Record the outcome of a claimed downstream commit attempt
The handler of the deprecated alias POST /v1/execution/finalize-token,
with the same body, rules and responses: COMMITTED, FAILED or
INDETERMINATE, effect confirmation only from accepted digest-bound
effect_evidence, a verifying provider's effect_receipt recorded as
presented, and lease-expiry recorded as INDETERMINATE. The verified
token's jti must be {grantId}; otherwise the answer is 409
GRANT_ID_MISMATCH and nothing is recorded.
A permit-style platform may add native_receipt, what the platform
itself recorded when it carried the action out. It is recorded as
downstream_evidence.native_receipt, so the claim and its commit
evidence carry it; it is the executor's report of the attempt and
never effect confirmation by itself.
A finalization that contradicts its binding opens an assumption
breach in the grant's action and target, reported as
assumption_breach: effect evidence naming an observed effect other
than the expected one (EFFECT_MISMATCH), or a verified receipt that
effected another effect, effected what the executor reports FAILED,
or refused what it reports COMMITTED (EFFECT_RECEIPT_CONTRADICTION).
An unverified receipt opens nothing. The breach never changes the
finalization's answer.
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Path Parameters
The execution grant's jti: the execution_token_jti returned when the grant was issued, the jti recorded for the grant, and the jti claim of the signed execution token. The token remains the bearer proof; a token whose jti is not this id is refused with GRANT_ID_MISMATCH.
uuidRequest Body
application/json
1 <= length <= 20000^[A-Za-z0-9_-]{43,128}$Value in
- "COMMITTED"
- "FAILED"
- "INDETERMINATE"
1 <= length <= 200Free-form legacy evidence; never interpreted as effect confirmation.
What a permit-style platform recorded when it carried the action out (a posted journal, an acknowledged order). Recorded as downstream_evidence.native_receipt, replacing any value the executor put there; the executor's report of the attempt, never effect confirmation by itself.
When effect evidence is present for a Protocol 1.1 grant it must use the Protocol 1.1 shape. Effect confirmation remains optional. The legacy shape remains accepted only for historical grants and keeps its original verification semantics.
A verifying provider's effect receipt, forwarded by the executor exactly as the provider returned it: a compact EdDSA JWS whose protected header typ is decionis-effect-receipt+jwt and whose payload is EffectReceiptClaims. Verified against the organisation's registered provider keys and recorded whatever the verdict; never a reason to refuse the finalization.
^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$1 <= length <= 20000Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/authority/grants/497f6eca-6276-4993-bfeb-53cbbbba6f08/receipts" \ -H "Content-Type: application/json" \ -d '{ "execution_token": "string", "claim_token": "string", "outcome": "COMMITTED", "commit_correlation_id": "string" }'{ "finalized": true, "outcome": "COMMITTED", "evidence_recorded": true, "evidence_durably_queued": true, "decision_chain_evidence_recorded": true, "effect_evidence_recorded": true, "effect_confirmation": "CONFIRMED", "effect_receipt": { "verified": true, "verification_code": "EFFECT_RECEIPT_VERIFIED", "provider_key_id": "string", "recorded": true }, "assumption_breach": { "breach_id": "3cccc133-0d3f-42f4-b900-730669a83e33", "trigger": "EFFECT_MISMATCH", "created": true }, "reason_codes": [ "string" ]}Revalidate and atomically claim a grant once, immediately before commit POST
The handler of the deprecated aliases `POST /v1/execution/claim-token` and `POST /v1/execution/consume-token`, with the same body and the same responses: execution is authorized only when `should_execute` is `true`, `claim_token` is non-null and `claim_lease_expires_at` is still live at the downstream boundary, and a live claim returns `claim_attestation`. The verified token's `jti` must be `{grantId}`; otherwise the answer is 409 `GRANT_ID_MISMATCH` and nothing is claimed. When the grant's binding draws on a held allowance (`allowance_draws`), the claim converts the grant's reservation in the same transaction that consumes the grant and inserts its concurrency scopes. A grant whose reservation is not live cannot be claimed: the answer is 409 `NONCE_REPLAY_DETECTED`, as for any grant that can no longer be consumed, and nothing is claimed. A live claim must be finalized at `/receipts` (alias `/v1/execution/finalize-token`) before `claim_lease_expires_at`, with COMMITTED, FAILED or INDETERMINATE; the 200 says so in `x-decionis-action-required: FINALIZE_BEFORE_LEASE_EXPIRY`. A claim left unfinalized past its lease is recorded INDETERMINATE and keeps its concurrency scopes (its execution target and bound material signals): every later claim on any of them answers 409 REVIEW `CURRENT_STATE_UNRESOLVED` with `evidence.nonce_claim_state` INDETERMINATE, and `x-decionis-blocking-grant` names the grant whose claim holds the scope, until that attempt is reconciled at `/v1/authority/grants/{grantId}/reconciliations`.
Report how an INDETERMINATE execution of this grant resolved POST
An executor holding the grant reports, from its own downstream reconciliation, whether an INDETERMINATE execution COMMITTED or FAILED. The nonce stays burned and the action is never retried: the resolution is an append-only record with digest-bound effect evidence, and its commit evidence goes to the Decision Chain. The same evidence rules as the platform operator's reconciliation apply. The execution token (accepted after its expiry, as at finalization) must verify, its `jti` must be `{grantId}` (otherwise 409 `GRANT_ID_MISMATCH`), its correlation must be `commit_correlation_id`, and `claim_token` must be the token of the grant's claim (otherwise 409 `CLAIM_TOKEN_MISMATCH`). The caller needs `decision:write`, `decision:*` or `org:*` in the grant's organisation. The authenticated principal is the reconciler and the only trusted observer of the effect evidence; it is never named in the body. An organisation API key reconciles only when it is on the trusted effect-observer allow-list; any other caller is answered 409 `EFFECT_OBSERVER_PROVENANCE_UNAVAILABLE`. A claim that is not INDETERMINATE answers 409 `CLAIM_NOT_INDETERMINATE`. Evidence bound to the grant that names an observed effect other than the expected one cannot resolve the claim (409 `EFFECT_EVIDENCE_INSUFFICIENT_FOR_RECONCILIATION`, the claim stays INDETERMINATE) and opens an assumption breach in the grant's action and target (`RECONCILIATION_CONTRADICTION`), reported as `assumption_breach`.