The organization's signed edge-evaluator entitlement
A compact JWS stating what the authenticated organization is licensed
for: its plan, deployment tier (hosted | dedicated |
self_managed), included governed actions per month, volume band
(self-managed only), whether the edge evaluator is included (edge),
and how many days after a month ends its usage report is due. Valid
35 days. Issued to every organization, entitled or not: an edge
installation verifies it against the policy-bundle JWKS
(/.well-known/decionis-policy-bundle-jwks.json; same key, its own
typ) and uses it only to warn — a licence problem never stops or
degrades a decision. Requires an organization API key with
policy:read (or policy:* / org:*).
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Response Body
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/edge/entitlement"{ "entitlement": "string", "kid": "string", "edge": true, "issued_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z"}List the signed policy bundles issued to the organization GET
The record of every signed policy bundle issued to the authenticated organization, newest first: its `jti`, bundle, version, digest, signing key, validity window and the API key that requested it. Requires an organization API key with `policy:read` (or `policy:*` / `org:*`).
List the organization's edge usage reports GET
Every usage report recorded for the authenticated organization, newest first, superseded ones included (`superseded_by`), optionally for one month. The report JWS itself is kept as evidence and not returned. Requires an organization API key with `policy:read`, `policy:write`, `policy:*` or `org:*`.