Evaluate a bound native payment (deprecated alias)
Deprecated
Default off. Current ordinary workspace API key with decision:read and decision:write; no runtime-key scope expansion. Deprecated alias of POST /v1/commerce/payments/authorizations: the same handler, kept for installed Commerce releases. Requires an immutable Commerce attempt, a fresh matching native snapshot, historical Accounts reviewer evidence plus fresh current authority, and the exact active approved policy pin. The whole Protocol policy and P12-P15 checks run. Transport retries retain the original input and expiry; no lease renewal. A policy result is not consent or an ERP write. Missing authority fails closed; HOLD and BLOCK remain stops. On a connection with the permit path on, a request may name the executor and the exact payment line's agent-safe.intent/1 intent; Core then binds one single-use grant to that intent and answers it under grant, with the permit fields a permit-style executor presents. Nothing executes until that permit is claimed, once.
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Request Body
application/json
^(?!00000000-0000-0000-0000-000000000000$)[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$uuidResponse Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/commerce/payments/authorize" \ -H "Content-Type: application/json" \ -d '{ "version": "commerce-payment-authorization-v1", "attempt_id": "7a838dca-3ea8-4a7c-8133-ba2c86aeb22d", "request": { "transaction_id": "string", "erp_type": "D365_BC", "tenant_id": "34f5c98e-f430-457b-a812-92637d0c6fd0", "native_context": { "version": "commerce-native-context-v1", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "workspace_environment": "sandbox", "connection_id": "d3547de1-d1f2-4344-b4c2-17169b7526f9", "expected_revision": 1, "environment_name": "string", "company_id": "b2e6a1c3-1a5e-44ae-a8fd-81f76fd715cf" }, "timestamp": "2019-08-24T14:15:22Z", "agent_id": "string", "mode": "ENFORCE", "payment": { "payment_id": "string", "vendor_id": "string", "amount": 0, "currency": "string" }, "facts": { "observed_at": "2019-08-24T14:15:22Z" }, "payment_evidence": { "version": "commerce-payment-evidence-v1", "method": "ledger_cash_same_currency_single_payment_v1", "journal_id": "1f63e2a2-c902-4838-a77c-cc16cfd719c2", "journal_revision": "string", "batch_id": "4da22c97-b7d5-4e31-8c3a-03870ebc7b20", "batch_revision": "string", "invoice_entry_id": "1a176ad1-dfc5-4367-81c5-19cf200ae937", "invoice_revision": "string", "invoice_remaining_amount": 1, "funding_bank_id": "7d4f0736-a26a-4205-a4df-a5342d36c59f", "funding_bank_revision": "string", "beneficiary_bank_id": "129bae77-1594-4083-a63c-c22ad1977256", "beneficiary_bank_revision": "string", "source_revisions": { "run": "string", "invoice": "string", "treasury": "string" }, "snapshot_sha256": "string" } } }'{ "authorization": { "attempt_id": "7a838dca-3ea8-4a7c-8133-ba2c86aeb22d", "expires_at": "2019-08-24T14:15:22Z", "source_snapshot_sha256": "string" }, "mode": "ENFORCE", "enforced": true, "transaction_id": "string", "disposition": "PROCEED", "reason_code": "string", "message": "string", "policy_version": "string", "dossier_id": "8a9bfc13-db6c-4e62-a117-1a4399450d29", "checks": [ { "id": "string", "status": "evaluated", "verdict": "PROCEED", "reason_codes": [ "string" ], "missing_facts": [ "string" ] } ], "execution_time_ms": 0, "native_context": { "version": "commerce-native-context-v1", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "workspace_environment": "sandbox", "connection_id": "d3547de1-d1f2-4344-b4c2-17169b7526f9", "expected_revision": 1, "environment_name": "string", "company_id": "b2e6a1c3-1a5e-44ae-a8fd-81f76fd715cf", "erp_type": "D365_BC", "tenant_id": "34f5c98e-f430-457b-a812-92637d0c6fd0", "basis": "persisted_connection_and_native_grant", "provider_read_authority": "not_checked", "execution_available": true }, "grant": { "decision_id": "string", "status": "ALLOW", "should_execute": true, "reason_codes": [ "string" ], "action_hash": "string", "execution_token": "string", "execution_token_jti": "42f58912-c28c-4787-88d3-a563d1bfa8f2", "execution_token_expires_at": "2019-08-24T14:15:22Z", "dossier_id": "string", "permit_id": "7af9675c-40fb-44dd-8fe4-46923dd592e6", "intent_sha256": "string", "expires_at": "2019-08-24T14:15:22Z" }}Read the current native payment source snapshot POST
Default off. Current ordinary workspace API key with decision:read and decision:write; no runtime-key scope expansion. Fixed managed Business Central reader checks current connection/grant/assignment and exact native context, preserving the native observation time. Beneficiary verification remains unverified. Unsupported, stale, changing or locked source fails closed. No payment execution.
Evaluate a bound native payment with managed case evidence POST
Default off. Current ordinary workspace API key with decision:read and decision:write; no runtime-key scope expansion. Requires an immutable Commerce attempt, a fresh matching native snapshot, historical Accounts reviewer evidence plus fresh current authority, and the exact active approved policy pin. The whole Protocol policy and P12-P15 checks run. Transport retries retain the original input and expiry; no lease renewal. A policy result is not consent or an ERP write. Missing authority fails closed; HOLD and BLOCK remain stops. On a connection with the permit path on, a request may name the executor and the exact payment line's agent-safe.intent/1 intent; Core then binds one single-use grant to that intent and answers it under grant, with the permit fields a permit-style executor presents. Nothing executes until that permit is claimed, once.