Define a held allowance, or change its limit or window
Defines the allowance under {allowanceKey}, or replaces its unit,
limit, window and description. Raising the limit is a top-up: the
next grant drawing on it sees the room at once. Lowering it below
what is reserved, held and consumed refuses every new draw until
enough settles or leaves the window; reservations already made stay
valid. A policy rule names the key in then.allowance, and a draw on
a key no allowance is defined under is refused as
ALLOWANCE_UNDEFINED. Requires policy:write or org:* scope, so an
agent's decision:write key can never raise the limit it draws on.
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Path Parameters
The name a policy rule's then.allowance.key draws on, unique within the organisation.
^[a-z0-9][a-z0-9._:-]{0,127}$Query Parameters
Optional when the authenticated API key is already bound to an organization.
uuidRequest Body
application/json
What one unit counts (replicas, deployments, USD_minor); a label only.
^[A-Za-z0-9][A-Za-z0-9._:/-]*$1 <= length <= 64The most the allowance admits across its window.
0 <= value <= 9007199254740991A rolling window over which committed draws count. Null means no window: a committed draw counts until the limit is raised past it.
60 <= value <= 31536000length <= 500Response Body
application/json
application/json
application/json
application/json
application/json
curl -X PUT "https://example.com/v1/authority/allowances/string" \ -H "Content-Type: application/json" \ -d '{ "unit": "string", "limit": 0, "window_seconds": 60 }'{ "service": "decionis", "allowance_key": "string", "unit": "string", "limit": 0, "window_seconds": 0, "description": "string", "usage": { "reserved": 0, "held": 0, "consumed": 0, "available": 0 }, "created_at": "2019-08-24T14:15:22Z", "updated_at": "2019-08-24T14:15:22Z"}Read one held allowance and what it holds GET
The allowance and its usage, as listed. Requires policy:read, policy:write or org:* scope.
Read Decionis-managed Presence authorization status GET
Returns tenant-scoped orchestration state without exposing Presence credentials, invitation locators, authentication assertions, or biometric material. A normal execution grant is present only at GRANT_READY, after Decionis has independently verified Presence evidence and re-evaluated current policy for the original exact intent.