Evaluate a bound native payment with managed case evidence
Default off. Current ordinary workspace API key with decision:read and decision:write; no runtime-key scope expansion. Requires an immutable Commerce attempt, a fresh matching native snapshot, historical Accounts reviewer evidence plus fresh current authority, and the exact active approved policy pin. The whole Protocol policy and P12-P15 checks run. Transport retries retain the original input and expiry; no lease renewal. A policy result is not consent or an ERP write. Missing authority fails closed; HOLD and BLOCK remain stops. On a connection with the permit path on, a request may name the executor and the exact payment line's agent-safe.intent/1 intent; Core then binds one single-use grant to that intent and answers it under grant, with the permit fields a permit-style executor presents. Nothing executes until that permit is claimed, once.
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Request Body
application/json
^(?!00000000-0000-0000-0000-000000000000$)[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$uuidResponse Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/commerce/payments/authorizations" \ -H "Content-Type: application/json" \ -d '{ "version": "commerce-payment-authorization-v1", "attempt_id": "7a838dca-3ea8-4a7c-8133-ba2c86aeb22d", "request": { "transaction_id": "string", "erp_type": "D365_BC", "tenant_id": "34f5c98e-f430-457b-a812-92637d0c6fd0", "native_context": { "version": "commerce-native-context-v1", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "workspace_environment": "sandbox", "connection_id": "d3547de1-d1f2-4344-b4c2-17169b7526f9", "expected_revision": 1, "environment_name": "string", "company_id": "b2e6a1c3-1a5e-44ae-a8fd-81f76fd715cf" }, "timestamp": "2019-08-24T14:15:22Z", "agent_id": "string", "mode": "ENFORCE", "payment": { "payment_id": "string", "vendor_id": "string", "amount": 0, "currency": "string" }, "facts": { "observed_at": "2019-08-24T14:15:22Z" }, "payment_evidence": { "version": "commerce-payment-evidence-v1", "method": "ledger_cash_same_currency_single_payment_v1", "journal_id": "1f63e2a2-c902-4838-a77c-cc16cfd719c2", "journal_revision": "string", "batch_id": "4da22c97-b7d5-4e31-8c3a-03870ebc7b20", "batch_revision": "string", "invoice_entry_id": "1a176ad1-dfc5-4367-81c5-19cf200ae937", "invoice_revision": "string", "invoice_remaining_amount": 1, "funding_bank_id": "7d4f0736-a26a-4205-a4df-a5342d36c59f", "funding_bank_revision": "string", "beneficiary_bank_id": "129bae77-1594-4083-a63c-c22ad1977256", "beneficiary_bank_revision": "string", "source_revisions": { "run": "string", "invoice": "string", "treasury": "string" }, "snapshot_sha256": "string" } } }'{ "authorization": { "attempt_id": "7a838dca-3ea8-4a7c-8133-ba2c86aeb22d", "expires_at": "2019-08-24T14:15:22Z", "source_snapshot_sha256": "string" }, "mode": "ENFORCE", "enforced": true, "transaction_id": "string", "disposition": "PROCEED", "reason_code": "string", "message": "string", "policy_version": "string", "dossier_id": "8a9bfc13-db6c-4e62-a117-1a4399450d29", "checks": [ { "id": "string", "status": "evaluated", "verdict": "PROCEED", "reason_codes": [ "string" ], "missing_facts": [ "string" ] } ], "execution_time_ms": 0, "native_context": { "version": "commerce-native-context-v1", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "workspace_environment": "sandbox", "connection_id": "d3547de1-d1f2-4344-b4c2-17169b7526f9", "expected_revision": 1, "environment_name": "string", "company_id": "b2e6a1c3-1a5e-44ae-a8fd-81f76fd715cf", "erp_type": "D365_BC", "tenant_id": "34f5c98e-f430-457b-a812-92637d0c6fd0", "basis": "persisted_connection_and_native_grant", "provider_read_authority": "not_checked", "execution_available": true }, "grant": { "decision_id": "string", "status": "ALLOW", "should_execute": true, "reason_codes": [ "string" ], "action_hash": "string", "execution_token": "string", "execution_token_jti": "42f58912-c28c-4787-88d3-a563d1bfa8f2", "execution_token_expires_at": "2019-08-24T14:15:22Z", "dossier_id": "string", "permit_id": "7af9675c-40fb-44dd-8fe4-46923dd592e6", "intent_sha256": "string", "expires_at": "2019-08-24T14:15:22Z" }}Evaluate a bound native payment (deprecated alias) POST
Default off. Current ordinary workspace API key with decision:read and decision:write; no runtime-key scope expansion. Deprecated alias of `POST /v1/commerce/payments/authorizations`: the same handler, kept for installed Commerce releases. Requires an immutable Commerce attempt, a fresh matching native snapshot, historical Accounts reviewer evidence plus fresh current authority, and the exact active approved policy pin. The whole Protocol policy and P12-P15 checks run. Transport retries retain the original input and expiry; no lease renewal. A policy result is not consent or an ERP write. Missing authority fails closed; HOLD and BLOCK remain stops. On a connection with the permit path on, a request may name the executor and the exact payment line's agent-safe.intent/1 intent; Core then binds one single-use grant to that intent and answers it under grant, with the permit fields a permit-style executor presents. Nothing executes until that permit is claimed, once.
Create a policy, or create it MANAGED from a system scaffold POST
Account session of a writing workspace member; same-site JSON and an Idempotency-Key are required. With content, the caller authors revision 1 and holds POLICY_OWNER and AUTHOR. With governance MANAGED and no content, the system writes revision 1 as a scaffold with no author, the caller holds POLICY_OWNER and RELEASE_APPROVER (never AUTHOR), the named desk analysts receive their bounded roles, and MANAGED governance takes the scaffold as its baseline, all in one journaled command. Alias kept on the same handler /v1/public/account/workspace/policy-platform.