Revoke native company permission at the expected revision
Default off and outside the MCP OAuth profile. Requires an ordinary OWNER/ADMIN organization key with org:integrations:write, org:* or *; no protocol service or OAuth credential is admitted. Tenant comes only from fresh signed Accounts purchaser evidence. A current verified company connection, unchanged revision and read-only native status proof are required. A configure grant additionally requires provider-observed company write permission. No provider credential is returned or financial ERP action performed.
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Path Parameters
uuidRequest Body
application/json
uuid1 <= valueResponse Body
application/json
curl -X POST "https://example.com/v1/microsoft/business-central/connections/497f6eca-6276-4993-bfeb-53cbbbba6f08/native-grant/revoke" \ -H "Content-Type: application/json" \ -d '{ "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "expected_revision": 1 }'{ "revoked": true}Verify and record narrow native company permissions POST
Default off and outside the MCP OAuth profile. Requires an ordinary OWNER/ADMIN organization key with org:integrations:write, org:* or *; no protocol service or OAuth credential is admitted. Tenant comes only from fresh signed Accounts purchaser evidence. A current verified company connection, unchanged revision and read-only native status proof are required. A configure grant additionally requires provider-observed company write permission. No provider credential is returned or financial ERP action performed.
Resolve registered Business Central payment evidence context GET
A current ordinary organization key with decision:read and decision:write resolves only its synchronized Accounts workspace and exact active verified company connection with a current revision-bound native read grant. No query parameters or body are accepted. Missing configuration is unavailable; client-supplied organization or provider tenant claims grant no authority. The response contains non-secret registration metadata with basis=persisted_connection_and_native_grant, provider_read_authority=not_checked and execution_available=false, or true only for a connection whose payments Core decides with a single-use permit (the permit path); a permit claimed for one exact payment line, never this flag, lets a payment post. It does not read Microsoft payment facts, refresh Accounts provider authority, open provider credential custody or authorize posting. Existing native provider reads and configuration retain their separate fresh Accounts source and permission checks. Commerce binds subsequent queued assertions to all returned workspace/company/revision fields. Both scopes authorize payment evidence use, not a financial action.