Report how an INDETERMINATE execution of this grant resolved
An executor holding the grant reports, from its own downstream reconciliation, whether an INDETERMINATE execution COMMITTED or FAILED. The nonce stays burned and the action is never retried: the resolution is an append-only record with digest-bound effect evidence, and its commit evidence goes to the Decision Chain. The same evidence rules as the platform operator's reconciliation apply.
The execution token (accepted after its expiry, as at finalization)
must verify, its jti must be {grantId} (otherwise 409
GRANT_ID_MISMATCH), its correlation must be commit_correlation_id,
and claim_token must be the token of the grant's claim (otherwise
409 CLAIM_TOKEN_MISMATCH). The caller needs decision:write,
decision:* or org:* in the grant's organisation. The authenticated
principal is the reconciler and the only trusted observer of the
effect evidence; it is never named in the body. An organisation API
key reconciles only when it is on the trusted effect-observer
allow-list; any other caller is answered 409
EFFECT_OBSERVER_PROVENANCE_UNAVAILABLE. A claim that is not
INDETERMINATE answers 409 CLAIM_NOT_INDETERMINATE.
Evidence bound to the grant that names an observed effect other than
the expected one cannot resolve the claim (409
EFFECT_EVIDENCE_INSUFFICIENT_FOR_RECONCILIATION, the claim stays
INDETERMINATE) and opens an assumption breach in the grant's action
and target (RECONCILIATION_CONTRADICTION), reported as
assumption_breach.
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Path Parameters
The execution grant's jti: the execution_token_jti returned when the grant was issued, the jti recorded for the grant, and the jti claim of the signed execution token. The token remains the bearer proof; a token whose jti is not this id is refused with GRANT_ID_MISMATCH.
uuidRequest Body
application/json
1 <= length <= 20000The claim token the grant's claim returned.
^[A-Za-z0-9_-]{43,128}$1 <= length <= 200Value in
- "COMMITTED"
- "FAILED"
Free-form context; never identity. A fixed note naming the grant is recorded when absent.
1 <= length <= 2000Protocol 1.1 evidence must be CONFIRMED to resolve COMMITTED, and cannot resolve FAILED; legacy evidence must name the reconciling principal as its observer.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/authority/grants/497f6eca-6276-4993-bfeb-53cbbbba6f08/reconciliations" \ -H "Content-Type: application/json" \ -d '{ "execution_token": "string", "claim_token": "string", "commit_correlation_id": "string", "outcome": "COMMITTED", "effect_evidence": { "version": "1.0", "status": "CONFIRMED", "observation_method": "DOWNSTREAM_ACK", "observer": { "id": "string", "version": "string" }, "expected_effect_digest": "string", "observed_effect_digest": "string", "observed_at": "2019-08-24T14:15:22Z", "evidence_reference": "string", "execution_correlation_id": "string", "evidence_digest": "string" } }'{ "reconciled": true, "resolution": "FINALIZED", "reconciliation_id": "6d473d86-0a5d-4edb-89d3-2c59d4094fbd", "evidence_hash": "string", "decision_chain_evidence_recorded": true, "assumption_breach": { "breach_id": "3cccc133-0d3f-42f4-b900-730669a83e33", "trigger": "EFFECT_MISMATCH", "created": true }, "reason_codes": [ "string" ]}Record the outcome of a claimed downstream commit attempt POST
The handler of the deprecated alias `POST /v1/execution/finalize-token`, with the same body, rules and responses: COMMITTED, FAILED or INDETERMINATE, effect confirmation only from accepted digest-bound `effect_evidence`, a verifying provider's `effect_receipt` recorded as presented, and lease-expiry recorded as INDETERMINATE. The verified token's `jti` must be `{grantId}`; otherwise the answer is 409 `GRANT_ID_MISMATCH` and nothing is recorded. A permit-style platform may add `native_receipt`, what the platform itself recorded when it carried the action out. It is recorded as `downstream_evidence.native_receipt`, so the claim and its commit evidence carry it; it is the executor's report of the attempt and never effect confirmation by itself. A finalization that contradicts its binding opens an assumption breach in the grant's action and target, reported as `assumption_breach`: effect evidence naming an observed effect other than the expected one (`EFFECT_MISMATCH`), or a verified receipt that effected another effect, effected what the executor reports FAILED, or refused what it reports COMMITTED (`EFFECT_RECEIPT_CONTRADICTION`). An unverified receipt opens nothing. The breach never changes the finalization's answer.
Verify an execution grant without consuming it POST
Deprecated alias of `GET /v1/authority/grants/{grantId}`: the same handler, fed the token and the full intent from a body. Verifies the Ed25519 signature, issuer, audience, lifetime, action, actor, tenant, and exact intent hash. This endpoint does not authorize execution by itself because it does not atomically consume the grant.