Finalize a claimed downstream commit attempt
Deprecated
Deprecated alias of POST /v1/authority/grants/{grantId}/receipts:
the same handler.
Records COMMITTED, FAILED, or INDETERMINATE. INDETERMINATE effects must
be reconciled and are never safe for automatic retry. A COMMITTED claim
proves an attempt was finalized, but an effect is confirmed only when
digest-bound effect_evidence with status CONFIRMED is accepted. If the
signed grant expires after a successful claim, finalization may continue
only while the exact persisted claim token, nonce, correlation, and
database claim lease remain valid. An expired unclaimed grant is never
execution-eligible. A finalize request at or after the database-clock
lease boundary fails closed and atomically records the claim as
INDETERMINATE.
A verifying provider's signed effect receipt (Verifying Provider
Profile, VP-3) may accompany the finalization as effect_receipt. It
is verified against the organisation's registered provider keys and
recorded in the commit evidence as presented, verified or not; it is
never a reason to refuse the finalization. When the grant named the
effect it expected and the verified receipt carries an effect digest,
the receipt is also read as SIGNED_RECEIPT effect evidence, and
confirms the effect only when the digests agree and the outcome is
COMMITTED. An explicit effect_evidence takes precedence.
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Request Body
application/json
1 <= length <= 20000^[A-Za-z0-9_-]{43,128}$Value in
- "COMMITTED"
- "FAILED"
- "INDETERMINATE"
1 <= length <= 200Free-form legacy evidence; never interpreted as effect confirmation.
What a permit-style platform recorded when it carried the action out (a posted journal, an acknowledged order). Recorded as downstream_evidence.native_receipt, replacing any value the executor put there; the executor's report of the attempt, never effect confirmation by itself.
When effect evidence is present for a Protocol 1.1 grant it must use the Protocol 1.1 shape. Effect confirmation remains optional. The legacy shape remains accepted only for historical grants and keeps its original verification semantics.
A verifying provider's effect receipt, forwarded by the executor exactly as the provider returned it: a compact EdDSA JWS whose protected header typ is decionis-effect-receipt+jwt and whose payload is EffectReceiptClaims. Verified against the organisation's registered provider keys and recorded whatever the verdict; never a reason to refuse the finalization.
^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$1 <= length <= 20000Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/execution/finalize-token" \ -H "Content-Type: application/json" \ -d '{ "execution_token": "string", "claim_token": "string", "outcome": "COMMITTED", "commit_correlation_id": "string" }'{ "finalized": true, "outcome": "COMMITTED", "evidence_recorded": true, "evidence_durably_queued": true, "decision_chain_evidence_recorded": true, "effect_evidence_recorded": true, "effect_confirmation": "CONFIRMED", "effect_receipt": { "verified": true, "verification_code": "EFFECT_RECEIPT_VERIFIED", "provider_key_id": "string", "recorded": true }, "assumption_breach": { "breach_id": "3cccc133-0d3f-42f4-b900-730669a83e33", "trigger": "EFFECT_MISMATCH", "created": true }, "reason_codes": [ "string" ]}Public keys for execution grants and claim attestations GET
The Ed25519 public keys, as a JWKS, that sign execution grants and claim attestations. A deploy target or a downstream system of record verifies either offline against this set; during a signing-key rotation the previous key stays listed until the grants signed with it have drained. The `kid` in a token's protected header names the key to use.
List the organisation's held allowances, with what each one holds GET
Every allowance the organisation defines, with its usage now: `reserved` by grants not yet claimed and not expired, `held` by claims whose outcome is open or unknown (CLAIMED, INDETERMINATE), `consumed` by committed claims within the window (all of them when `window_seconds` is null), and what is `available` to the next grant. Requires policy:read, policy:write or org:* scope.