Decionis API
Decionis for DevelopersGitHub
HomeAPI ReferenceSDKsContext Plugin
Assessments

Submit transaction, event or audit records for PolicyAgent to author a policy from

POST
/v1/assessments/{assessmentId}/records

The central policy intake for producers holding an organization key (Commerce, the AgentSafe CLI), with decision:write and role MEMBER or higher; the organization comes from the key. Records arrive inline or as one JSON Lines file (decionis.assessments.records/1). Core's assessor for the domain finds the exposures with the production evaluator (commerce today; cards and agents are refused until their assessors exist), reports missing history as a coverage gap, and signs the findings (decionis.assessments.findings/1) like any submitted findings. New findings reach the managed desk, who propose the policy. Identical records return the findings signed the first time (200).

Authorization

ApiKeyAuth
AuthorizationBearer <token>

An organization API key. Its scopes decide what it may call; decision:shadow is the narrowest: SHADOW evaluations through POST /v1/authority/grants or its alias POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying context.decionis_policy, evidence or escalation), with no integration dispatch. A key whose only scope is decision:shadow (an AgentSafe hosted gateway's) reaches exactly those two, POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm and POST /v1/hosted-gateway/keys/revoke-self; every other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED. decision:enforce is an enforced hosted gateway's key: evaluations in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying context.decionis_policy; it never holds policy:write), and the grants and managed escalations they bind. A key whose scopes are decision:enforce (with or without decision:shadow) reaches exactly POST /v1/authority/enforce-and-bind, POST /v1/authority/grants, GET /v1/authority/grants/{grant_id}, POST /v1/authority/grants/{grant_id}/claims, POST /v1/authority/grants/{grant_id}/receipts, POST /v1/authority/grants/{grant_id}/reconciliations, POST /v1/execution/verify-token, POST /v1/execution/claim-token, POST /v1/execution/consume-token, POST /v1/execution/finalize-token, GET /v1/authority/escalations/{escalation_id}, DELETE /v1/authority/escalations/{escalation_id}, POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.

In: header

Path Parameters

assessmentId*string
Formatuuid

Request Body

application/json

decionis.assessments.records/1. Records inline or one JSON Lines file, never both. A commerce record is a commerce-preflight-v2 action with its facts as they stood, its time and its transaction-time money; identifiers in the action should be opaque digests.

version*string
assessment_id*string
Formatuuid
domain*string

Value in

  • "commerce"
  • "cards"
  • "agents"
kind*string

Value in

  • "transaction"
  • "event"
  • "audit"
platform*string
Match^[a-z0-9][a-z0-9-]{0,99}$
producer*
as_of*string
Formatdate-time
window*
policy_id?string

The policy the findings are for; its desk receives them. Without it they go to the workspace's commerce draft (a policy created MANAGED first, then a MANAGED one). Must name a commerce policy in the organization.

Formatuuid
total*|
Range0 <= value
truncated*boolean
records?array<>
Items1 <= items <= 5000
file?

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/assessments/497f6eca-6276-4993-bfeb-53cbbbba6f08/records" \  -H "Content-Type: application/json" \  -d '{    "version": "decionis.assessments.records/1",    "assessment_id": "9f60a03f-b3de-4b19-9361-0380d9aa1e9e",    "domain": "commerce",    "kind": "transaction",    "platform": "string",    "producer": {      "product": "agentsafe",      "surface": "cli",      "version": "string"    },    "as_of": "2019-08-24T14:15:22Z",    "window": {      "from": "2019-08-24T14:15:22Z",      "to": "2019-08-24T14:15:22Z"    },    "total": 0,    "truncated": true  }'
{  "version": "decionis.assessments.records/1",  "assessment_id": "9f60a03f-b3de-4b19-9361-0380d9aa1e9e",  "domain": "commerce",  "policy_id": "ee9b03e0-6495-427a-85a5-34444d24ae04",  "received": 0,  "assessed": 0,  "findings": {    "artifact": {      "assessment_id": "9f60a03f-b3de-4b19-9361-0380d9aa1e9e",      "platform": "string",      "evaluator": {        "platform": "string",        "methodology": "string"      },      "source": {        "kind": "connected_history",        "connection_id": "d3547de1-d1f2-4344-b4c2-17169b7526f9",        "company_id": "string",        "revision": "string",        "as_of": "2019-08-24T14:15:22Z",        "window": {          "from": "2019-08-24T14:15:22Z",          "to": "2019-08-24T14:15:22Z"        }      },      "status": "complete",      "coverage": {        "assessed": 0,        "total": 0,        "limit": 0,        "truncated": true,        "complete": true,        "reasons": [          "string"        ],        "gaps": [          {            "code": "string",            "finding_types": [              "string"            ]          }        ]      },      "findings": [        {          "finding_id": "string",          "type": "string",          "check_id": "P01",          "record_digest": "string",          "occurred_at": "2019-08-24T14:15:22Z",          "amount": {            "currency": "string",            "scale": 0,            "amount_minor": 0          },          "measurements": {            "property1": 0,            "property2": 0          },          "basis": "source_record"        }      ],      "records": [        {          "record_digest": "string",          "occurred_at": "2019-08-24T14:15:22Z",          "amount": {            "currency": "string",            "scale": 0,            "amount_minor": 0          },          "replay": {            "action": {              "actor": {                "type": "HUMAN",                "id": "string"              },              "platform": "string",              "idempotency_key": "string",              "action_type": "PRICE_CHANGE",              "payload": {                "sku": "string",                "from_price": 0,                "to_price": 0,                "estimated_cost": 0,                "currency": "string"              }            },            "facts": {              "observed_at": "2019-08-24T14:15:22Z",              "source": "string",              "currency": "string",              "pricing": {                "gross_amount": 0,                "discount_amount": 0,                "estimated_cost": 0              },              "cost_basis": {                "source_cost": 0,                "system_of_record_cost": 0              },              "inventory": {                "source_on_hand": 0,                "system_on_hand": 0,                "reserved_quantity": 0,                "requested_quantity": 0              },              "region": {                "country": "string"              },              "discounts": {                "count": 0,                "sources": [                  "string"                ]              },              "contract": {                "account_type": "retail",                "offered_price": 0,                "contract_price": 0              },              "promotion": {                "discount_codes": [                  "string"                ],                "prior_redemptions": 0,                "account_age_days": 0,                "identity_hash": "string"              },              "refund": {                "remaining_refundable": 0,                "prior_refund_count": 0              },              "lifecycle": {                "current_state": "created",                "delivered_at": "2019-08-24T14:15:22Z",                "return_eligible": true              },              "payment": {                "prior_payment_count": 0,                "approver_authority_limit": 0              },              "beneficiary": {                "changed_at": "2019-08-24T14:15:22Z",                "verification": "verified"              },              "treasury": {                "cash_position": 0,                "run_total": 0,                "cost_of_funds_percent": 0              }            }          }        }      ],      "version": "decionis.assessments.findings/1",      "findings_id": "49cc7d7a-341d-4557-bfde-ce7a8ead8d58",      "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b",      "submitted_at": "2019-08-24T14:15:22Z",      "submission_sha256": "string",      "totals": [        {          "type": "string",          "check_id": "P01",          "currency": "string",          "scale": 0,          "amount_minor": 0,          "count": 0        }      ]    },    "artifact_sha256": "string",    "canonicalization": "RFC8785/JCS",    "verification": "signed",    "signature": {      "algorithm": "Ed25519",      "keyId": "string",      "value": "string"    },    "public_jwks_path": "/.well-known/decision-dossier-jwks.json"  }}

Submit assessment findings for Core to validate and sign POST

Organization API key with decision:write (role MEMBER or higher); the organization comes from the key. Core checks record digests, as-of provenance, assessed and total counts, coverage and partial status, and transaction-time amounts in each record's own currency, recomputes the per-currency totals and signs the artifact (decionis.assessments.findings/1) with the dossier Ed25519 key, verifiable offline against /.well-known/decision-dossier-jwks.json. Without a signing key the artifact is stored and labelled unsigned. A partial assessment stays partial. An identical resubmission returns the artifact signed the first time (200).

Draft an outcome agreement POST

Organization API key with decision:write and role ADMIN or higher; the organization comes from the key. Drafts the agreed outcome meter (decionis.outcomes.agreement/1): workflow, primary metric, scope, baseline, currency and conversion, deductions, who confirms a problem, exclusions, attribution window, monthly close and commercial basis. The agreement becomes ACTIVE only after Decionis signs it with the dossier key and a customer signatory co-signs with a passkey in the delivered case. 503 outcomes_disabled while `DECIONIS_OUTCOMES_ENABLED` is not 1.