Confirm a just-issued hosted gateway key was received (the key itself)
Called with the key the token endpoint returned, as Bearer, before confirm_by. The key then no longer expires, and in the same transaction the tenant's earlier keys it replaces are revoked (revoked_key_ids). Idempotent: a second call revokes nothing more. A key no sign-on issued answers 404 HOSTED_GATEWAY_KEY_NOT_FOUND. A key that is revoked (superseded, disconnected, revoked by itself) or past confirm_by is refused by the org-key authentication before this route runs: 401 UNAUTHORIZED ("Invalid API key"). The 409s HOSTED_GATEWAY_KEY_RETIRED and HOSTED_GATEWAY_KEY_INACTIVE answer only a race with a concurrent retirement.
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Request Body
application/json
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/hosted-gateway/keys/confirm" \ -H "Content-Type: application/json" \ -d '{}'{ "key_id": "1e779c8a-6786-4c89-b7c3-a6666f5fd6b5", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "tenant_label": "string", "delivered_at": "2019-08-24T14:15:22Z", "expires_at": null, "already_confirmed": true, "revoked_key_ids": [ "e0280a5d-997c-493b-901d-a4080a8b2036" ]}Disconnect a hosted gateway by revoking its key (workspace admin) POST
From the page itself (same-origin, a JSON body such as `{}`, as approve). An ADMIN or above of the session's workspace revokes a key that a hosted gateway sign-on issued there (it appears in the workspace key list as `agentsafe-hosted-<tenant_label>` with scopes `["decision:shadow"]`), including one that lapsed undelivered; the gateway records nothing more. Any other key answers 404.
List administrable Business Central connections GET
Default off and outside the MCP OAuth profile. Requires a separate OWNER or ADMIN organization API key with org:integrations:write, org:* or * scope. Accounts must have supplied a fresh signed v2 or v3 purchaser tenant; the customer cannot enter or rebind tenant authority. Administrators authorize an environment/company and dedicated read-only BC application separately. Credentials are encrypted with an explicitly configured integration custody key and never returned. Verification performs bounded reads only; no ERP write is available.