Decionis API
Decionis for DevelopersGitHub
HomeAPI ReferenceSDKsContext Plugin
Assessments

Submit assessment findings for Core to validate and sign

POST
/v1/assessments/{assessmentId}/findings

Organization API key with decision:write (role MEMBER or higher); the organization comes from the key. Core checks record digests, as-of provenance, assessed and total counts, coverage and partial status, and transaction-time amounts in each record's own currency, recomputes the per-currency totals and signs the artifact (decionis.assessments.findings/1) with the dossier Ed25519 key, verifiable offline against /.well-known/decision-dossier-jwks.json. Without a signing key the artifact is stored and labelled unsigned. A partial assessment stays partial. An identical resubmission returns the artifact signed the first time (200).

Authorization

ApiKeyAuth
AuthorizationBearer <token>

An organization API key. Its scopes decide what it may call; decision:shadow is the narrowest: SHADOW evaluations through POST /v1/authority/grants or its alias POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying context.decionis_policy, evidence or escalation), with no integration dispatch. A key whose only scope is decision:shadow (an AgentSafe hosted gateway's) reaches exactly those two, POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm and POST /v1/hosted-gateway/keys/revoke-self; every other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED. decision:enforce is an enforced hosted gateway's key: evaluations in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying context.decionis_policy; it never holds policy:write), and the grants and managed escalations they bind. A key whose scopes are decision:enforce (with or without decision:shadow) reaches exactly POST /v1/authority/enforce-and-bind, POST /v1/authority/grants, GET /v1/authority/grants/{grant_id}, POST /v1/authority/grants/{grant_id}/claims, POST /v1/authority/grants/{grant_id}/receipts, POST /v1/authority/grants/{grant_id}/reconciliations, POST /v1/execution/verify-token, POST /v1/execution/claim-token, POST /v1/execution/consume-token, POST /v1/execution/finalize-token, GET /v1/authority/escalations/{escalation_id}, DELETE /v1/authority/escalations/{escalation_id}, POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.

In: header

Path Parameters

assessmentId*string
Formatuuid

Request Body

application/json

version*string
assessment_id*string
Formatuuid
platform*string
Match^[a-z0-9][a-z0-9-]{0,99}$
evaluator*
source*
status*string

Value in

  • "complete"
  • "partial"
coverage*
findings*array<>
Itemsitems <= 5000
records*array<>
Itemsitems <= 5000

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/assessments/497f6eca-6276-4993-bfeb-53cbbbba6f08/findings" \  -H "Content-Type: application/json" \  -d '{    "version": "decionis.assessments.submission/1",    "assessment_id": "9f60a03f-b3de-4b19-9361-0380d9aa1e9e",    "platform": "string",    "evaluator": {      "platform": "string",      "methodology": "string"    },    "source": {      "kind": "connected_history",      "connection_id": "d3547de1-d1f2-4344-b4c2-17169b7526f9",      "company_id": "string",      "revision": "string",      "as_of": "2019-08-24T14:15:22Z",      "window": {        "from": "2019-08-24T14:15:22Z",        "to": "2019-08-24T14:15:22Z"      }    },    "status": "complete",    "coverage": {      "assessed": 0,      "total": 0,      "limit": 0,      "truncated": true,      "complete": true,      "reasons": [        "string"      ],      "gaps": [        {          "code": "string",          "finding_types": [            "string"          ]        }      ]    },    "findings": [      {        "finding_id": "string",        "type": "string",        "check_id": "P01",        "record_digest": "string",        "occurred_at": "2019-08-24T14:15:22Z",        "amount": {          "currency": "string",          "scale": 0,          "amount_minor": 0        },        "measurements": {          "property1": 0,          "property2": 0        },        "basis": "source_record"      }    ],    "records": [      {        "record_digest": "string",        "occurred_at": "2019-08-24T14:15:22Z",        "amount": {          "currency": "string",          "scale": 0,          "amount_minor": 0        },        "replay": {          "action": {            "actor": {              "type": "HUMAN",              "id": "string"            },            "platform": "string",            "idempotency_key": "string",            "action_type": "PRICE_CHANGE",            "payload": {              "sku": "string",              "from_price": 0,              "to_price": 0            }          },          "facts": {}        }      }    ]  }'
{  "artifact": {    "assessment_id": "9f60a03f-b3de-4b19-9361-0380d9aa1e9e",    "platform": "string",    "evaluator": {      "platform": "string",      "methodology": "string"    },    "source": {      "kind": "connected_history",      "connection_id": "d3547de1-d1f2-4344-b4c2-17169b7526f9",      "company_id": "string",      "revision": "string",      "as_of": "2019-08-24T14:15:22Z",      "window": {        "from": "2019-08-24T14:15:22Z",        "to": "2019-08-24T14:15:22Z"      }    },    "status": "complete",    "coverage": {      "assessed": 0,      "total": 0,      "limit": 0,      "truncated": true,      "complete": true,      "reasons": [        "string"      ],      "gaps": [        {          "code": "string",          "finding_types": [            "string"          ]        }      ]    },    "findings": [      {        "finding_id": "string",        "type": "string",        "check_id": "P01",        "record_digest": "string",        "occurred_at": "2019-08-24T14:15:22Z",        "amount": {          "currency": "string",          "scale": 0,          "amount_minor": 0        },        "measurements": {          "property1": 0,          "property2": 0        },        "basis": "source_record"      }    ],    "records": [      {        "record_digest": "string",        "occurred_at": "2019-08-24T14:15:22Z",        "amount": {          "currency": "string",          "scale": 0,          "amount_minor": 0        },        "replay": {          "action": {            "actor": {              "type": "HUMAN",              "id": "string"            },            "platform": "string",            "idempotency_key": "string",            "action_type": "PRICE_CHANGE",            "payload": {              "sku": "string",              "from_price": 0,              "to_price": 0,              "estimated_cost": 0,              "currency": "string"            }          },          "facts": {            "observed_at": "2019-08-24T14:15:22Z",            "source": "string",            "currency": "string",            "pricing": {              "gross_amount": 0,              "discount_amount": 0,              "estimated_cost": 0            },            "cost_basis": {              "source_cost": 0,              "system_of_record_cost": 0            },            "inventory": {              "source_on_hand": 0,              "system_on_hand": 0,              "reserved_quantity": 0,              "requested_quantity": 0            },            "region": {              "country": "string"            },            "discounts": {              "count": 0,              "sources": [                "string"              ]            },            "contract": {              "account_type": "retail",              "offered_price": 0,              "contract_price": 0            },            "promotion": {              "discount_codes": [                "string"              ],              "prior_redemptions": 0,              "account_age_days": 0,              "identity_hash": "string"            },            "refund": {              "remaining_refundable": 0,              "prior_refund_count": 0            },            "lifecycle": {              "current_state": "created",              "delivered_at": "2019-08-24T14:15:22Z",              "return_eligible": true            },            "payment": {              "prior_payment_count": 0,              "approver_authority_limit": 0            },            "beneficiary": {              "changed_at": "2019-08-24T14:15:22Z",              "verification": "verified"            },            "treasury": {              "cash_position": 0,              "run_total": 0,              "cost_of_funds_percent": 0            }          }        }      }    ],    "version": "decionis.assessments.findings/1",    "findings_id": "49cc7d7a-341d-4557-bfde-ce7a8ead8d58",    "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b",    "submitted_at": "2019-08-24T14:15:22Z",    "submission_sha256": "string",    "totals": [      {        "type": "string",        "check_id": "P01",        "currency": "string",        "scale": 0,        "amount_minor": 0,        "count": 0      }    ]  },  "artifact_sha256": "string",  "canonicalization": "RFC8785/JCS",  "verification": "signed",  "signature": {    "algorithm": "Ed25519",    "keyId": "string",    "value": "string"  },  "public_jwks_path": "/.well-known/decision-dossier-jwks.json"}

Read the signed findings of an assessment GET

Organization API key with decision:read. Returns every findings artifact signed for the assessment in this organization, each verifiable offline.

Submit transaction, event or audit records for PolicyAgent to author a policy from POST

The central policy intake for producers holding an organization key (Commerce, the AgentSafe CLI), with decision:write and role MEMBER or higher; the organization comes from the key. Records arrive inline or as one JSON Lines file (decionis.assessments.records/1). Core's assessor for the domain finds the exposures with the production evaluator (commerce today; cards and agents are refused until their assessors exist), reports missing history as a coverage gap, and signs the findings (decionis.assessments.findings/1) like any submitted findings. New findings reach the managed desk, who propose the policy. Identical records return the findings signed the first time (200).