Notify Decionis that signed Presence proof may be ready
Service-to-service recovery hint. The body is never authorization. Decionis locates the tenant-bound escalation, fetches the signed Presence dossier, verifies it independently, and performs current-policy re-authorization before any grant can be issued. Duplicate notifications are idempotent.
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Request Body
application/json
uuid8 <= length <= 2001 <= length <= 200^[0-9a-f]{64}$^[0-9a-f]{64}$^[0-9a-f]{64}$1 <= length <= 200date-timedate-timeResponse Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/authority/presence-completions" \ -H "Content-Type: application/json" \ -d '{ "version": "presence.authority_completion/1", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "authority_request_id": "stringst", "source_decision_id": "string", "requirement_digest": "string", "action_digest": "string", "proof_digest": "string", "proof_dossier_id": "string", "verified_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z" }'Read the Presence authority request a managed escalation asks a person to prove GET
For the caller that opened the escalation, so that a decision case of its own can name the same Presence request as its step-up and one passkey ceremony answers both. `authority_request_id` is null until Presence has the request, and for an approval chain, where each tier member has a request of their own. It is never approval evidence and carries no invitation, assertion or grant.
Register a governed plan; it authorizes no step POST
Registers one change carried out as several governed operations (`agent-safe.plan/1`): its steps, a coupling per dependency edge, a partial-commit rule and the compensation steps a failure opens. The plan is a governance object, not an orchestrator: registering it authorizes nothing, and every step is still decided by enforce-and-bind and claimed before it commits, with a grant of its own. A step's intent names the plan it belongs to in its hashed context (`agent_safe.plan`: `plan_id`, `plan_digest`, `step_id`); Decionis derives the step's facts from the plan and its own claim records and writes them under `agent_safe.plan` for policy to read, and binds the step's view of the plan as a material signal the claim rechecks. Plans are immutable: the same `plan_id` with another digest is refused. One organisation in v1: `tenant_id` must be the caller's. Requires decision:write, decision:* or org:*.