Read one held allowance and what it holds
The allowance and its usage, as listed. Requires policy:read, policy:write or org:* scope.
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Path Parameters
The name a policy rule's then.allowance.key draws on, unique within the organisation.
^[a-z0-9][a-z0-9._:-]{0,127}$Query Parameters
Optional when the authenticated API key is already bound to an organization.
uuidResponse Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/authority/allowances/string"{ "service": "decionis", "allowance_key": "string", "unit": "string", "limit": 0, "window_seconds": 0, "description": "string", "usage": { "reserved": 0, "held": 0, "consumed": 0, "available": 0 }, "created_at": "2019-08-24T14:15:22Z", "updated_at": "2019-08-24T14:15:22Z"}List the organisation's held allowances, with what each one holds GET
Every allowance the organisation defines, with its usage now: `reserved` by grants not yet claimed and not expired, `held` by claims whose outcome is open or unknown (CLAIMED, INDETERMINATE), `consumed` by committed claims within the window (all of them when `window_seconds` is null), and what is `available` to the next grant. Requires policy:read, policy:write or org:* scope.
Define a held allowance, or change its limit or window PUT
Defines the allowance under `{allowanceKey}`, or replaces its unit, limit, window and description. Raising the limit is a top-up: the next grant drawing on it sees the room at once. Lowering it below what is reserved, held and consumed refuses every new draw until enough settles or leaves the window; reservations already made stay valid. A policy rule names the key in `then.allowance`, and a draw on a key no allowance is defined under is refused as `ALLOWANCE_UNDEFINED`. Requires policy:write or org:* scope, so an agent's `decision:write` key can never raise the limit it draws on.