": { "post": { "operationId": "recordAnalyticsEvent", "summary": "Ingest a public experiment analytics event", "description": "Public sink for proof-led A/B exposure and conversion events. Events are\nidempotent on visitor_id, experiment, event, and occurred_at.\n", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AnalyticsEventRequest" } } } }, "responses": { "202": { "description": "Analytics event accepted", "content": { "application/json": { "schema": { "type": "object", "required": [ "accepted", "event_id", "idempotent_replay", "experiment", "variant", "report" ], "properties": { "accepted": { "type": "boolean" }, "event_id": { "type": "string", "format": "uuid" }, "idempotent_replay": { "type": "boolean" }, "experiment": { "type": "string" }, "variant": { "type": "string", "enum": [ "A", "B" ] }, "report": { "$ref": "#/components/schemas/AnalyticsExperimentReport" } } } } } }, "400": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } } } }, "/v1/analytics/experiments/{experiment}/report": { "get": { "operationId": "getAnalyticsExperimentReport", "summary": "Report exposure-to-conversion rates for an experiment", "parameters": [ { "name": "experiment", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "window_days", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 365, "default": 90 } }, { "name": "conversion_event", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Experiment conversion report", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AnalyticsExperimentReport" } } } }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } } } }, "/v1/compliance/evidence-pack": { "post": { "operationId": "createComplianceEvidencePack", "summary": "Generate and persist a signed compliance evidence pack", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ComplianceEvidencePackRequest" } } } }, "responses": { "201": { "description": "Signed evidence pack", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ComplianceEvidencePackResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } } } }, "/v1/verify/evidence/{pack_id}": { "get": { "operationId": "verifyComplianceEvidencePack", "summary": "Publicly verify a signed compliance evidence pack", "security": [], "parameters": [ { "name": "pack_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Evidence pack verification result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EvidencePackVerificationResponse" } } } }, "404": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } } } }, "/v1/public/agents/provision": { "post": { "operationId": "provisionAnonymousAgentWorkspace", "summary": "Mint a provisional anonymous workspace and API key", "security": [], "description": "Zero-human onboarding entry point. Mints a provisional workspace, its\norg API key, and a seeded shadow-mode default policy — no account, no\nemail. Hard caps: 10 requests per minute, 5 provisional workspaces per\nnetwork per 24 hours, and an exploration allowance of 50 governed\ndecisions per month. The raw key is returned exactly once. Every\ndossier a provisional workspace mints carries a SIGNED issuer_context\ntier of \"provisional_anonymous\" inside the dossier claims, so a\nverifier can always distinguish it from an owned org's dossier.\nClaiming (POST /v1/orgs/{org_id}/claim/start then /claim/verify)\nattaches a human owner; the key and the dossier ledger survive the\nclaim.\n", "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentProvisionRequest" } } } }, "responses": { "201": { "description": "Provisional workspace minted; the raw key appears only here", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentProvisionResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "429": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } } } }, "/v1/public/decision-dossiers/{dossier_id}/verify": { "get": { "operationId": "verifyPublicDecisionDossier", "summary": "Verify a Decision Dossier — no account required", "security": [], "description": "Runs the real Ed25519 verification against the published public JWKS —\nthe same check anyone can reproduce offline with @decionis/verify —\nand returns a share-safe, masked projection of the dossier. The ?sig\ncapability comes from a dossier's verification envelope and only gates\naccess (it keeps dossier ids from being enumerated); the signatures\nprove authenticity. Every capability failure collapses to the same\n404 — no oracle about which check failed.\n", "parameters": [ { "$ref": "#/components/parameters/PublicDossierId" }, { "$ref": "#/components/parameters/ShareLinkSignature" }, { "$ref": "#/components/parameters/ShareLinkExpiry" } ], "responses": { "200": { "description": "Verification result with a masked public dossier projection", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicDossierVerificationResponse" } } } }, "404": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } } } }, "/v1/public/decision-dossiers/{dossier_id}/proof-bundle": { "get": { "operationId": "getPublicDecisionDossierProofBundle", "summary": "Fetch the signed documents and Ed25519 proof bundle", "security": [], "description": "Returns only what independent verification needs: the signed documents\nat their JSON-pointer paths, the Ed25519 proof bundle, and the public\nJWKS URL. Same ?sig share-link capability as /verify. Verify offline\nwith `npx @decionis/verify \"\"`. Exit 0 means the presented\nproof artifacts are cryptographically valid; it does not by itself\nestablish current execution eligibility.\n", "parameters": [ { "$ref": "#/components/parameters/PublicDossierId" }, { "$ref": "#/components/parameters/ShareLinkSignature" }, { "$ref": "#/components/parameters/ShareLinkExpiry" } ], "responses": { "200": { "description": "Signed documents plus the proof bundle and JWKS pointer", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicDossierProofBundleResponse" } } } }, "404": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } } } }, "/v1/public/decision-dossiers/{dossier_id}/reproduce": { "get": { "operationId": "reproducePublicDecisionDossier", "summary": "Deterministically re-run the recorded decision", "security": [], "description": "Re-runs the recorded inputs through the recorded policy bundle in the\nprotocol engine — side-effect-free, nothing persisted — and reports\nwhether the same verdict comes out. Same ?sig capability as /verify;\nbecause replay actually runs the policy engine, results are cached for\nabout 60 seconds and capped at 20 requests per minute per dossier.\n", "parameters": [ { "$ref": "#/components/parameters/PublicDossierId" }, { "$ref": "#/components/parameters/ShareLinkSignature" }, { "$ref": "#/components/parameters/ShareLinkExpiry" } ], "responses": { "200": { "description": "Reproduction outcome for the recorded decision", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicDossierReproduceResponse" } } } }, "404": { "$ref": "#/components/responses/Error" }, "429": { "$ref": "#/components/responses/Error" }, "502": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } } } }, "/v1/orgs/{org_id}/claim/start": { "post": { "operationId": "startOrgClaim", "summary": "Start claiming a provisional workspace (email OTP)", "description": "First half of attaching a human owner to an anonymously minted\nworkspace. Org-key authed — holding the workspace's key is the\npossession proof that decides who may attach an owner. The org must be\nprovisional and unclaimed. Emails a six-digit OTP with a 5-minute\nexpiry to owner_email; 10 requests per minute.\n", "parameters": [ { "name": "org_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OrgClaimStartRequest" } } } }, "responses": { "202": { "description": "OTP challenge created and emailed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OrgClaimStartResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "404": { "description": "Not a provisional workspace (it already has an owner path)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "409": { "description": "The workspace is already claimed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "502": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } } } }, "/v1/orgs/{org_id}/claim/verify": { "post": { "operationId": "verifyOrgClaim", "summary": "Finish claiming a provisional workspace", "description": "Second half of the claim: org-key authed, with a timing-safe check of\nthe emailed OTP (3 attempts per challenge). Attaches an existing\naccount by email or creates one — a new account requires a password so\nthe claimed identity can sign back in. The claim is atomic; the API\nkey and every dossier minted before the claim survive. 10 requests per\nminute.\n", "parameters": [ { "name": "org_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OrgClaimVerifyRequest" } } } }, "responses": { "200": { "description": "Workspace claimed; a signed account session cookie is set", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OrgClaimVerifyResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "description": "OTP invalid, expired, or attempt cap reached", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "404": { "$ref": "#/components/responses/Error" }, "409": { "description": "Already claimed, or the OTP was already used", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "503": { "$ref": "#/components/responses/Error" } } } }, "/v1/orgs/{org_id}/verification-links/rotate": { "post": { "operationId": "rotateOrgVerificationLinks", "summary": "Revoke every outstanding v2 dossier share link for the org", "description": "v2 dossier share links are signed with a per-org derived secret;\nbumping the org's secret version invalidates every v2 link the org has\never minted — one org, one bump, nothing global. Freshly minted links\nuse the new version. Revoking every outstanding share link is an admin\nact: requires an org API key with the ADMIN role. 5 requests per\nminute.\n", "parameters": [ { "name": "org_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Secret version bumped; all previously issued v2 links are dead", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OrgVerificationLinkRotationResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" } } } } }, "components": { "securitySchemes": { "ApiKeyAuth": { "type": "http", "scheme": "bearer" } }, "parameters": { "CorrelationId": { "name": "X-Correlation-ID", "in": "header", "required": false, "schema": { "type": "string" } }, "IdempotencyKey": { "name": "Idempotency-Key", "in": "header", "required": false, "schema": { "type": "string" } }, "UcpOrgId": { "name": "org_id", "in": "query", "required": false, "description": "Optional when the authenticated API key is already bound to an organization.", "schema": { "type": "string", "format": "uuid" } }, "PublicDossierId": { "name": "dossier_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, "ShareLinkSignature": { "name": "sig", "in": "query", "required": true, "description": "The share-link capability from a dossier's verification envelope. An access gate, not proof of authenticity — the Ed25519 signatures in the proof bundle are what prove the dossier. A missing or wrong value returns the same 404 as an unknown dossier.", "schema": { "type": "string" } }, "ShareLinkExpiry": { "name": "exp", "in": "query", "required": false, "description": "Expiry (epoch seconds) of a v2 org-scoped share link. Bound into the signature — stripping or editing it invalidates the link. Absent only on legacy expiry-less links, which deployments may refuse.", "schema": { "type": "string" } } }, "responses": { "Error": { "description": "Structured API error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } } }, "schemas": { "AnalyticsSegment": { "type": [ "string", "null" ], "enum": [ "compliance", "risk", "finance", "technical", null ] }, "AnalyticsEventRequest": { "type": "object", "required": [ "experiment", "variant", "event", "visitor_id", "page_path", "occurred_at" ], "properties": { "experiment": { "type": "string", "examples": [ "proof_led_page" ] }, "variant": { "type": "string", "enum": [ "A", "B" ] }, "event": { "type": "string", "examples": [ "exposure", "qualified_demo", "signup" ] }, "segment": { "$ref": "#/components/schemas/AnalyticsSegment" }, "visitor_id": { "type": "string" }, "page_path": { "type": "string", "examples": [ "/proof-led" ] }, "occurred_at": { "type": "string", "format": "date-time" }, "metadata": { "type": "object", "additionalProperties": true } }, "additionalProperties": false }, "AnalyticsConversionRate": { "type": "object", "required": [ "variant", "segment", "exposed_visitors", "converted_visitors", "conversion_rate" ], "properties": { "variant": { "type": "string", "enum": [ "A", "B" ] }, "segment": { "$ref": "#/components/schemas/AnalyticsSegment" }, "exposed_visitors": { "type": "integer", "minimum": 0 }, "converted_visitors": { "type": "integer", "minimum": 0 }, "conversion_rate": { "type": "number", "minimum": 0 } }, "additionalProperties": false }, "AnalyticsExperimentReport": { "type": "object", "required": [ "generated_at", "experiment", "window_days", "conversion_event", "variants", "segments" ], "properties": { "generated_at": { "type": "string", "format": "date-time" }, "experiment": { "type": "string" }, "window_days": { "type": "integer" }, "conversion_event": { "type": [ "string", "null" ] }, "variants": { "type": "array", "items": { "$ref": "#/components/schemas/AnalyticsConversionRate" } }, "segments": { "type": "array", "items": { "$ref": "#/components/schemas/AnalyticsConversionRate" } } }, "additionalProperties": false }, "ComplianceFrameworkId": { "type": "string", "enum": [ "eu_ai_act", "gdpr", "soc2" ] }, "ComplianceEvidencePackRequest": { "type": "object", "required": [ "org_id", "session_id", "workflow_label", "window_days", "frameworks" ], "properties": { "org_id": { "type": "string", "format": "uuid" }, "session_id": { "type": "string" }, "workflow_label": { "type": "string", "examples": [ "Vendor payments" ] }, "window_days": { "type": "integer", "minimum": 1, "maximum": 365 }, "frameworks": { "type": "array", "items": { "$ref": "#/components/schemas/ComplianceFrameworkId" } } }, "additionalProperties": false }, "ComplianceEvidencePackMetrics": { "type": "object", "required": [ "decisions", "blocked", "escalated", "human_oversight", "recordkeeping" ], "properties": { "decisions": { "type": "integer", "minimum": 0 }, "blocked": { "type": "integer", "minimum": 0 }, "escalated": { "type": "integer", "minimum": 0 }, "human_oversight": { "type": "integer", "minimum": 0 }, "recordkeeping": { "type": "integer", "minimum": 0 } }, "additionalProperties": false }, "ComplianceEvidenceControl": { "type": "object", "required": [ "ref", "name", "requirement", "evidence", "metric_value" ], "properties": { "ref": { "type": "string" }, "name": { "type": "string" }, "requirement": { "type": "string" }, "evidence": { "type": "string" }, "metric": { "type": "string", "enum": [ "decisions", "blocked", "escalated", "humanOversight", "recordkeeping" ] }, "metric_value": { "type": [ "integer", "null" ], "minimum": 0 } }, "additionalProperties": false }, "ComplianceEvidenceFramework": { "type": "object", "required": [ "id", "name", "controls" ], "properties": { "id": { "$ref": "#/components/schemas/ComplianceFrameworkId" }, "name": { "type": "string" }, "controls": { "type": "array", "items": { "$ref": "#/components/schemas/ComplianceEvidenceControl" } } }, "additionalProperties": false }, "ComplianceEvidencePackResponse": { "type": "object", "required": [ "pack_id", "generated_at", "signature", "verification_url", "metrics", "frameworks", "download_url" ], "properties": { "pack_id": { "type": "string", "format": "uuid" }, "generated_at": { "type": "string", "format": "date-time" }, "signature": { "type": "string", "examples": [ "ed25519:key-id:base64url-signature" ] }, "verification_url": { "type": "string", "format": "uri" }, "metrics": { "$ref": "#/components/schemas/ComplianceEvidencePackMetrics" }, "frameworks": { "type": "array", "items": { "$ref": "#/components/schemas/ComplianceEvidenceFramework" } }, "download_url": { "type": "string", "format": "uri" } }, "additionalProperties": false }, "EvidencePackVerificationResponse": { "type": "object", "required": [ "service", "verified", "valid", "checked_at", "pack", "signature" ], "properties": { "service": { "type": "string", "enum": [ "decionis" ] }, "verified": { "type": "boolean" }, "valid": { "type": "boolean" }, "checked_at": { "type": "string", "format": "date-time" }, "pack": { "type": "object", "additionalProperties": true }, "signature": { "type": "object", "additionalProperties": true } }, "additionalProperties": false }, "AuthorityClassification": { "type": "string", "enum": [ "AUTHORITATIVE", "OBSERVATIONAL" ], "description": "Authority possessed by an artifact, independent of its verdict. Only AUTHORITATIVE artifacts may become execution-eligible." }, "PolicyReference": { "type": "object", "additionalProperties": false, "required": [ "policy_id", "revision_id", "version", "digest" ], "properties": { "policy_id": { "type": "string", "minLength": 1, "maxLength": 500 }, "revision_id": { "type": "string", "minLength": 1, "maxLength": 500 }, "version": { "type": "string", "minLength": 1, "maxLength": 500 }, "digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } } }, "EvaluationSemantics": { "type": "object", "additionalProperties": false, "required": [ "protocol_version", "evaluator_version", "policy_schema_version", "canonicalization", "digest_algorithm", "signal_normalization_version" ], "properties": { "protocol_version": { "type": "string", "const": "1.1" }, "evaluator_version": { "type": "string", "minLength": 1, "maxLength": 500 }, "policy_schema_version": { "type": "string", "minLength": 1, "maxLength": 500 }, "canonicalization": { "type": "string", "const": "RFC8785/JCS" }, "digest_algorithm": { "type": "string", "const": "SHA-256" }, "signal_normalization_version": { "type": "string", "minLength": 1, "maxLength": 500 } } }, "UcpProtocolVersion": { "type": "string", "enum": [ "2026-04-08", "2026-08-25" ], "description": "UCP releases whose checkout response envelopes this adapter validates." }, "UcpCapabilityReference": { "type": "object", "additionalProperties": true, "required": [ "version" ], "properties": { "version": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}$" }, "spec": { "type": "string", "format": "uri", "maxLength": 2000 }, "schema": { "type": "string", "format": "uri", "maxLength": 2000 }, "id": { "type": "string", "minLength": 1, "maxLength": 500 }, "extends": { "oneOf": [ { "type": "string", "minLength": 1, "maxLength": 500 }, { "type": "array", "minItems": 1, "maxItems": 50, "items": { "type": "string", "minLength": 1, "maxLength": 500 } } ] }, "config": { "type": "object", "additionalProperties": true } } }, "UcpPaymentHandlerReference": { "type": "object", "additionalProperties": true, "required": [ "version", "id" ], "properties": { "version": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}$" }, "id": { "type": "string", "minLength": 1, "maxLength": 500 }, "spec": { "type": "string", "format": "uri", "maxLength": 2000 }, "schema": { "type": "string", "format": "uri", "maxLength": 2000 }, "config": { "type": "object", "additionalProperties": true } } }, "UcpCheckoutEnvelope": { "type": "object", "additionalProperties": true, "required": [ "version" ], "properties": { "version": { "$ref": "#/components/schemas/UcpProtocolVersion" }, "status": { "type": "string", "enum": [ "success", "error" ] }, "capabilities": { "type": "object", "propertyNames": { "type": "string", "pattern": "^[a-z](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9_-]*[a-z0-9_])?)+$" }, "additionalProperties": { "type": "array", "maxItems": 50, "items": { "$ref": "#/components/schemas/UcpCapabilityReference" } }, "description": "Negotiated UCP capabilities keyed by reverse-domain identifier. A capability is active only through a matching versioned reference; key presence or an empty array is not negotiation." }, "payment_handlers": { "type": "object", "propertyNames": { "type": "string", "pattern": "^[a-z](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9_-]*[a-z0-9_])?)+$" }, "additionalProperties": { "type": "array", "maxItems": 50, "items": { "$ref": "#/components/schemas/UcpPaymentHandlerReference" } } } } }, "UcpCheckoutTotal": { "type": "object", "additionalProperties": true, "required": [ "type", "amount" ], "properties": { "type": { "type": "string", "minLength": 1, "maxLength": 120 }, "amount": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991, "description": "ISO 4217 minor units." }, "display_text": { "type": "string", "minLength": 1, "maxLength": 200 } }, "allOf": [ { "if": { "required": [ "type" ], "properties": { "type": { "enum": [ "discount", "items_discount" ] } } }, "then": { "properties": { "amount": { "maximum": -1 } } } }, { "if": { "required": [ "type" ], "properties": { "type": { "enum": [ "subtotal", "fulfillment", "tax", "fee" ] } } }, "then": { "properties": { "amount": { "minimum": 0 } } } }, { "if": { "required": [ "type" ], "properties": { "type": { "not": { "enum": [ "subtotal", "items_discount", "discount", "fulfillment", "tax", "fee", "total" ] } } } }, "then": { "required": [ "display_text" ] } } ] }, "UcpCheckoutLineItem": { "type": "object", "additionalProperties": true, "required": [ "id", "item", "quantity", "totals" ], "properties": { "id": { "type": "string", "minLength": 1, "maxLength": 200 }, "quantity": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 }, "item": { "type": "object", "additionalProperties": true, "required": [ "id", "title", "price" ], "properties": { "id": { "type": "string", "minLength": 1, "maxLength": 200 }, "title": { "type": "string", "minLength": 1, "maxLength": 400 }, "price": { "type": "integer", "minimum": 0, "maximum": 9007199254740991, "description": "ISO 4217 minor units." } } }, "totals": { "type": "array", "maxItems": 50, "items": { "$ref": "#/components/schemas/UcpCheckoutTotal" } } } }, "UcpCheckoutLink": { "type": "object", "additionalProperties": true, "required": [ "type", "url" ], "properties": { "type": { "type": "string", "minLength": 1, "maxLength": 120 }, "url": { "type": "string", "format": "uri", "maxLength": 2000 }, "title": { "type": "string", "maxLength": 400 } } }, "UcpCheckoutSession": { "type": "object", "additionalProperties": true, "description": "Validated core checkout response plus any negotiated extensions. The seven top-level required members are common to UCP 2026-04-08 and 2026-08-25; the version conditional below additionally requires the August response payment-handler registry.", "required": [ "ucp", "id", "line_items", "status", "currency", "totals", "links" ], "properties": { "ucp": { "$ref": "#/components/schemas/UcpCheckoutEnvelope" }, "id": { "type": "string", "minLength": 1, "maxLength": 200 }, "line_items": { "type": "array", "maxItems": 500, "items": { "$ref": "#/components/schemas/UcpCheckoutLineItem" } }, "status": { "type": "string", "enum": [ "incomplete", "requires_escalation", "ready_for_complete", "complete_in_progress", "completed", "canceled" ] }, "currency": { "type": "string", "pattern": "^[A-Z]{3}$", "description": "ISO 4217 List One code with a numeric minor unit, pinned to the maintenance-agency list published 2026-01-01. Unknown codes and entries whose minor unit is N.A. are rejected before evaluation." }, "totals": { "type": "array", "minItems": 2, "maxItems": 50, "items": { "$ref": "#/components/schemas/UcpCheckoutTotal" }, "allOf": [ { "contains": { "type": "object", "required": [ "type" ], "properties": { "type": { "const": "subtotal" } } }, "minContains": 1, "maxContains": 1 }, { "contains": { "type": "object", "required": [ "type" ], "properties": { "type": { "const": "total" } } }, "minContains": 1, "maxContains": 1 } ] }, "links": { "type": "array", "maxItems": 100, "items": { "$ref": "#/components/schemas/UcpCheckoutLink" } }, "signals": { "type": "object", "additionalProperties": true }, "ap2": { "type": "object", "additionalProperties": true, "properties": { "checkout_mandate": { "type": "string", "maxLength": 8192 }, "merchant_authorization": { "type": "string", "maxLength": 8192 } } } }, "allOf": [ { "if": { "properties": { "ucp": { "type": "object", "required": [ "version" ], "properties": { "version": { "const": "2026-08-25" } } } } }, "then": { "properties": { "ucp": { "required": [ "payment_handlers" ] } } } } ] }, "UcpCheckoutAuthorizeRequest": { "type": "object", "additionalProperties": false, "required": [ "checkout" ], "properties": { "org_id": { "type": "string", "format": "uuid", "description": "Optional when the authenticated API key is organization-bound." }, "checkout": { "$ref": "#/components/schemas/UcpCheckoutSession" }, "agent": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "maxLength": 200 }, "human_present": { "type": "boolean" }, "environment": { "type": "string", "minLength": 1, "maxLength": 120, "pattern": "^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$", "description": "Merchant execution environment committed into the signed downstream target, for example base-sepolia or production." } } }, "approval_url": { "type": "string", "format": "uri", "pattern": "^https://(?![^/?#]*@)", "maxLength": 2000 }, "mode": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ], "default": "ENFORCEMENT" }, "grant_ttl_seconds": { "type": "integer", "minimum": 1, "maximum": 300 }, "idempotency_key": { "type": "string", "minLength": 1, "maxLength": 180 }, "degradation_mode": { "type": "string", "enum": [ "fail_closed" ], "default": "fail_closed", "description": "Compatibility field. Execution authority always fails closed; caller-selected fail-open is rejected." } } }, "UcpMandateVerification": { "type": "object", "additionalProperties": false, "required": [ "verified", "status", "checked", "not_checked" ], "properties": { "verified": { "type": "boolean", "deprecated": true, "description": "Compatibility rollup; use status to distinguish inapplicable from unverified." }, "status": { "type": "string", "enum": [ "VERIFIED", "UNVERIFIED", "NOT_APPLICABLE" ] }, "checked": { "type": "array", "items": { "type": "string" } }, "not_checked": { "type": "array", "items": { "type": "string" } } } }, "UcpExecutionGrant": { "type": "object", "additionalProperties": false, "required": [ "token", "jti", "key_id", "expires_at", "intent_hash", "execution_binding_digest", "execution_correlation_id", "claim_path", "finalize_path", "intent" ], "properties": { "token": { "type": "string" }, "jti": { "type": "string" }, "key_id": { "type": "string" }, "expires_at": { "type": "string", "format": "date-time" }, "intent_hash": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "execution_binding_digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "execution_correlation_id": { "type": "string", "minLength": 1, "maxLength": 200 }, "claim_path": { "type": "string", "const": "/v1/execution/claim-token" }, "finalize_path": { "type": "string", "const": "/v1/execution/finalize-token" }, "intent": { "$ref": "#/components/schemas/ExecutionIntentBinding" } } }, "UcpExecutionAuthorityPayloadBase": { "type": "object", "required": [ "decision", "authoritative", "evaluation_id", "dossier_id", "policy_version", "dossier_sha256", "reason_codes", "required_presence", "verification_url", "evaluated_at" ], "properties": { "decision": { "type": "string", "enum": [ "ALLOW", "ESCALATE", "BLOCK" ] }, "authoritative": { "type": "boolean", "description": "Legacy compatibility flag; authority_classification is normative in Protocol 1.1." }, "evaluation_id": { "type": "string" }, "dossier_id": { "type": "string" }, "policy_version": { "type": "string" }, "reason_codes": { "type": "array", "items": { "type": "string" } }, "required_presence": { "type": "boolean" }, "verification_url": { "type": [ "string", "null" ], "format": "uri" }, "evaluated_at": { "type": "string", "format": "date-time" } } }, "UcpExecutionAuthorityProtocol11Fields": { "type": "object", "properties": { "authority_classification": { "$ref": "#/components/schemas/AuthorityClassification" }, "evaluation_mode": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ] }, "execution_eligible": { "type": "boolean" }, "policy_reference": { "$ref": "#/components/schemas/PolicyReference" }, "evaluation_semantics": { "$ref": "#/components/schemas/EvaluationSemantics" }, "input_snapshot_digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "execution_binding_digest": { "type": [ "string", "null" ], "pattern": "^sha256:[0-9a-f]{64}$" } }, "allOf": [ { "if": { "required": [ "authority_classification" ], "properties": { "authority_classification": { "const": "OBSERVATIONAL" } } }, "then": { "properties": { "authoritative": { "const": false }, "execution_eligible": { "const": false }, "execution_binding_digest": { "type": "null" } } } }, { "if": { "required": [ "execution_eligible" ], "properties": { "execution_eligible": { "const": true } } }, "then": { "required": [ "authority_classification", "evaluation_mode", "execution_binding_digest" ], "properties": { "decision": { "const": "ALLOW" }, "authoritative": { "const": true }, "authority_classification": { "const": "AUTHORITATIVE" }, "evaluation_mode": { "const": "ENFORCEMENT" }, "execution_binding_digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } } } }, { "if": { "required": [ "evaluation_mode" ], "properties": { "evaluation_mode": { "enum": [ "SHADOW", "PARALLEL" ] } } }, "then": { "properties": { "authority_classification": { "const": "OBSERVATIONAL" }, "execution_eligible": { "const": false }, "execution_binding_digest": { "type": "null" } } } }, { "if": { "required": [ "evaluation_mode" ], "properties": { "evaluation_mode": { "const": "ENFORCEMENT" } } }, "then": { "properties": { "authoritative": { "const": true }, "authority_classification": { "const": "AUTHORITATIVE" } } } }, { "if": { "required": [ "execution_binding_digest" ], "properties": { "execution_binding_digest": { "type": "string" } } }, "then": { "required": [ "execution_eligible" ], "properties": { "execution_eligible": { "const": true } } } }, { "if": { "required": [ "authoritative" ], "properties": { "authoritative": { "const": false } } }, "then": { "properties": { "authority_classification": { "const": "OBSERVATIONAL" }, "execution_eligible": { "const": false }, "execution_binding_digest": { "type": "null" } } } } ] }, "UcpExecutionAuthorityPayloadLegacy": { "description": "Exact response projection for extension 2026-09-05.", "unevaluatedProperties": false, "allOf": [ { "$ref": "#/components/schemas/UcpExecutionAuthorityPayloadBase" }, { "type": "object", "properties": { "dossier_sha256": { "type": [ "string", "null" ], "pattern": "^[0-9a-f]{64}$" } } } ] }, "UcpExecutionAuthorityPayloadPrevious": { "description": "Additive Protocol 1.1 response projection for extension 2026-09-06.", "unevaluatedProperties": false, "allOf": [ { "$ref": "#/components/schemas/UcpExecutionAuthorityPayloadBase" }, { "$ref": "#/components/schemas/UcpExecutionAuthorityProtocol11Fields" }, { "type": "object", "properties": { "dossier_sha256": { "type": [ "string", "null" ], "pattern": "^(?:sha256:)?[0-9a-f]{64}$" } } } ] }, "UcpExecutionAuthorityPayloadCurrent": { "description": "Strict Protocol 1.1 response projection for extension 2026-09-07.", "unevaluatedProperties": false, "allOf": [ { "$ref": "#/components/schemas/UcpExecutionAuthorityPayloadBase" }, { "$ref": "#/components/schemas/UcpExecutionAuthorityProtocol11Fields" }, { "type": "object", "required": [ "authority_classification", "evaluation_mode", "execution_eligible", "policy_reference", "evaluation_semantics", "input_snapshot_digest", "execution_binding_digest" ], "properties": { "dossier_sha256": { "type": [ "string", "null" ], "pattern": "^sha256:[0-9a-f]{64}$" } } } ] }, "UcpExecutionAuthorityPayload": { "description": "Version-dispatched response union. The exact negotiated extension release determines which immutable member schema applies; this union preserves historical 2026-09-05 and additive 2026-09-06 responses while making 2026-09-07 Protocol 1.1 evidence strict.", "anyOf": [ { "$ref": "#/components/schemas/UcpExecutionAuthorityPayloadLegacy" }, { "$ref": "#/components/schemas/UcpExecutionAuthorityPayloadPrevious" }, { "$ref": "#/components/schemas/UcpExecutionAuthorityPayloadCurrent" } ] }, "UcpCheckoutAuthorizeResponse": { "type": "object", "additionalProperties": true, "required": [ "service", "ucp" ], "properties": { "service": { "type": "string", "const": "decionis" }, "ucp": { "type": "object", "additionalProperties": true, "required": [ "version", "status" ], "properties": { "version": { "$ref": "#/components/schemas/UcpProtocolVersion" }, "status": { "type": "string", "enum": [ "success", "error" ] } } }, "checkout_id": { "type": "string" }, "mode": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ] }, "enforcing": { "type": "boolean" }, "authority_classification": { "$ref": "#/components/schemas/AuthorityClassification" }, "evaluation_mode": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ], "description": "Present on some fail-closed evidence errors; normal results use mode." }, "execution_eligible": { "type": "boolean", "description": "True only for an AUTHORITATIVE ALLOW carrying an exact-action execution grant. Signature validity alone does not make a response execution-eligible." }, "dossier_id": { "type": [ "string", "null" ] }, "status": { "type": [ "string", "null" ] }, "continue_url": { "type": "string", "format": "uri" }, "error": { "type": "object", "additionalProperties": true }, "actions": { "$ref": "#/components/schemas/UcpActions" }, "messages": { "type": "array", "items": { "$ref": "#/components/schemas/UcpMessage" } }, "fallback": { "$ref": "#/components/schemas/UcpAuthorityFallback" }, "com.decionis.commerce.execution_authority": { "$ref": "#/components/schemas/UcpExecutionAuthorityPayload" }, "verification": { "$ref": "#/components/schemas/UcpMandateVerification" }, "escalation": { "oneOf": [ { "type": "object", "additionalProperties": false, "required": [ "override_id" ], "properties": { "override_id": { "type": "string" }, "status": { "type": "string", "enum": [ "PENDING", "APPROVED", "REJECTED", "CANCELLED", "EXPIRED" ] } } }, { "type": "null" } ] }, "execution_grant": { "oneOf": [ { "$ref": "#/components/schemas/UcpExecutionGrant" }, { "type": "null" } ] }, "requires_human_approval": { "type": "boolean" }, "reason_codes": { "type": "array", "items": { "type": "string" } } } }, "UcpAuthorityReviewActionConfig": { "type": "object", "additionalProperties": false, "required": [ "continue_url" ], "properties": { "continue_url": { "type": "string", "format": "uri", "pattern": "^https://(?![^/?#]*@)", "maxLength": 2000 }, "reason_codes": { "type": "array", "maxItems": 100, "items": { "type": "string", "minLength": 1, "maxLength": 500 } }, "expires_at": { "type": "string", "format": "date-time" } } }, "UcpAuthorityReviewAction": { "type": "object", "additionalProperties": false, "required": [ "id", "config" ], "properties": { "id": { "type": "string", "minLength": 1, "maxLength": 500 }, "config": { "$ref": "#/components/schemas/UcpAuthorityReviewActionConfig" } } }, "UcpActions": { "type": "object", "additionalProperties": false, "required": [ "com.decionis.authority.review" ], "properties": { "com.decionis.authority.review": { "type": "array", "minItems": 1, "maxItems": 1, "items": { "$ref": "#/components/schemas/UcpAuthorityReviewAction" } } } }, "UcpMessage": { "type": "object", "additionalProperties": true, "required": [ "type", "content_type", "content" ], "properties": { "type": { "type": "string", "enum": [ "info", "warning", "error" ] }, "content_type": { "type": "string", "enum": [ "plain", "markdown" ] }, "content": { "type": "string", "minLength": 1 } } }, "UcpAuthorityFallback": { "type": "object", "additionalProperties": false, "required": [ "degraded", "mode", "reason", "circuit_open" ], "properties": { "degraded": { "type": "boolean", "const": true }, "mode": { "type": "string", "enum": [ "fail_closed" ] }, "reason": { "type": "string" }, "circuit_open": { "type": "boolean" } } }, "UcpPublicEcJwk": { "type": "object", "additionalProperties": false, "required": [ "kty", "crv", "x", "y" ], "properties": { "kty": { "type": "string", "const": "EC" }, "crv": { "type": "string", "enum": [ "P-256", "P-384", "P-521" ] }, "x": { "type": "string", "minLength": 1, "maxLength": 512 }, "y": { "type": "string", "minLength": 1, "maxLength": 512 }, "kid": { "type": "string", "minLength": 1, "maxLength": 200 }, "alg": { "type": "string", "enum": [ "ES256", "ES384", "ES512" ] }, "use": { "type": "string", "maxLength": 20 } } }, "UcpSigningKeyRegistrationRequest": { "type": "object", "additionalProperties": false, "required": [ "kid", "algorithm", "public_jwk" ], "properties": { "org_id": { "type": "string", "format": "uuid" }, "kid": { "type": "string", "minLength": 1, "maxLength": 200 }, "algorithm": { "type": "string", "enum": [ "ES256", "ES384", "ES512" ] }, "public_jwk": { "$ref": "#/components/schemas/UcpPublicEcJwk" }, "label": { "type": "string", "maxLength": 200 } } }, "UcpSigningKey": { "type": "object", "additionalProperties": false, "required": [ "kid", "algorithm", "label", "created_at" ], "properties": { "service": { "type": "string", "const": "decionis" }, "kid": { "type": "string" }, "algorithm": { "type": "string", "enum": [ "ES256", "ES384", "ES512" ] }, "label": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "revoked_at": { "type": [ "string", "null" ], "format": "date-time" } } }, "UcpSigningKeyListResponse": { "type": "object", "additionalProperties": false, "required": [ "service", "keys" ], "properties": { "service": { "type": "string", "const": "decionis" }, "keys": { "type": "array", "items": { "$ref": "#/components/schemas/UcpSigningKey" } } } }, "UcpSigningKeyRevocationResponse": { "type": "object", "additionalProperties": false, "required": [ "service", "kid", "revoked" ], "properties": { "service": { "type": "string", "const": "decionis" }, "kid": { "type": "string" }, "revoked": { "type": "boolean", "const": true } } }, "DecisionStatus": { "type": "string", "enum": [ "ALLOW", "BLOCK", "ESCALATE", "REVIEW_REQUIRED", "ERROR" ] }, "Actor": { "type": "object", "required": [ "id", "type" ], "properties": { "id": { "type": "string" }, "type": { "type": "string", "examples": [ "AI_AGENT", "TRADING_BOT", "HUMAN", "SERVICE" ] }, "role": { "type": "string" } }, "additionalProperties": true }, "Action": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string", "examples": [ "TRANSFER_FUNDS", "OPEN_POSITION" ] }, "resource": { "type": "string" } }, "additionalProperties": true }, "DecisionRequest": { "type": "object", "required": [ "tenant_id", "actor", "action" ], "properties": { "tenant_id": { "type": "string" }, "actor": { "$ref": "#/components/schemas/Actor" }, "action": { "$ref": "#/components/schemas/Action" }, "context": { "type": "object", "additionalProperties": true, "properties": { "signals": { "type": "object", "additionalProperties": true, "description": "Signal values may be existing scalars, legacy\n`{value, source?, observed_at?}` envelopes, or a strict\nSemanticSignalEnvelope. Typed values are digest-checked and\nadmitted by the selected policy bundle before rules can use them.\n" } } }, "policy_refs": { "type": "array", "items": { "type": "string" } }, "idempotency_key": { "type": "string" }, "correlation_id": { "type": "string" }, "shadow_mode": { "type": "boolean", "default": false }, "enforcement_mode": { "type": "string", "enum": [ "enforce", "shadow", "dry_run" ], "default": "enforce" } }, "additionalProperties": true }, "ExecutionIntentActor": { "type": "object", "additionalProperties": false, "required": [ "id", "type" ], "properties": { "id": { "type": "string", "minLength": 1, "maxLength": 200 }, "type": { "type": "string", "minLength": 1, "maxLength": 200 }, "runtime": { "type": "string", "minLength": 1, "maxLength": 200 }, "trust_level": { "type": "string", "minLength": 1, "maxLength": 80 } } }, "ExecutionIntentAction": { "type": "object", "additionalProperties": false, "required": [ "type", "resource", "parameters" ], "properties": { "type": { "type": "string", "minLength": 1, "maxLength": 120, "pattern": "^[a-z][a-z0-9._:-]*$" }, "resource": { "type": "string", "minLength": 1, "maxLength": 500 }, "parameters": { "type": "object", "additionalProperties": true } } }, "ExecutionDownstreamTarget": { "type": "object", "additionalProperties": false, "required": [ "system", "operation" ], "properties": { "system": { "type": "string", "minLength": 1, "maxLength": 200 }, "operation": { "type": "string", "minLength": 1, "maxLength": 200 }, "environment": { "type": "string", "minLength": 1, "maxLength": 200, "default": "production" }, "endpoint": { "type": "string", "minLength": 1, "maxLength": 500 } } }, "ExecutionPolicyProjection": { "type": "object", "additionalProperties": false, "required": [ "decision_type", "transaction_type", "workflow_key", "channel" ], "description": "Exact policy-routing vocabulary committed into the intent. Protocol adapters use it when their evaluated decision type differs from the executable action type; legacy generic callers may omit it.", "properties": { "decision_type": { "type": "string", "minLength": 1, "maxLength": 120 }, "transaction_type": { "type": [ "string", "null" ], "minLength": 1, "maxLength": 120 }, "workflow_key": { "type": [ "string", "null" ], "minLength": 1, "maxLength": 120 }, "channel": { "type": [ "string", "null" ], "minLength": 1, "maxLength": 120 } } }, "ExecutionIntentBindingBase": { "type": "object", "required": [ "protocol_version", "tenant_id", "intent_id", "captured_at", "expires_at", "actor", "action", "context", "downstream_target" ], "properties": { "protocol_version": { "type": "string", "const": "agent-safe.intent/1" }, "tenant_id": { "type": "string", "format": "uuid" }, "intent_id": { "type": "string", "format": "uuid" }, "captured_at": { "type": "string", "format": "date-time" }, "expires_at": { "type": "string", "format": "date-time", "description": "Must be later than captured_at and no more than five minutes after it." }, "actor": { "$ref": "#/components/schemas/ExecutionIntentActor" }, "action": { "$ref": "#/components/schemas/ExecutionIntentAction" }, "context": { "type": "object", "additionalProperties": true }, "downstream_target": { "$ref": "#/components/schemas/ExecutionDownstreamTarget" }, "policy_projection": { "$ref": "#/components/schemas/ExecutionPolicyProjection" }, "expected_effect_digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$", "description": "Digest-only commitment to the expected downstream state." } } }, "ExecutionIntentBinding": { "unevaluatedProperties": false, "allOf": [ { "$ref": "#/components/schemas/ExecutionIntentBindingBase" } ] }, "PresenceHumanApprovalEvidence": { "type": "object", "additionalProperties": false, "required": [ "provider", "requestId", "receiptDossierId" ], "properties": { "provider": { "type": "string", "const": "presence" }, "requestId": { "type": "string", "maxLength": 200 }, "receiptDossierId": { "type": "string", "maxLength": 200 } } }, "ManagedEscalationApproverConstraints": { "type": "object", "additionalProperties": false, "properties": { "principal_id": { "type": "string", "minLength": 1, "maxLength": 200 }, "role_id": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]{1,63}$" } }, "anyOf": [ { "required": [ "principal_id" ] }, { "required": [ "role_id" ] } ], "description": "Optional narrowing constraints. These values do not assign a role; effective identity and role are resolved from trusted tenant identity configuration and verified Presence evidence." }, "ManagedEscalationVerificationRequirements": { "type": "object", "additionalProperties": false, "required": [ "methods" ], "properties": { "methods": { "type": "array", "minItems": 1, "maxItems": 3, "uniqueItems": true, "items": { "type": "string", "enum": [ "WEBAUTHN", "ACTIVE_LIVENESS" ] } }, "level": { "type": "string", "enum": [ "STANDARD", "HIGH_CONFIDENCE" ] } }, "description": "Optional equal-or-stronger constraints applied to the policy-issued AuthorityRequirement. They can never downgrade policy requirements." }, "ManagedEscalationRequest": { "type": "object", "additionalProperties": false, "required": [ "mode" ], "properties": { "mode": { "type": "string", "const": "MANAGED" }, "approver": { "$ref": "#/components/schemas/ManagedEscalationApproverConstraints" }, "verification_requirements": { "$ref": "#/components/schemas/ManagedEscalationVerificationRequirements" } }, "description": "Requests Decionis-owned Presence orchestration. This object is outside the canonical ExecutionIntentBinding hash and is included in request replay validation. It is valid only in ENFORCEMENT mode." }, "ManagedEscalationLifecycleStatus": { "type": "string", "enum": [ "PENDING_PRESENCE", "PRESENCE_REQUESTED", "AWAITING_APPROVER", "PRESENCE_VERIFIED", "REAUTHORIZING", "GRANT_READY", "EXPIRED", "REJECTED", "BLOCKED", "CANCELLED", "FAILED" ] }, "ManagedEscalationOutcome": { "type": "string", "enum": [ "ESCALATE_PENDING", "ALLOW", "BLOCK", "ERROR" ] }, "ManagedEscalationReference": { "type": "object", "additionalProperties": false, "required": [ "outcome", "escalation_id", "intent_id", "status", "expires_at", "reason_codes" ], "properties": { "outcome": { "$ref": "#/components/schemas/ManagedEscalationOutcome" }, "escalation_id": { "type": "string", "minLength": 8, "maxLength": 200 }, "intent_id": { "type": "string", "format": "uuid" }, "status": { "$ref": "#/components/schemas/ManagedEscalationLifecycleStatus" }, "expires_at": { "type": "string", "format": "date-time" }, "reason_codes": { "type": "array", "maxItems": 50, "items": { "type": "string" } } }, "description": "Non-authorizing status locator. It is not an ExecutionBinding, claim token, invitation, or executable capability." }, "ManagedEscalationStatus": { "type": "object", "additionalProperties": false, "required": [ "escalation_id", "intent_id", "action_hash", "status", "outcome", "expires_at", "reason_codes", "decision" ], "properties": { "escalation_id": { "type": "string", "minLength": 8, "maxLength": 200 }, "intent_id": { "type": "string", "format": "uuid" }, "action_hash": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "status": { "$ref": "#/components/schemas/ManagedEscalationLifecycleStatus" }, "outcome": { "$ref": "#/components/schemas/ManagedEscalationOutcome" }, "expires_at": { "type": "string", "format": "date-time" }, "reason_codes": { "type": "array", "maxItems": 50, "items": { "type": "string" } }, "decision": { "oneOf": [ { "$ref": "#/components/schemas/ExecutionAuthorityDecision" }, { "type": "null" } ] } } }, "PresenceAuthorityCompletion": { "type": "object", "additionalProperties": false, "required": [ "version", "org_id", "authority_request_id", "source_decision_id", "requirement_digest", "action_digest", "proof_digest", "proof_dossier_id", "verified_at", "expires_at" ], "properties": { "version": { "type": "string", "const": "presence.authority_completion/1" }, "org_id": { "type": "string", "format": "uuid" }, "authority_request_id": { "type": "string", "minLength": 8, "maxLength": 200 }, "source_decision_id": { "type": "string", "minLength": 1, "maxLength": 200 }, "requirement_digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "action_digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "proof_digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "proof_dossier_id": { "type": "string", "minLength": 1, "maxLength": 200 }, "verified_at": { "type": "string", "format": "date-time" }, "expires_at": { "type": "string", "format": "date-time" } } }, "ExecutionAuthorityRequest": { "unevaluatedProperties": false, "allOf": [ { "$ref": "#/components/schemas/ExecutionIntentBindingBase" }, { "type": "object", "required": [ "intent_hash", "mode" ], "properties": { "intent_hash": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$", "description": "SHA-256 of the UTF-8 canonical JSON ExecutionIntentBinding.\nObjects are recursively key-sorted using ECMAScript's default\nUTF-16 code-unit ordering and serialized with JSON.stringify semantics.\n" }, "mode": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ] }, "escalation": { "$ref": "#/components/schemas/ManagedEscalationRequest" }, "evidence": { "type": "object", "additionalProperties": false, "properties": { "humanApproval": { "$ref": "#/components/schemas/PresenceHumanApprovalEvidence" } } } } } ] }, "ExecutionAuthorityDecision": { "type": "object", "additionalProperties": false, "required": [ "decision_id", "chain_id", "status", "should_execute", "authority_classification", "execution_eligible", "execution_binding_digest", "reason_codes", "action_hash", "policy_version", "mode", "execution_token", "execution_token_jti", "execution_token_key_id", "execution_token_expires_at", "dossier_id", "dossier_sha256", "dossier_url", "approval_request_id", "ledger_entry_id" ], "properties": { "decision_id": { "type": "string" }, "chain_id": { "type": [ "string", "null" ] }, "status": { "type": "string", "enum": [ "ALLOW", "BLOCK", "ESCALATE", "REVIEW_REQUIRED", "ERROR" ] }, "should_execute": { "type": "boolean" }, "authority_classification": { "$ref": "#/components/schemas/AuthorityClassification" }, "execution_eligible": { "type": "boolean", "description": "True only for an AUTHORITATIVE ALLOW carrying an exact-action ExecutionBinding and executable grant." }, "execution_binding_digest": { "type": [ "string", "null" ], "pattern": "^sha256:[0-9a-f]{64}$" }, "reason_codes": { "type": "array", "items": { "type": "string" } }, "action_hash": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "policy_version": { "type": [ "string", "null" ] }, "mode": { "type": [ "string", "null" ], "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT", null ] }, "execution_token": { "type": [ "string", "null" ], "description": "Present only when status is ALLOW and should_execute is true." }, "execution_token_jti": { "type": [ "string", "null" ], "description": "Single-use identifier of the issued execution token." }, "execution_token_key_id": { "type": [ "string", "null" ], "description": "Identifier of the key that signed the issued execution token." }, "execution_token_expires_at": { "type": [ "string", "null" ], "format": "date-time" }, "dossier_id": { "type": [ "string", "null" ] }, "dossier_sha256": { "type": [ "string", "null" ] }, "dossier_url": { "type": [ "string", "null" ] }, "approval_request_id": { "type": [ "string", "null" ] }, "ledger_entry_id": { "type": [ "string", "null" ] }, "managed_escalation": { "oneOf": [ { "$ref": "#/components/schemas/ManagedEscalationReference" }, { "type": "null" } ] } } }, "ExecutionTokenRequest": { "type": "object", "additionalProperties": false, "required": [ "execution_token", "intent_hash", "intent" ], "properties": { "execution_token": { "type": "string", "minLength": 1, "maxLength": 20000 }, "intent_hash": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "intent": { "$ref": "#/components/schemas/ExecutionIntentBinding" }, "evidence": { "type": "object", "additionalProperties": false, "description": "Action-bound authority evidence presented again at the claim boundary. Required when the bound policy requires Presence.", "properties": { "humanApproval": { "$ref": "#/components/schemas/PresenceHumanApprovalEvidence" } } }, "consumed_by": { "type": "string", "minLength": 1, "maxLength": 200 }, "commit_correlation_id": { "type": "string", "minLength": 1, "maxLength": 200 } } }, "ExecutionClaimTokenRequest": { "type": "object", "additionalProperties": false, "required": [ "execution_token", "intent_hash", "intent" ], "properties": { "execution_token": { "type": "string", "minLength": 1, "maxLength": 20000 }, "intent_hash": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "intent": { "$ref": "#/components/schemas/ExecutionIntentBinding" }, "consumed_by": { "type": "string", "minLength": 1, "maxLength": 200 }, "commit_correlation_id": { "type": "string", "minLength": 1, "maxLength": 200 }, "claim_lease_seconds": { "type": "integer", "minimum": 5, "maximum": 300, "default": 30, "description": "Pre-commit lease duration. This does not extend the signed execution grant lifetime." } } }, "ExecutionTokenClaims": { "type": "object", "additionalProperties": true, "required": [ "iss", "org_id", "dossier_id", "decision_id", "action", "decision", "scope", "binding", "jti", "iat", "nbf", "exp" ], "properties": { "iss": { "type": "string" }, "sub": { "type": "string" }, "aud": { "type": "string" }, "org_id": { "type": "string", "format": "uuid" }, "dossier_id": { "type": "string" }, "decision_id": { "type": "string" }, "chain_id": { "type": "string" }, "action": { "type": "string" }, "decision": { "type": "string", "const": "allow" }, "scope": { "type": "string", "const": "execute" }, "binding": { "type": "object", "required": [ "intent_hash" ], "properties": { "intent_hash": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "execution_binding_digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "execution_payload_digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$", "description": "Signed digest of the exact downstream request parameters." }, "execution_payload_canonicalization_profile": { "type": "string", "description": "Canonicalization profile used for execution_payload_digest." }, "execution_nonce": { "type": "string", "pattern": "^[A-Za-z0-9_-]{43,128}$" }, "execution_correlation_id": { "type": "string" }, "expected_effect_digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$", "description": "Expected downstream effect commitment carried by the grant." }, "authority_protocol_version": { "type": "string", "enum": [ "1.0", "1.0.0", "1.1" ], "description": "Protocol semantics governing execution eligibility and effect evidence validation for this grant. Protocol 1.1 grants reject the deprecated legacy effect-evidence shape." } } }, "jti": { "type": "string" }, "iat": { "type": "integer" }, "nbf": { "type": "integer" }, "exp": { "type": "integer" } } }, "ExecutionTokenResponse": { "type": "object", "additionalProperties": false, "required": [ "valid", "reason_codes", "claims" ], "properties": { "valid": { "type": "boolean" }, "should_execute": { "type": "boolean", "description": "Present on pre-commit claim responses. Only true after current-state and Presence revalidation, an atomic nonce claim with durable evidence, and a final database-time claim-lease check." }, "would_block": { "type": "boolean", "description": "Present on pre-commit claim responses for Shadow diagnostics." }, "verdict": { "type": "string", "enum": [ "APPROVE", "ESCALATE", "REJECT", "REVIEW" ], "description": "Deterministic pre-commit revalidation verdict." }, "reason_codes": { "type": "array", "items": { "type": "string" } }, "claims": { "oneOf": [ { "$ref": "#/components/schemas/ExecutionTokenClaims" }, { "type": "null" } ] }, "claim_token": { "type": [ "string", "null" ], "pattern": "^[A-Za-z0-9_-]{43,128}$" }, "claim_validated_at": { "type": [ "string", "null" ], "format": "date-time", "description": "Database time of the final execution-eligibility confirmation. Qualifying effect observations must not predate this boundary." }, "claim_lease_expires_at": { "type": [ "string", "null" ], "format": "date-time" }, "evidence": { "type": "object", "additionalProperties": true }, "evidence_durably_queued": { "type": "boolean", "description": "True when the canonical revalidation evidence is durably queued in the same transaction as the nonce transition. This does not by itself mean the Protocol Decision Chain append has completed." }, "decision_chain_evidence_recorded": { "type": "boolean", "description": "True when the queued evidence has already been acknowledged by the Protocol Decision Chain. False evidence remains recoverable when evidence_durably_queued is true." } } }, "ExecutionClaimTokenResponse": { "description": "Successful pre-commit claim response. All three execution-bound fields are required; `valid` alone never authorizes execution.", "allOf": [ { "$ref": "#/components/schemas/ExecutionTokenResponse" }, { "type": "object", "required": [ "should_execute", "claim_token", "claim_validated_at", "claim_lease_expires_at" ], "properties": { "should_execute": { "type": "boolean", "const": true }, "claim_token": { "type": "string", "pattern": "^[A-Za-z0-9_-]{43,128}$" }, "claim_validated_at": { "type": "string", "format": "date-time" }, "claim_lease_expires_at": { "type": "string", "format": "date-time" } } } ] }, "ExecutionEffectEvidence": { "type": "object", "additionalProperties": false, "deprecated": true, "description": "Deployed pre-Protocol-1.1 effect record. It remains accepted and verifiable for grants issued under its original request/outcome-binding rules. Protocol 1.1 grants reject this shape to prevent an evidence semantics downgrade. New integrations should emit EffectEvidence.", "allOf": [ { "if": { "properties": { "status": { "const": "CONFIRMED" } }, "required": [ "status" ] }, "then": { "properties": { "response_digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } } } } ], "required": [ "effect_schema_version", "status", "request_digest", "response_digest", "digest_algorithm", "canonicalization_profile", "external_reference", "observation_mode", "observer", "observed_at", "metadata_digest" ], "properties": { "effect_schema_version": { "type": "string", "const": "1.0" }, "status": { "type": "string", "enum": [ "CONFIRMED", "FAILED", "INDETERMINATE" ], "description": "CONFIRMED means the execution gate directly observed a digestible response." }, "request_digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$", "description": "Must equal the execution payload digest signed into the grant." }, "response_digest": { "type": [ "string", "null" ], "pattern": "^sha256:[0-9a-f]{64}$", "description": "Required when status is CONFIRMED; null otherwise." }, "digest_algorithm": { "type": "string", "const": "SHA-256" }, "canonicalization_profile": { "type": "string", "minLength": 1, "maxLength": 500, "description": "Canonicalization profile for the response digest when present; otherwise the request digest profile." }, "external_reference": { "type": [ "string", "null" ], "minLength": 1, "maxLength": 2000 }, "observation_mode": { "type": "string", "enum": [ "GATE_OBSERVED", "RUNTIME_REPORTED" ] }, "observer": { "type": "object", "additionalProperties": false, "required": [ "id", "version" ], "properties": { "id": { "type": "string", "minLength": 1, "maxLength": 500 }, "version": { "type": "string", "minLength": 1, "maxLength": 200 } } }, "observed_at": { "type": "string", "format": "date-time" }, "metadata_digest": { "type": [ "string", "null" ], "pattern": "^sha256:[0-9a-f]{64}$" } } }, "EffectObservationMethod": { "type": "string", "enum": [ "DOWNSTREAM_ACK", "READ_AFTER_WRITE", "EVENT_CONFIRMATION", "STATE_RECONCILIATION", "SIGNED_RECEIPT", "EXTERNAL_ATTESTATION", "HUMAN_VALIDATION" ], "description": "Versioned identifier for how the downstream effect was observed. DOWNSTREAM_ACK is weak evidence and cannot independently confirm an effect." }, "EffectEvidence": { "type": "object", "additionalProperties": false, "description": "Optional Protocol 1.1 observation evidence. COMMITTED remains an executor-reported finalization state and is not CONFIRMED without a qualifying record. Raw provider responses should remain outside the evidence artifact; use commitments and immutable references.", "required": [ "version", "status", "observation_method", "observer", "expected_effect_digest", "observed_effect_digest", "observed_at", "evidence_digest", "evidence_reference", "execution_correlation_id" ], "allOf": [ { "if": { "properties": { "status": { "const": "CONFIRMED" } }, "required": [ "status" ] }, "then": { "required": [ "observer", "observed_effect_digest", "observed_at" ], "allOf": [ { "not": { "properties": { "observation_method": { "const": "DOWNSTREAM_ACK" } }, "required": [ "observation_method" ] } }, { "properties": { "observer": { "type": "object", "required": [ "id", "version" ], "properties": { "id": { "type": "string", "minLength": 1, "maxLength": 500, "pattern": ".*\\S.*" }, "version": { "type": "string", "minLength": 1, "maxLength": 500, "pattern": ".*\\S.*" } } }, "observed_effect_digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "observed_at": { "type": "string", "format": "date-time" } } }, { "anyOf": [ { "properties": { "evidence_digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } }, "required": [ "evidence_digest" ] }, { "properties": { "evidence_reference": { "type": "string", "minLength": 1, "maxLength": 500 } }, "required": [ "evidence_reference" ] } ] } ] } } ], "properties": { "version": { "type": "string", "const": "1.0" }, "status": { "type": "string", "enum": [ "CONFIRMED", "UNCONFIRMED" ] }, "observation_method": { "$ref": "#/components/schemas/EffectObservationMethod" }, "observer": { "oneOf": [ { "type": "object", "additionalProperties": false, "required": [ "id", "version" ], "properties": { "id": { "type": "string", "minLength": 1, "maxLength": 500, "pattern": ".*\\S.*" }, "version": { "type": [ "string", "null" ], "minLength": 1, "maxLength": 500, "pattern": ".*\\S.*" } } }, { "type": "null" } ] }, "expected_effect_digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "observed_effect_digest": { "type": [ "string", "null" ], "pattern": "^sha256:[0-9a-f]{64}$", "description": "For CONFIRMED evidence, must equal expected_effect_digest." }, "observed_at": { "type": [ "string", "null" ], "format": "date-time" }, "evidence_digest": { "type": [ "string", "null" ], "pattern": "^sha256:[0-9a-f]{64}$" }, "evidence_reference": { "type": [ "string", "null" ], "minLength": 1, "maxLength": 500 }, "execution_correlation_id": { "type": "string", "minLength": 1, "maxLength": 500, "description": "Must exactly equal the bound commit correlation identifier." } } }, "ExecutionFinalizeRequest": { "type": "object", "additionalProperties": false, "required": [ "execution_token", "claim_token", "outcome", "commit_correlation_id" ], "properties": { "execution_token": { "type": "string", "minLength": 1, "maxLength": 20000 }, "claim_token": { "type": "string", "pattern": "^[A-Za-z0-9_-]{43,128}$" }, "outcome": { "type": "string", "enum": [ "COMMITTED", "FAILED", "INDETERMINATE" ] }, "commit_correlation_id": { "type": "string", "minLength": 1, "maxLength": 200 }, "downstream_evidence": { "type": "object", "additionalProperties": true, "description": "Free-form legacy evidence; never interpreted as effect confirmation." }, "effect_evidence": { "oneOf": [ { "$ref": "#/components/schemas/EffectEvidence" }, { "$ref": "#/components/schemas/ExecutionEffectEvidence" } ], "description": "When effect evidence is present for a Protocol 1.1 grant it must use the Protocol 1.1 shape. Effect confirmation remains optional. The legacy shape remains accepted only for historical grants and keeps its original verification semantics." } } }, "ExecutionFinalizeResponse": { "type": "object", "additionalProperties": false, "required": [ "finalized", "reason_codes" ], "properties": { "finalized": { "type": "boolean" }, "outcome": { "type": "string", "enum": [ "COMMITTED", "FAILED", "INDETERMINATE" ] }, "evidence_recorded": { "type": "boolean", "description": "Compatibility field reporting immediate Decision Chain acknowledgement." }, "evidence_durably_queued": { "type": "boolean", "description": "True when commit evidence was persisted transactionally with the terminal claim state, including lease-expiry INDETERMINATE." }, "decision_chain_evidence_recorded": { "type": "boolean", "description": "True when the Protocol Decision Chain had already acknowledged the commit evidence when this response was formed; false is delivered asynchronously from the durable outbox." }, "effect_evidence_recorded": { "type": "boolean" }, "effect_confirmation": { "type": "string", "enum": [ "CONFIRMED", "UNCONFIRMED" ] }, "reason_codes": { "type": "array", "items": { "type": "string" } } } }, "ProtocolEvaluateDecisionRequest": { "type": "object", "required": [ "decision_type" ], "properties": { "org_id": { "type": "string", "format": "uuid", "description": "Optional when authenticated with an organization API key." }, "decision_type": { "type": "string" }, "amount": { "type": "number" }, "risk_score": { "type": "number", "minimum": 0, "maximum": 1 }, "channel": { "type": "string" }, "policy_version": { "type": "string" }, "objective_profile": { "type": "string" }, "mode": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ] }, "decision_band": { "type": "string" }, "transaction_type": { "type": "string" }, "workflow_key": { "type": "string" }, "vertical_pack": { "type": "string" }, "context": { "type": "object", "additionalProperties": true, "description": "Arbitrary evaluated facts. A matched ESCALATE rule can issue a\nPresence Authority Requirement only when `action_context` conforms\nto `PresenceActionContext`; the digest binds that complete canonical\nobject and unknown action fields are excluded from the binding.\n`context.authority_requirement` is reserved and rejected; callers\ncannot promote their own JSON into trusted authority policy.\n" }, "idempotency_key": { "type": "string" }, "decision_chain": { "$ref": "#/components/schemas/DecisionChainRequest" } }, "additionalProperties": true }, "ProtocolEvaluateDecisionResponse": { "type": "object", "allOf": [ { "if": { "properties": { "protocol_version": { "const": "1.1" } }, "required": [ "protocol_version" ] }, "then": { "required": [ "verdict", "authority_classification", "execution_eligible", "policy_reference", "evaluation_semantics", "input_snapshot_digest", "execution_binding_digest" ] } } ], "required": [ "outcome", "confidence", "policy_version", "objective_profile", "dossier_id", "evaluation_id", "mode", "fallback_to_legacy", "governance_metrics", "idempotent_replay" ], "properties": { "protocol_version": { "type": "string", "const": "1.1" }, "outcome": { "type": "string", "enum": [ "APPROVE", "ESCALATE", "REJECT", "REVIEW" ] }, "verdict": { "type": "string", "enum": [ "ALLOW", "ESCALATE", "BLOCK" ] }, "authority_classification": { "$ref": "#/components/schemas/AuthorityClassification" }, "execution_eligible": { "type": "boolean" }, "policy_reference": { "$ref": "#/components/schemas/PolicyReference" }, "evaluation_semantics": { "$ref": "#/components/schemas/EvaluationSemantics" }, "input_snapshot_digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "execution_binding_digest": { "type": [ "string", "null" ], "pattern": "^sha256:[0-9a-f]{64}$", "description": "Commitment to the exact-action ExecutionBinding when one is present. Null on observational or otherwise non-execution-eligible Protocol 1.1 evaluations." }, "confidence": { "type": "number" }, "policy_version": { "type": "string" }, "objective_profile": { "type": "string" }, "dossier_id": { "type": "string", "format": "uuid" }, "dossier_sha256": { "type": "string", "nullable": true }, "evaluation_id": { "type": "string", "format": "uuid" }, "decision_resolution_id": { "type": "string", "format": "uuid", "nullable": true }, "ledger_entry_id": { "type": "string", "format": "uuid", "nullable": true }, "ledger_entry_hash": { "type": "string", "nullable": true }, "mode": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ] }, "fallback_to_legacy": { "type": "boolean" }, "fallback_reason": { "type": "string", "nullable": true }, "governance_metrics": { "type": "object", "additionalProperties": true }, "policy_guard": { "type": "object", "additionalProperties": true }, "policy_evaluation": { "type": "object", "additionalProperties": true }, "decision_chain": { "$ref": "#/components/schemas/DecisionChainSummary" }, "policy_snapshot": { "type": "object", "additionalProperties": true, "description": "Hash-backed reference to the encoded policy bundle evaluated by the protocol." }, "execution_binding": { "type": "object", "additionalProperties": true, "description": "Exact-action ExecutionBinding v1.0. Absent on observational or otherwise non-execution-eligible evaluations." }, "authority_requirement": { "$ref": "#/components/schemas/AuthorityRequirement", "description": "Present only for an ENFORCEMENT-mode matched ESCALATE rule with\nexplicit policy-owned authority settings and a valid canonical action_context. Human\napproval is evidence; callers must keep execution held until a later\nDecionis re-evaluation authorizes release.\n" }, "idempotent_replay": { "type": "boolean" } }, "additionalProperties": true }, "PresenceActorContext": { "type": "object", "additionalProperties": true, "properties": { "claimed_location": { "type": "string", "minLength": 1 }, "ip_geo": { "type": "string", "minLength": 1 }, "ip_asn": { "type": "string", "minLength": 1 }, "is_vpn": { "type": "boolean" }, "device_posture": { "type": "string", "minLength": 1 } } }, "PresenceActionContext": { "type": "object", "additionalProperties": true, "required": [ "intent", "surface", "actor_id", "target_resource_id" ], "properties": { "intent": { "type": "string", "minLength": 1 }, "surface": { "type": "string", "minLength": 1 }, "actor_id": { "type": "string", "minLength": 1 }, "target_resource_id": { "type": "string", "minLength": 1 }, "provider_event_id": { "type": "string", "minLength": 1 }, "amount": { "type": "number", "minimum": 0 }, "currency": { "type": "string", "minLength": 3, "maxLength": 3 }, "recipient_iban": { "type": "string", "minLength": 1, "maxLength": 64 }, "account": { "type": "string", "minLength": 1, "maxLength": 200 }, "account_no": { "type": "string", "minLength": 1, "maxLength": 128 }, "actor_context": { "$ref": "#/components/schemas/PresenceActorContext" } } }, "AuthoritySelector": { "oneOf": [ { "type": "object", "additionalProperties": false, "required": [ "kind", "role_id" ], "properties": { "kind": { "type": "string", "const": "ROLE" }, "role_id": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]{1,63}$" }, "principal_id": { "type": "string", "minLength": 1, "maxLength": 200, "description": "Optional exact-human narrowing for managed role selection. The selected principal must still hold the trusted human role." } } }, { "type": "object", "additionalProperties": false, "required": [ "kind", "principal_id" ], "properties": { "kind": { "type": "string", "const": "PRINCIPAL" }, "principal_id": { "type": "string", "minLength": 1, "maxLength": 200 }, "role_id": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]{1,63}$", "description": "Trusted effective human approval role. Optional for DIRECT requirements and required when orchestration.mode is MANAGED." } } } ] }, "AuthorityVerificationRequirements": { "type": "object", "additionalProperties": false, "required": [ "level", "methods", "hardware_pki_required", "disallow_virtual_cameras" ], "properties": { "level": { "type": "string", "enum": [ "STANDARD", "HIGH_CONFIDENCE" ] }, "methods": { "type": "array", "minItems": 1, "maxItems": 3, "uniqueItems": true, "items": { "type": "string", "enum": [ "WEBAUTHN", "MOBILE_DEVICE", "ACTIVE_LIVENESS" ] } }, "hardware_pki_required": { "type": "boolean" }, "disallow_virtual_cameras": { "type": "boolean" }, "mobile_device_policy": { "type": "string", "enum": [ "WEB_OR_JIT_DEVICE", "MANAGED_DEVICE_REQUIRED" ] }, "trusted_ip_regions": { "type": "array", "minItems": 1, "maxItems": 100, "uniqueItems": true, "items": { "type": "string", "minLength": 1, "maxLength": 64 } } } }, "AuthorityResolutionPolicy": { "type": "object", "additionalProperties": false, "required": [ "quorum", "delegation", "fallback_role_ids" ], "properties": { "quorum": { "type": "integer", "const": 1 }, "delegation": { "type": "string", "enum": [ "DISALLOWED", "REQUIREMENT_REFRESH" ] }, "fallback_role_ids": { "type": "array", "maxItems": 10, "uniqueItems": true, "items": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]{1,63}$" } } } }, "AuthorityOriginator": { "type": "object", "additionalProperties": false, "required": [ "organization_id", "organization_name", "provenance" ], "properties": { "organization_id": { "type": "string", "minLength": 1, "maxLength": 200 }, "organization_name": { "type": "string", "minLength": 1, "maxLength": 160 }, "actor_id": { "type": "string", "minLength": 1, "maxLength": 200 }, "display_name": { "type": "string", "minLength": 1, "maxLength": 160 }, "role": { "type": "string", "minLength": 1, "maxLength": 120 }, "provenance": { "type": "string", "enum": [ "AUTHENTICATED_TENANT", "VERIFIED_CONNECTOR", "CALLER_DECLARED" ] } } }, "AuthorityPresentation": { "type": "object", "additionalProperties": false, "required": [ "locale", "title", "description", "display_fields" ], "properties": { "locale": { "type": "string", "minLength": 2, "maxLength": 35, "pattern": "^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$" }, "title": { "type": "string", "minLength": 1, "maxLength": 160 }, "description": { "type": "string", "minLength": 1, "maxLength": 1000 }, "display_fields": { "type": "array", "maxItems": 20, "items": { "type": "object", "additionalProperties": false, "required": [ "key", "label", "value" ], "properties": { "key": { "type": "string", "pattern": "^[a-z][a-z0-9_]{0,63}$" }, "label": { "type": "string", "minLength": 1, "maxLength": 120 }, "value": { "type": "string", "minLength": 1, "maxLength": 500 } } } } } }, "ManagedAuthorityOrchestration": { "type": "object", "additionalProperties": false, "required": [ "mode", "escalation_id" ], "properties": { "mode": { "type": "string", "const": "MANAGED" }, "escalation_id": { "type": "string", "minLength": 8, "maxLength": 200 } }, "description": "Server-issued routing metadata. It identifies managed orchestration but is not execution authority and does not create an ExecutionBinding." }, "AuthorityRequirement": { "type": "object", "additionalProperties": false, "required": [ "requirement_version", "requirement_id", "source_decision_id", "source_dossier_id", "policy_version", "policy_reason_codes", "action_digest", "selector", "verification_requirements", "resolution", "originator", "presentation", "nonce", "issued_at", "expires_at" ], "properties": { "requirement_version": { "type": "string", "const": "decionis.authority_requirement/1" }, "requirement_id": { "type": "string", "minLength": 8, "maxLength": 200 }, "source_decision_id": { "type": "string", "minLength": 1, "maxLength": 200 }, "source_dossier_id": { "type": "string", "minLength": 1, "maxLength": 200 }, "policy_version": { "type": "string", "minLength": 1, "maxLength": 120 }, "policy_reason_codes": { "type": "array", "minItems": 1, "maxItems": 20, "items": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]{1,119}$" } }, "action_digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "selector": { "$ref": "#/components/schemas/AuthoritySelector" }, "verification_requirements": { "$ref": "#/components/schemas/AuthorityVerificationRequirements" }, "resolution": { "$ref": "#/components/schemas/AuthorityResolutionPolicy" }, "originator": { "$ref": "#/components/schemas/AuthorityOriginator" }, "presentation": { "$ref": "#/components/schemas/AuthorityPresentation" }, "nonce": { "type": "string", "pattern": "^[A-Za-z0-9_-]{43,128}$" }, "issued_at": { "type": "string", "format": "date-time" }, "expires_at": { "type": "string", "format": "date-time", "description": "Must be later than issued_at." }, "orchestration": { "$ref": "#/components/schemas/ManagedAuthorityOrchestration" } } }, "ProtocolDecisionDossierResponse": { "type": "object", "additionalProperties": true, "required": [ "service", "protocol_version", "dossier" ], "properties": { "service": { "type": "string" }, "protocol_version": { "type": "string" }, "dossier": { "type": "object", "additionalProperties": false, "required": [ "dossier_id", "org_id", "decision_evaluation_id", "dossier_payload", "evidence_hashes", "created_at", "updated_at" ], "properties": { "dossier_id": { "type": "string", "format": "uuid" }, "org_id": { "type": "string", "format": "uuid" }, "decision_evaluation_id": { "type": "string", "format": "uuid" }, "dossier_payload": { "type": "object", "additionalProperties": true }, "evidence_hashes": { "type": "array", "items": { "type": "string", "pattern": "^[0-9a-f]{64}$" } }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" } } } } }, "AgentActionCapsuleV04": { "type": "object", "description": "Agent Action Capsule compatibility profile pinned to draft-mih-scitt-agent-action-capsule-04, format 4, using plain RFC 8785/JCS.", "required": [ "spec_version", "format_version", "canonicalization_id", "capsule_id", "action_id", "action_type", "operator", "developer", "timestamp", "disposition", "assurance" ], "properties": { "spec_version": { "type": "string", "const": "draft-mih-scitt-agent-action-capsule-04" }, "format_version": { "type": "string", "const": "4" }, "canonicalization_id": { "type": "string", "const": "jcs" }, "capsule_id": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "action_id": { "type": "string", "minLength": 1 }, "decision_id": { "type": "string", "minLength": 1 }, "action_type": { "type": "string", "enum": [ "fyi", "decide" ] }, "operator": { "type": "string", "minLength": 1 }, "developer": { "type": "string", "minLength": 1 }, "timestamp": { "type": "string", "format": "date-time" }, "epoch_id": { "type": "string", "minLength": 1 }, "disposition": { "type": "object", "required": [ "decision", "approver", "human_disposed" ], "properties": { "decision": { "type": "string" }, "approver": { "type": "string", "enum": [ "human", "policy", "counterparty" ] }, "human_disposed": { "type": "boolean" }, "authority": { "type": "string" }, "verdict_class": { "type": "string" }, "reason_digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" } }, "additionalProperties": true }, "effect": { "type": "object", "required": [ "type", "status", "irreversibility_class" ], "properties": { "type": { "type": "string" }, "status": { "type": "string", "enum": [ "planned", "dispatched", "confirmed", "failed", "reverted" ] }, "request_digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "response_digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "external_ref": { "type": "string" }, "irreversibility_class": { "type": "string" }, "effect_attestation": { "type": "string" } }, "additionalProperties": true }, "assurance": { "type": "object", "additionalProperties": false, "required": [ "attestation_mode", "effect_mode", "ledger_mode" ], "properties": { "attestation_mode": { "type": "string", "enum": [ "self_attested", "anchored" ] }, "effect_mode": { "type": "string", "enum": [ "not_applicable", "dispatched_unconfirmed", "confirmed" ] }, "ledger_mode": { "type": "string", "enum": [ "standalone", "chained", "anchored" ] } } }, "constraints": { "type": "array", "items": { "type": "object", "required": [ "id", "result", "severity", "blocking" ], "properties": { "id": { "type": "string" }, "check_type": { "type": "string" }, "method": { "type": "string" }, "result": { "type": "string", "enum": [ "pass", "fail", "n/a" ] }, "severity": { "type": "string" }, "blocking": { "type": "boolean" }, "evidence_digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" } }, "additionalProperties": false } }, "chain": { "type": "object", "additionalProperties": false, "required": [ "parent_capsule_id", "relation" ], "properties": { "parent_capsule_id": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "relation": { "type": "string" } } }, "references": { "type": "array", "items": { "type": "object", "required": [ "type", "digest_alg", "digest" ], "properties": { "type": { "type": "string" }, "digest_alg": { "type": "string" }, "digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "citation_purpose": { "type": "string" } }, "additionalProperties": true } } }, "additionalProperties": true }, "AgentActionCapsuleProducerEnvelopeResponse": { "type": "object", "additionalProperties": false, "required": [ "service", "protocol_version", "capsule_id", "payload_encoding", "signing_available", "envelopes" ], "properties": { "service": { "type": "string" }, "protocol_version": { "type": "string" }, "capsule_id": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "payload_encoding": { "type": "string", "const": "raw-32-byte-capsule-id" }, "signing_available": { "type": "boolean" }, "envelopes": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "media_type", "profile", "content_type", "key_id", "cose_sign1_base64url", "verification" ], "properties": { "media_type": { "type": "string", "const": "application/cose" }, "profile": { "type": "string", "const": "draft-mih-scitt-agent-action-capsule-04" }, "content_type": { "type": "string", "const": "application/agent-action-capsule-id" }, "key_id": { "type": "string" }, "cose_sign1_base64url": { "type": "string", "pattern": "^[A-Za-z0-9_-]+$" }, "verification": { "type": "object", "additionalProperties": true } } } } } }, "ScittCapsuleRegistrationResponse": { "type": "object", "additionalProperties": true, "required": [ "capsule_id", "anchored", "registration" ], "properties": { "service": { "type": "string" }, "protocol_version": { "type": "string" }, "capsule_id": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "idempotent": { "type": "boolean" }, "anchored": { "type": "boolean", "description": "True only when both the Signed Statement and receipt profile verify." }, "status_path": { "type": "string" }, "registration": { "type": "object", "additionalProperties": false, "required": [ "org_id", "dossier_id", "capsule_id", "transparency_service", "status", "registration_statement_base64url", "statement_verified", "receipt_verified", "attempt_count", "created_at", "updated_at" ], "properties": { "org_id": { "type": "string", "format": "uuid" }, "dossier_id": { "type": "string", "format": "uuid" }, "capsule_id": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "transparency_service": { "type": "string", "format": "uri" }, "status": { "type": "string", "enum": [ "PENDING", "REGISTERING", "RECEIPT_UNVERIFIED", "ANCHORED", "FAILED" ] }, "registration_statement_base64url": { "type": "string" }, "statement_verified": { "type": "boolean" }, "receipt_base64url": { "type": [ "string", "null" ] }, "receipt_profile": { "type": [ "string", "null" ] }, "receipt_verified": { "type": "boolean" }, "service_key_id": { "type": [ "string", "null" ] }, "attempt_count": { "type": "integer", "minimum": 0 }, "last_error": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" } } } } }, "DecisionChainRequest": { "type": "object", "properties": { "chain_id": { "type": "string", "format": "uuid", "description": "Existing chain to append to. Optional when parent references are supplied." }, "workflow_id": { "type": "string", "description": "Customer workflow or execution instance identifier." }, "step_id": { "type": "string", "description": "Current workflow step being evaluated." }, "sequence": { "type": "integer", "minimum": 0 }, "parent_evaluation_ids": { "type": "array", "maxItems": 20, "items": { "type": "string", "format": "uuid" } }, "parent_dossier_ids": { "type": "array", "maxItems": 20, "items": { "type": "string", "format": "uuid" } }, "metadata": { "type": "object", "additionalProperties": true } }, "additionalProperties": true }, "DecisionChainSummary": { "type": "object", "required": [ "chain_id", "workflow_id", "step_id", "root_evaluation_id", "parent_evaluation_ids", "parent_dossier_ids", "lineage_depth", "integrity_hash", "chain_api_path" ], "properties": { "chain_id": { "type": "string", "format": "uuid" }, "workflow_id": { "type": "string" }, "step_id": { "type": "string" }, "sequence": { "type": "integer", "nullable": true }, "root_evaluation_id": { "type": "string", "format": "uuid" }, "parent_evaluation_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "parent_dossier_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "lineage_depth": { "type": "integer" }, "integrity_hash": { "type": "string" }, "chain_api_path": { "type": "string" }, "authority_classification": { "$ref": "#/components/schemas/AuthorityClassification" }, "verdict": { "type": "string", "enum": [ "ALLOW", "ESCALATE", "BLOCK" ] }, "execution_binding_digest": { "type": [ "string", "null" ], "pattern": "^sha256:[0-9a-f]{64}$" } }, "additionalProperties": false }, "DecisionChainLink": { "type": "object", "required": [ "id", "chain_id", "workflow_id", "step_id", "decision_evaluation_id", "dossier_id", "parent_evaluation_ids", "parent_dossier_ids", "root_evaluation_id", "lineage_depth", "integrity_hash", "integrity_verified", "dossier_api_path", "created_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "chain_id": { "type": "string", "format": "uuid" }, "workflow_id": { "type": "string" }, "step_id": { "type": "string" }, "sequence": { "type": "integer", "nullable": true }, "decision_evaluation_id": { "type": "string", "format": "uuid" }, "dossier_id": { "type": "string", "format": "uuid" }, "parent_evaluation_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "parent_dossier_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "root_evaluation_id": { "type": "string", "format": "uuid" }, "lineage_depth": { "type": "integer" }, "integrity_hash": { "type": "string" }, "integrity_verified": { "type": "boolean" }, "outcome": { "type": "string" }, "policy_version": { "type": "string" }, "authority_classification": { "type": [ "string", "null" ], "enum": [ "AUTHORITATIVE", "OBSERVATIONAL", null ] }, "verdict": { "type": [ "string", "null" ], "enum": [ "ALLOW", "ESCALATE", "BLOCK", null ] }, "execution_binding_digest": { "type": [ "string", "null" ], "pattern": "^sha256:[0-9a-f]{64}$" }, "dossier_api_path": { "type": "string" }, "created_at": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "DecisionChainEvidenceReference": { "type": "object", "additionalProperties": false, "description": "Privacy-safe reference to append-only execution evidence correlated with a Decision Chain. The audit ledger remains the evidence store; this object carries commitments and provenance, never raw provider payloads. DISPATCH appears only when a connected executor records dispatch evidence.", "required": [ "stage", "evaluation_id", "dossier_id", "status", "occurred_at", "ledger_entry_id", "ledger_entry_hash", "evidence_digest", "evidence_hash_verified", "execution_correlation_id", "binding_digest", "observed_at", "observation_method", "observer", "expected_effect_digest", "observed_effect_digest", "evidence_reference" ], "properties": { "stage": { "type": "string", "enum": [ "CLAIM", "DISPATCH", "FINALIZATION", "EFFECT" ] }, "evaluation_id": { "type": "string", "format": "uuid" }, "dossier_id": { "type": "string", "format": "uuid" }, "status": { "type": "string", "minLength": 1, "maxLength": 120 }, "occurred_at": { "type": "string", "format": "date-time" }, "ledger_entry_id": { "type": "string", "format": "uuid" }, "ledger_entry_hash": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "evidence_digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "evidence_hash_verified": { "type": "boolean", "description": "True when the evidence hash recorded in the ledger payload matches the canonical evidence fields projected into this reference." }, "execution_correlation_id": { "type": "string", "minLength": 1, "maxLength": 500 }, "binding_digest": { "type": [ "string", "null" ], "pattern": "^sha256:[0-9a-f]{64}$" }, "observed_at": { "type": [ "string", "null" ], "format": "date-time" }, "observation_method": { "type": [ "string", "null" ], "maxLength": 120 }, "observer": { "oneOf": [ { "type": "object", "additionalProperties": false, "required": [ "id", "version" ], "properties": { "id": { "type": "string", "minLength": 1, "maxLength": 500 }, "version": { "type": [ "string", "null" ], "minLength": 1, "maxLength": 500 } } }, { "type": "null" } ] }, "expected_effect_digest": { "type": [ "string", "null" ], "pattern": "^sha256:[0-9a-f]{64}$" }, "observed_effect_digest": { "type": [ "string", "null" ], "pattern": "^sha256:[0-9a-f]{64}$" }, "evidence_reference": { "type": [ "string", "null" ], "minLength": 1, "maxLength": 2000 } } }, "DecisionChain": { "type": "object", "required": [ "service", "protocol_version", "org_id", "chain_id", "count", "max_lineage_depth", "integrity_verified", "ledger_verification", "links", "link_limit", "links_truncated", "evidence_lineage", "evidence_lineage_limit", "evidence_lineage_truncated" ], "properties": { "service": { "type": "string" }, "protocol_version": { "type": "string" }, "org_id": { "type": "string", "format": "uuid" }, "chain_id": { "type": "string", "format": "uuid" }, "workflow_id": { "type": "string", "nullable": true }, "root_evaluation_id": { "type": "string", "format": "uuid", "nullable": true }, "count": { "type": "integer" }, "max_lineage_depth": { "type": "integer" }, "integrity_verified": { "type": "boolean" }, "ledger_verification": { "type": "object", "additionalProperties": false, "required": [ "valid", "complete", "checked", "max_entries" ], "description": "Bounded canonical-ledger verification performed for this response. `complete: false` means the response must not be treated as verified, even when the checked prefix contained no broken link.", "properties": { "valid": { "type": "boolean" }, "complete": { "type": "boolean" }, "checked": { "type": "integer", "minimum": 0 }, "max_entries": { "type": "integer", "minimum": 1, "maximum": 50000 } } }, "links": { "type": "array", "items": { "$ref": "#/components/schemas/DecisionChainLink" } }, "link_limit": { "type": "integer", "minimum": 1, "maximum": 500, "description": "Maximum Decision Chain links returned in this bounded projection." }, "links_truncated": { "type": "boolean", "description": "True when additional Decision Chain links exist. A truncated response must not be interpreted as verification of the complete chain." }, "evidence_lineage": { "type": "array", "description": "Claim, optional dispatch, finalization, and effect-evidence commitments correlated from canonical append-only audit-ledger membership and a cryptographically verified ExecutionBinding.", "items": { "$ref": "#/components/schemas/DecisionChainEvidenceReference" } }, "evidence_lineage_limit": { "type": "integer", "minimum": 1, "maximum": 500, "description": "Maximum canonical audit-ledger entries considered by this projection." }, "evidence_lineage_truncated": { "type": "boolean", "description": "True when additional chain-correlated ledger entries exist. In that case evidence_lineage is withheld so a bounded prefix is not presented as complete authoritative lineage." } }, "additionalProperties": false }, "ShadowEvaluateDecisionReport": { "type": "object", "required": [ "evaluation_id", "dossier_id", "created_at", "decision_type", "policy_version", "mode", "outcome", "confidence", "would_execute", "execution_action", "reason", "dossier_api_path" ], "properties": { "evaluation_id": { "type": "string", "format": "uuid" }, "dossier_id": { "type": "string", "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "decision_type": { "type": "string" }, "decision_domain": { "type": "string", "nullable": true }, "amount": { "type": "number", "nullable": true }, "risk_score": { "type": "number", "nullable": true }, "channel": { "type": "string", "nullable": true }, "policy_version": { "type": "string" }, "mode": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ] }, "outcome": { "type": "string", "enum": [ "APPROVE", "ESCALATE", "REJECT", "REVIEW" ] }, "confidence": { "type": "number" }, "would_execute": { "type": "boolean" }, "execution_action": { "type": "string", "enum": [ "CONTINUE", "STOP", "HAND_OFF", "REVIEW" ] }, "reason": { "type": "string" }, "policy_guard_reason": { "type": "string", "nullable": true }, "policy_evaluation_resolution": { "type": "string", "nullable": true }, "selected_rule_id": { "type": "string", "nullable": true }, "dossier_api_path": { "type": "string" } }, "additionalProperties": false }, "ShadowEvaluateDecisionReportSummary": { "type": "object", "required": [ "total_evaluations", "would_approve_count", "would_block_count", "would_escalate_count", "review_required_count", "non_approve_count", "non_approve_rate", "policy_mismatch_count", "policy_mismatch_rate", "near_miss_count", "near_miss_rate" ], "properties": { "total_evaluations": { "type": "integer" }, "would_approve_count": { "type": "integer" }, "would_block_count": { "type": "integer" }, "would_escalate_count": { "type": "integer" }, "review_required_count": { "type": "integer" }, "non_approve_count": { "type": "integer" }, "non_approve_rate": { "type": "number" }, "policy_mismatch_count": { "type": "integer" }, "policy_mismatch_rate": { "type": "number" }, "near_miss_count": { "type": "integer" }, "near_miss_rate": { "type": "number" }, "outcome_counts": { "type": "object", "additionalProperties": { "type": "integer" } }, "top_decision_types": { "type": "array", "items": { "type": "object", "additionalProperties": true } }, "top_reason_patterns": { "type": "array", "items": { "type": "object", "additionalProperties": true } } }, "additionalProperties": false }, "ShadowEvaluateDecisionReportsResponse": { "type": "object", "required": [ "service", "protocol_version", "generated_at", "org_id", "mode", "count", "reports", "summary" ], "properties": { "service": { "type": "string" }, "protocol_version": { "type": "string" }, "generated_at": { "type": "string", "format": "date-time" }, "org_id": { "type": "string", "format": "uuid" }, "mode": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ] }, "since": { "type": "string", "format": "date-time", "nullable": true }, "count": { "type": "integer" }, "reports": { "type": "array", "items": { "$ref": "#/components/schemas/ShadowEvaluateDecisionReport" } }, "summary": { "$ref": "#/components/schemas/ShadowEvaluateDecisionReportSummary" } }, "additionalProperties": false }, "ShadowEvaluateDecisionReportsSummaryResponse": { "type": "object", "required": [ "service", "protocol_version", "generated_at", "org_id", "mode", "summary" ], "properties": { "service": { "type": "string" }, "protocol_version": { "type": "string" }, "generated_at": { "type": "string", "format": "date-time" }, "org_id": { "type": "string", "format": "uuid" }, "mode": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ] }, "since": { "type": "string", "format": "date-time", "nullable": true }, "summary": { "$ref": "#/components/schemas/ShadowEvaluateDecisionReportSummary" } }, "additionalProperties": false }, "DecisionSignature": { "type": "object", "required": [ "algorithm", "value" ], "properties": { "algorithm": { "type": "string", "enum": [ "Ed25519" ] }, "value": { "type": "string", "description": "Base64, base64url, or hex encoded signature bytes." } } }, "DecisionResponse": { "type": "object", "required": [ "decision_id", "status", "reason_codes", "explanation" ], "properties": { "decision_id": { "type": "string" }, "status": { "$ref": "#/components/schemas/DecisionStatus" }, "reason_codes": { "type": "array", "items": { "type": "string" } }, "explanation": { "type": "string" }, "dossier_url": { "type": "string", "format": "uri" }, "signature": { "$ref": "#/components/schemas/DecisionSignature" }, "latency_ms": { "type": "integer", "minimum": 0 } }, "additionalProperties": true }, "DecisionDossier": { "type": "object", "properties": { "decision_id": { "type": "string" }, "dossier_url": { "type": "string", "format": "uri" }, "status": { "$ref": "#/components/schemas/DecisionStatus" }, "audit_events": { "type": "array", "items": { "type": "object", "additionalProperties": true } } }, "additionalProperties": true }, "PolicyValidationResponse": { "type": "object", "required": [ "valid" ], "properties": { "valid": { "type": "boolean" }, "errors": { "type": "array", "items": { "type": "string" } }, "warnings": { "type": "array", "items": { "type": "string" } } }, "additionalProperties": true }, "PolicyBundle": { "type": "object", "required": [ "protocol_version", "bundle_id", "org_id", "version", "effective_from", "rules" ], "properties": { "protocol_version": { "type": "string", "pattern": "^1\\.[0-9]+(\\.[0-9]+)?$" }, "bundle_id": { "type": "string", "format": "uuid" }, "org_id": { "type": "string" }, "version": { "type": "string", "minLength": 1, "maxLength": 100 }, "effective_from": { "type": "string", "format": "date-time" }, "effective_to": { "type": "string", "format": "date-time" }, "rules": { "type": "array", "minItems": 1, "items": { "$ref": "#/components/schemas/PolicyRule" } }, "metadata": { "type": "object", "properties": { "author": { "type": "string" }, "source": { "type": "string" }, "change_ticket": { "type": "string" }, "signal_admission": { "$ref": "#/components/schemas/SemanticSignalAdmissionPolicy" } }, "additionalProperties": false }, "signature": { "type": "object", "properties": { "algo": { "type": "string" }, "digest": { "type": "string" }, "signed_at": { "type": "string", "format": "date-time" }, "signed_by": { "type": "string" } }, "additionalProperties": false } }, "additionalProperties": false }, "SemanticSignalAdmissionPolicy": { "type": "object", "additionalProperties": false, "description": "Deterministic trust gate for typed semantic evidence.", "properties": { "allowed_producers": { "type": "array", "maxItems": 100, "uniqueItems": true, "items": { "type": "string" } }, "allowed_detector_versions": { "type": "array", "maxItems": 100, "uniqueItems": true, "items": { "type": "string" } }, "require_evidence_digest": { "type": "boolean" }, "minimum_confidence_basis_points": { "type": "integer", "minimum": 0, "maximum": 10000 }, "required_signal_paths": { "type": "array", "maxItems": 50, "uniqueItems": true, "items": { "type": "string" } }, "on_failure": { "type": "string", "enum": [ "ESCALATE", "AUTO_REJECT" ] } } }, "SemanticSignalEnvelope": { "type": "object", "additionalProperties": false, "required": [ "schema_version", "signal_id", "kind", "value", "producer", "observed_at", "confidence_basis_points", "evidence_digest", "value_digest", "material" ], "properties": { "schema_version": { "type": "string", "const": "1.0" }, "signal_id": { "type": "string", "minLength": 1, "maxLength": 200 }, "kind": { "type": "string", "pattern": "^(intent_risk|scope_drift|data_sensitivity|suspected_exfiltration|[a-z0-9][a-z0-9.-]{0,62}:[a-z0-9][a-z0-9._-]{0,119})$" }, "value": {}, "producer": { "type": "object", "additionalProperties": false, "required": [ "provider", "detector_version" ], "properties": { "provider": { "type": "string", "minLength": 1, "maxLength": 200 }, "detector_version": { "type": "string", "minLength": 1, "maxLength": 200 } } }, "observed_at": { "type": "string", "format": "date-time" }, "confidence_basis_points": { "type": "integer", "minimum": 0, "maximum": 10000 }, "evidence_digest": { "type": [ "string", "null" ], "pattern": "^sha256:[0-9a-f]{64}$" }, "value_digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "material": { "type": "boolean" } } }, "PersistedSemanticSignalMetadata": { "type": "object", "additionalProperties": false, "required": [ "schema_version", "signal_id", "kind", "detector_version", "observed_at", "confidence_basis_points", "evidence_digest", "value_digest", "material" ], "properties": { "schema_version": { "type": "string", "const": "1.0" }, "signal_id": { "type": "string", "minLength": 1, "maxLength": 200 }, "kind": { "type": "string", "pattern": "^(intent_risk|scope_drift|data_sensitivity|suspected_exfiltration|[a-z0-9][a-z0-9.-]{0,62}:[a-z0-9][a-z0-9._-]{0,119})$" }, "detector_version": { "type": "string", "minLength": 1, "maxLength": 200 }, "observed_at": { "type": "string", "format": "date-time" }, "confidence_basis_points": { "type": "integer", "minimum": 0, "maximum": 10000 }, "evidence_digest": { "type": [ "string", "null" ], "pattern": "^sha256:[0-9a-f]{64}$" }, "value_digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "material": { "type": "boolean" } } }, "ProtocolSignalEnvelope": { "type": "object", "additionalProperties": false, "required": [ "protocol_version", "envelope_id", "org_id", "source", "domain", "metric_name", "metric_type", "value", "recorded_at", "ingested_at" ], "properties": { "protocol_version": { "type": "string", "pattern": "^1\\.[0-9]+(\\.[0-9]+)?$" }, "envelope_id": { "type": "string", "format": "uuid" }, "org_id": { "type": "string" }, "source": { "type": "object", "additionalProperties": false, "required": [ "provider", "mode" ], "properties": { "provider": { "type": "string" }, "connector_id": { "type": "string" }, "mode": { "type": "string", "enum": [ "DIRECT_API", "CUSTOMER_INFRA", "WEBHOOK", "MANUAL" ] } } }, "domain": { "type": "string" }, "metric_name": { "type": "string" }, "metric_type": { "type": "string", "enum": [ "gauge", "counter", "event", "categorical" ] }, "value": {}, "unit": { "type": "string" }, "recorded_at": { "type": "string", "format": "date-time" }, "ingested_at": { "type": "string", "format": "date-time" }, "dimensions": { "type": "object", "additionalProperties": true }, "semantic": { "$ref": "#/components/schemas/PersistedSemanticSignalMetadata" }, "evidence": { "type": "array", "maxItems": 100, "items": { "type": "string" } }, "trace": { "type": "object", "additionalProperties": true }, "hash": { "type": "string", "pattern": "^[A-Fa-f0-9]{64}$" } } }, "PolicyRule": { "type": "object", "required": [ "rule_id", "name", "decision_domain", "when", "then", "priority", "enabled" ], "properties": { "rule_id": { "type": "string" }, "name": { "type": "string" }, "decision_domain": { "type": "string" }, "when": { "type": "object", "additionalProperties": true }, "then": { "type": "object", "required": [ "action" ], "properties": { "action": { "type": "string", "enum": [ "REQUIRE_REVIEW", "AUTO_APPROVE", "AUTO_REJECT", "ESCALATE", "REQUEST_INFO" ] }, "severity": { "type": "string", "enum": [ "routine", "elevated", "urgent" ] }, "assignee_role": { "type": "string" }, "sla_minutes": { "type": "integer", "minimum": 1 }, "authority": { "type": "object", "additionalProperties": false, "required": [ "reason_codes", "selector", "verification_requirements", "resolution", "expires_in_seconds" ], "properties": { "reason_codes": { "type": "array", "minItems": 1, "maxItems": 20, "uniqueItems": true, "items": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]{1,119}$" } }, "selector": { "$ref": "#/components/schemas/AuthoritySelector" }, "verification_requirements": { "$ref": "#/components/schemas/AuthorityVerificationRequirements" }, "resolution": { "$ref": "#/components/schemas/AuthorityResolutionPolicy" }, "expires_in_seconds": { "type": "integer", "minimum": 60, "maximum": 3600 } } } }, "additionalProperties": false }, "priority": { "type": "integer" }, "enabled": { "type": "boolean" }, "rationale": { "type": "string" } }, "additionalProperties": false }, "PolicyDraftSource": { "type": "object", "required": [ "label", "source_type" ], "description": "One manual policy source. Provide `content` (inline text) or\n`content_base64` (file bytes; text is extracted server-side from PDF,\nXLSX, XML, HTML, JSON, and plain-text documents such as transaction\nor audit logs).\n", "properties": { "label": { "type": "string", "maxLength": 200 }, "source_type": { "type": "string", "maxLength": 80, "description": "Caller-chosen tag, e.g. upload, jira, confluence, audit_log." }, "content": { "type": "string", "maxLength": 250000 }, "content_base64": { "type": "string", "maxLength": 10000000 }, "content_type": { "type": "string", "maxLength": 200 }, "file_name": { "type": "string", "maxLength": 300 }, "external_reference": { "type": "string", "maxLength": 500 } }, "additionalProperties": false }, "PolicyDraftRequest": { "type": "object", "description": "Provide manual sources, live connector ids, or both — at least one of the two is required.\n", "properties": { "suggested_name": { "type": "string", "maxLength": 160 }, "workflow_key": { "type": "string", "maxLength": 120 }, "sources": { "type": "array", "maxItems": 20, "items": { "$ref": "#/components/schemas/PolicyDraftSource" } }, "live_connector_ids": { "type": "array", "maxItems": 6, "description": "Org policy-source connectors to pull live at draft time (Jira, Confluence, Notion, Google Drive, Git repository, SAP).\n", "items": { "type": "string", "format": "uuid" } } }, "additionalProperties": false }, "PolicyStrategyDraftResponse": { "type": "object", "required": [ "org", "generated_at", "draft" ], "properties": { "org": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "generated_at": { "type": "string", "format": "date-time" }, "draft": { "type": "object", "required": [ "used_llm", "suggested_name", "workflow_key", "summary", "strategy" ], "properties": { "used_llm": { "type": "boolean" }, "suggested_name": { "type": "string" }, "workflow_key": { "type": "string" }, "summary": { "type": "string" }, "strategy": { "type": "object", "description": "The strategy-shaped draft, including `strategy_rules` with clauses bucketed for automatic execution, escalation, and blocking.\n", "additionalProperties": true }, "extracted_sources": { "type": "array", "items": {} }, "review_checklist": { "type": "array", "items": {} }, "open_questions": { "type": "array", "items": {} }, "warnings": { "type": "array", "items": {} } }, "additionalProperties": true } }, "additionalProperties": false }, "PolicyPackDraftResponse": { "type": "object", "required": [ "org", "generated_at", "pack_id", "draft" ], "properties": { "org": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "generated_at": { "type": "string", "format": "date-time" }, "pack_id": { "type": "string", "format": "uuid", "description": "The persisted draft pack, ready for review and finalization." }, "draft": { "type": "object", "required": [ "used_llm", "suggested_name", "workflow_key", "pack", "review" ], "properties": { "status": { "type": "string" }, "used_llm": { "type": "boolean" }, "suggested_name": { "type": "string" }, "workflow_key": { "type": "string" }, "pack": { "type": "object", "description": "The executable pack: compiler-validated rules of the shape `{ name, all|any: [{field, op, value}], action }` with action one of allow, block, restrain, escalate.\n", "properties": { "rules": { "type": "array", "items": { "type": "object", "additionalProperties": true } } }, "additionalProperties": true }, "source_summary": { "type": "array", "items": {} }, "review": { "type": "array", "description": "Clauses that could not become executable predicates — returned for human review instead of being synthesized into rules.\n", "items": {} } }, "additionalProperties": true } }, "additionalProperties": false }, "ArtifactAcceptedResponse": { "type": "object", "required": [ "accepted", "service", "protocol_version", "artifact", "artifact_id", "org_id", "received_at" ], "properties": { "accepted": { "type": "boolean" }, "service": { "type": "string" }, "protocol_version": { "type": "string" }, "artifact": { "type": "string", "enum": [ "policy_bundle", "signal_envelope" ] }, "artifact_id": { "type": "string" }, "org_id": { "type": "string" }, "received_at": { "type": "string", "format": "date-time" } }, "additionalProperties": true }, "HealthResponse": { "type": "object", "required": [ "status" ], "properties": { "status": { "type": "string", "examples": [ "ok" ] }, "version": { "type": "string" } } }, "ErrorResponse": { "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "message": { "type": "string" }, "request_id": { "type": "string" }, "status": { "type": "integer" } } }, "OpsGateRequest": { "type": "object", "description": "A spend/disbursement payload for the ops spend-control vertical pack.", "properties": { "object_type": { "type": "string", "examples": [ "Expense", "VendorPayment", "Refund", "Credit" ] }, "object_id": { "type": "string" }, "action": { "type": "string" }, "proposed_state": { "type": "object", "description": "amount, currency, vendor_id, invoice_number, vendor_status, expense_threshold, refund_limit, credit_limit, etc.", "additionalProperties": true }, "actor": { "type": "object", "description": "The acting principal and its role (e.g. role Controller or CFO).", "additionalProperties": true }, "context": { "type": "object", "description": "requested_by, approved_by, second_approver, org_id, etc.", "additionalProperties": true } }, "additionalProperties": true }, "OpsGateVerdict": { "type": "object", "properties": { "decision": { "type": "string", "enum": [ "ALLOW", "BLOCK", "ESCALATE", "DELAY" ] }, "outcome": { "type": "string", "enum": [ "APPROVE", "REJECT", "ESCALATE", "REVIEW" ] }, "reason": { "type": "string" }, "required_action": { "type": [ "string", "null" ] }, "gate": { "type": "string", "enum": [ "spend_admission", "disbursement_authority" ] }, "decision_domain": { "type": "string", "enum": [ "OPS_SPEND_ADMISSION", "OPS_DISBURSEMENT_AUTHORITY" ] }, "rule_id": { "type": [ "string", "null" ] }, "duplicate_suspected": { "type": "boolean" }, "policy_version": { "type": "string" }, "dossier_id": { "type": [ "string", "null" ] }, "dossier_sha256": { "type": [ "string", "null" ] }, "ledger_entry_id": { "type": [ "string", "null" ] }, "ledger_entry_hash": { "type": [ "string", "null" ] }, "federated": { "type": "boolean" }, "pipeline": { "type": "boolean" }, "idempotent_replay": { "type": "boolean" } }, "additionalProperties": true }, "SurfaceDecisionRequest": { "type": "object", "required": [ "surface", "decision", "dossier_id", "dossier_sha256" ], "properties": { "surface": { "type": "string", "examples": [ "amazon", "ebay", "shopify" ] }, "decision": { "type": "string", "enum": [ "authorize", "block", "review" ] }, "dossier_id": { "type": "string" }, "dossier_sha256": { "type": "string" }, "org_id": { "type": "string", "format": "uuid" }, "mode": { "type": "string", "enum": [ "shadow", "enforced" ] }, "dossier": { "type": "object", "description": "The full signed surface dossier. When present it is persisted and made exportable as a proof packet; when omitted only a ledger entry is appended.", "additionalProperties": true } }, "additionalProperties": true }, "SurfaceDecisionResponse": { "type": "object", "properties": { "federated": { "type": "boolean" }, "persisted": { "type": "boolean" }, "surface": { "type": "string" }, "org_id": { "type": "string" }, "dossier_id": { "type": "string" }, "ledger_entry_id": { "type": [ "string", "null" ] }, "ledger_entry_hash": { "type": [ "string", "null" ] }, "ledger_error": { "type": [ "string", "null" ] } }, "additionalProperties": true }, "EbayChallengeResponse": { "type": "object", "required": [ "challengeResponse" ], "properties": { "challengeResponse": { "type": "string", "description": "Hex SHA-256 of challengeCode + verificationToken + endpointURL." } } }, "MarketplaceDeletionNotification": { "type": "object", "description": "eBay account-deletion notification payload (subset Decionis reads).", "properties": { "metadata": { "type": "object", "properties": { "topic": { "type": "string" }, "schemaVersion": { "type": "string" } }, "additionalProperties": true }, "notification": { "type": "object", "properties": { "notificationId": { "type": "string" }, "data": { "type": "object", "properties": { "username": { "type": "string" }, "userId": { "type": "string" }, "eiasToken": { "type": "string" } }, "additionalProperties": true } }, "additionalProperties": true } }, "additionalProperties": true }, "DecisionDossierProofPacket": { "type": "object", "properties": { "service": { "type": "string" }, "protocol_version": { "type": "string" }, "packet_type": { "type": "string", "examples": [ "decionis.decision_dossier.proof_packet" ] }, "packet_version": { "type": "string" }, "issued_at": { "type": "string", "format": "date-time" }, "subject": { "type": "object", "properties": { "org_id": { "type": "string" }, "dossier_id": { "type": "string" } } }, "dossier": { "type": "object", "additionalProperties": true }, "policy_snapshot": { "type": [ "object", "null" ], "additionalProperties": true }, "ledger_anchor": { "type": "object", "additionalProperties": true }, "proof_bundle": { "type": [ "object", "null" ], "additionalProperties": true }, "verification": { "type": "object", "description": "signature_verified, policy_snapshot_verified, chain_integrity_verified, proof_bundle_verified, and overall (VERIFIED | PARTIAL | UNVERIFIED).", "additionalProperties": true }, "verify_instructions": { "type": "object", "additionalProperties": true } }, "additionalProperties": true }, "DecisionChainProofPacket": { "type": "object", "description": "Backward-compatible schema name for the authenticated Decision Chain verification report. The response is not signed, portable, or independently verifiable offline because source dossier and ledger bytes are not embedded.", "properties": { "service": { "type": "string" }, "protocol_version": { "type": "string" }, "packet_type": { "type": "string", "examples": [ "decionis.decision_chain.proof_packet" ] }, "packet_version": { "type": "string" }, "report_semantics": { "type": "object", "additionalProperties": false, "required": [ "verification_mode", "response_signed", "source_evidence_embedded", "portable", "offline_verifiable", "steps" ], "properties": { "verification_mode": { "type": "string", "const": "SERVER_STATE_AT_ISSUED_AT" }, "response_signed": { "type": "boolean", "const": false }, "source_evidence_embedded": { "type": "boolean", "const": false }, "portable": { "type": "boolean", "const": false }, "offline_verifiable": { "type": "boolean", "const": false }, "steps": { "type": "array", "items": { "type": "string" } } } }, "issued_at": { "type": "string", "format": "date-time" }, "subject": { "type": "object", "properties": { "org_id": { "type": "string" }, "chain_id": { "type": "string" } } }, "chain": { "type": "object", "additionalProperties": true }, "ledger_anchor": { "type": "object", "additionalProperties": true }, "links": { "type": "array", "items": { "type": "object", "additionalProperties": true } }, "overall": { "type": "string", "description": "Point-in-time server verification result, not a signature over this response.", "enum": [ "VERIFIED", "PARTIAL", "UNVERIFIED" ] }, "verify_instructions": { "type": "object", "description": "Explains the server-report boundary and how to obtain source evidence.", "additionalProperties": true } }, "additionalProperties": true }, "AgentProvisionRequest": { "type": "object", "properties": { "agent_name": { "type": "string", "maxLength": 64, "description": "Optional display name for the workspace, shown to the claiming owner." } }, "additionalProperties": false }, "AgentProvisionLimits": { "type": "object", "description": "The caps on the anonymous lane, echoed so agents plan around them.", "properties": { "requests_per_minute": { "type": "integer", "examples": [ 10 ] }, "workspaces_per_network_per_day": { "type": "integer", "examples": [ 5 ] }, "governed_decisions_per_month": { "type": "integer", "examples": [ 50 ] }, "workspaces_service_wide_per_day": { "type": "integer", "description": "Service-wide daily ceiling across every network (present only when the deployment enables one). When minting answers 429 with PROVISION_LIMIT_REACHED and Retry-After, claim an existing workspace instead of retrying from a new address." } }, "additionalProperties": true }, "AgentProvisionResponse": { "type": "object", "required": [ "org_id", "raw_key", "provisional", "limits", "claim", "next" ], "properties": { "org_id": { "type": "string", "format": "uuid" }, "raw_key": { "type": "string", "description": "The workspace's org API key. Returned exactly once — store it." }, "provisional": { "type": "boolean", "description": "Always true at mint; the workspace stays provisional until claimed." }, "limits": { "$ref": "#/components/schemas/AgentProvisionLimits" }, "claim": { "type": "object", "description": "How to attach a human owner — the claim/start and claim/verify endpoints prefilled for this org, plus the note to surface to your operator. The key and dossier ledger survive the claim.", "additionalProperties": true }, "next": { "type": "object", "description": "Suggested next calls, starting with a shadow-mode evaluate-decision.", "additionalProperties": true } }, "additionalProperties": true }, "PublicDossierVerificationResponse": { "type": "object", "required": [ "service", "verified", "cryptographically_verified", "execution_eligible", "execution_authority", "generated_at", "verification_status", "proof_bundle", "dossier", "integrity" ], "properties": { "service": { "type": "string", "examples": [ "decionis" ] }, "verified": { "type": "boolean", "description": "Compatibility result. Protocol 1.0 artifacts retain their original share-link verification semantics. When an Ed25519 proof bundle is present this equals its cryptographic signature result. This field is not an execution-eligibility statement." }, "cryptographically_verified": { "type": "boolean", "description": "True only when every listed proof artifact verified against the published Ed25519 JWKS. This does not by itself establish execution eligibility." }, "execution_eligible": { "type": "boolean", "description": "True only for a cryptographically valid Protocol 1.1 authoritative ALLOW whose required execution-authority artifacts and semantic commitments are proof-covered." }, "execution_authority": { "type": "object", "required": [ "protocol_version", "required_artifact_coverage_verified", "authority_classification", "execution_eligible" ], "properties": { "protocol_version": { "type": [ "string", "null" ], "minLength": 1, "maxLength": 120, "description": "Signed protocol declaration when present. Historical, future, or otherwise unsupported values are echoed for diagnosis but never promoted to Protocol 1.1 execution eligibility." }, "required_artifact_coverage_verified": { "type": "boolean" }, "authority_classification": { "oneOf": [ { "$ref": "#/components/schemas/AuthorityClassification" }, { "type": "null" } ] }, "execution_eligible": { "type": "boolean" } }, "additionalProperties": false }, "generated_at": { "type": "string", "format": "date-time" }, "verification_status": { "type": "object", "description": "Per-check breakdown — signature, policy snapshot, ledger chain, proof bundle — each with verified, severity, and detail.", "additionalProperties": true }, "proof_bundle": { "type": "object", "description": "Ed25519 verification detail, the JWKS URL, and a self_verify command anyone can run offline with @decionis/verify.", "additionalProperties": true }, "dossier": { "type": "object", "description": "Share-safe public projection. Categorical tokens pass; caller- minted values and identifiers are masked server-side; the policy snapshot is proven and pinned by hash but never shipped.", "additionalProperties": true }, "integrity": { "type": "object", "additionalProperties": true }, "verification": { "type": "object", "description": "Fresh expiring share links for this dossier (v2, org-scoped).", "additionalProperties": true }, "signal_trace": { "type": "array", "items": { "type": "object", "additionalProperties": true } }, "overrides": { "type": "object", "additionalProperties": true }, "message": { "type": "string" } }, "additionalProperties": true }, "PublicDossierProofBundleResponse": { "type": "object", "required": [ "service", "dossier_id", "dossier_payload", "jwks_url" ], "properties": { "service": { "type": "string", "examples": [ "decionis" ] }, "dossier_id": { "type": "string", "format": "uuid" }, "dossier_payload": { "type": "object", "description": "Only what verification needs — the signed documents at their JSON-pointer paths plus integrity.proof_bundle. Nothing else from the dossier payload.", "additionalProperties": true }, "jwks_url": { "type": "string", "format": "uri" }, "jwks_path": { "type": "string" }, "verify_with": { "type": "object", "description": "The exact npx @decionis/verify command for this bundle.", "additionalProperties": true }, "message": { "type": "string" } }, "additionalProperties": true }, "PublicDossierReproduceResponse": { "type": "object", "required": [ "service", "dossier_id", "reproduction" ], "properties": { "service": { "type": "string", "examples": [ "decionis" ] }, "dossier_id": { "type": "string", "format": "uuid" }, "reproduction": { "type": "object", "description": "The deterministic re-run result — same inputs plus same policy bundle, compared against the recorded verdict.", "additionalProperties": true }, "message": { "type": "string" } }, "additionalProperties": true }, "OrgClaimStartRequest": { "type": "object", "required": [ "owner_email" ], "properties": { "owner_email": { "type": "string", "format": "email", "maxLength": 200 } }, "additionalProperties": false }, "OrgClaimStartResponse": { "type": "object", "required": [ "verification" ], "properties": { "verification": { "type": "object", "required": [ "channel", "owner_email", "expires_at" ], "properties": { "channel": { "type": "string", "enum": [ "email" ] }, "owner_email": { "type": "string", "format": "email" }, "expires_at": { "type": "string", "format": "date-time" }, "email_sent": { "type": "boolean" }, "email_delivery_mode": { "type": "string" } }, "additionalProperties": true } }, "additionalProperties": true }, "OrgClaimVerifyRequest": { "type": "object", "required": [ "owner_email", "otp_code" ], "properties": { "owner_email": { "type": "string", "format": "email", "maxLength": 200 }, "otp_code": { "type": "string", "pattern": "^\\d{6}$" }, "password": { "type": "string", "minLength": 8, "maxLength": 256, "description": "Required only when the email has no existing account — it becomes sign-in." }, "name": { "type": "string", "maxLength": 200 } }, "additionalProperties": false }, "OrgClaimVerifyResponse": { "type": "object", "required": [ "claimed", "org", "user" ], "properties": { "claimed": { "type": "boolean" }, "org": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": [ "string", "null" ] } }, "additionalProperties": true }, "user": { "type": "object", "properties": { "id": { "type": "string" }, "email": { "type": "string", "format": "email" }, "name": { "type": [ "string", "null" ] } }, "additionalProperties": true }, "existing_user": { "type": "boolean" }, "next": { "type": "object", "description": "Workspace and onboarding paths for the newly attached owner.", "additionalProperties": true } }, "additionalProperties": true }, "OrgVerificationLinkRotationResponse": { "type": "object", "required": [ "rotated", "verification_link_secret_version" ], "properties": { "rotated": { "type": "boolean" }, "verification_link_secret_version": { "type": "integer", "description": "The new per-org secret version; freshly minted links use it." }, "message": { "type": "string" } }, "additionalProperties": true } } } }