List the organisation's held allowances, with what each one holds
Every allowance the organisation defines, with its usage now:
reserved by grants not yet claimed and not expired, held by
claims whose outcome is open or unknown (CLAIMED, INDETERMINATE),
consumed by committed claims within the window (all of them when
window_seconds is null), and what is available to the next
grant. Requires policy:read, policy:write or org:* scope.
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Query Parameters
Optional when the authenticated API key is already bound to an organization.
uuidResponse Body
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/authority/allowances"{ "service": "decionis", "allowances": [ { "service": "decionis", "allowance_key": "string", "unit": "string", "limit": 0, "window_seconds": 0, "description": "string", "usage": { "reserved": 0, "held": 0, "consumed": 0, "available": 0 }, "created_at": "2019-08-24T14:15:22Z", "updated_at": "2019-08-24T14:15:22Z" } ]}Finalize a claimed downstream commit attempt POST
Deprecated alias of `POST /v1/authority/grants/{grantId}/receipts`: the same handler. Records COMMITTED, FAILED, or INDETERMINATE. INDETERMINATE effects must be reconciled and are never safe for automatic retry. A COMMITTED claim proves an attempt was finalized, but an effect is confirmed only when digest-bound `effect_evidence` with status CONFIRMED is accepted. If the signed grant expires after a successful claim, finalization may continue only while the exact persisted claim token, nonce, correlation, and database claim lease remain valid. An expired unclaimed grant is never execution-eligible. A finalize request at or after the database-clock lease boundary fails closed and atomically records the claim as INDETERMINATE. A verifying provider's signed effect receipt (Verifying Provider Profile, VP-3) may accompany the finalization as `effect_receipt`. It is verified against the organisation's registered provider keys and recorded in the commit evidence as presented, verified or not; it is never a reason to refuse the finalization. When the grant named the effect it expected and the verified receipt carries an effect digest, the receipt is also read as `SIGNED_RECEIPT` effect evidence, and confirms the effect only when the digests agree and the outcome is COMMITTED. An explicit `effect_evidence` takes precedence.
Read one held allowance and what it holds GET
The allowance and its usage, as listed. Requires policy:read, policy:write or org:* scope.