Create a Core protocol key for an Accounts-authorized workspace
Disabled until the dedicated Accounts service credential is configured. Accounts authorizes current owner/admin membership and Commerce access, then signs a command bound to its exact organization, workspace, user, environment and protocol purpose. Core requires a synchronized existing workspace projection, verifies the signature through the configured Accounts JWKS and checks authorization expiry after lock waits. Commands expire within 60 seconds; issued_at may be at most 5 seconds ahead. command_id is globally immutable across actors, workspaces and actions; only authorization timestamps may change on retry. JSON only, no query parameters, cookies or Origin header. This creates no native platform connection and grants no ERP execution authority. Core uses its existing key generator and hash storage with fixed MEMBER decision:read/decision:write scopes. Only the first successful response discloses raw_key. No recoverable response ciphertext is stored. An authorized retry returns already_issued metadata; a lost first response requires explicit revocation and a new command.
Authorization
AccountsWorkspaceCredentialService Private Accounts-to-Core service credential: ACCOUNTS_WORKSPACE_CREDENTIAL_SERVICE_TOKEN. Each request also requires fresh Accounts Ed25519 command evidence. Merchant keys, product sessions, native provider credentials and other service credentials do not authorize this endpoint.
In: header
Request Body
application/json
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/internal/workspace-credentials/issue" \ -H "Content-Type: application/json" \ -d '{ "payload": { "version": "accounts-workspace-credential-v1", "command_id": "7d510d78-7444-4252-aeac-9e473949661e", "purpose": "protocol", "account_org_id": "string", "account_workspace_id": "string", "account_user_id": "string", "product": "commerce", "environment": "sandbox", "role": "owner", "issued_at": "2019-08-24T14:15:22Z", "authorization_expires_at": "2019-08-24T14:15:22Z", "action": "issue", "label": "string" }, "evidence": { "algorithm": "Ed25519", "key_id": "string", "payload_sha256": "string", "signature": "string" } }'{ "version": "accounts-workspace-credential-v1", "command_id": "7d510d78-7444-4252-aeac-9e473949661e", "account_org_id": "string", "account_workspace_id": "string", "product": "commerce", "environment": "sandbox", "status": "already_issued", "credential": { "key_id": "1e779c8a-6786-4c89-b7c3-a6666f5fd6b5", "label": "string", "role": "MEMBER", "scopes": [ "decision:read", "decision:write" ], "created_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z", "revoked_at": "2019-08-24T14:15:22Z" }}Revalidate a named human review's current source and dossier POST
Default off; only a dedicated commerceConnectedTransport credential is admitted. Enabled automatic onboarding additionally requires accountSourceAuthority:true with orgIds omitted. This is not a generic wildcard org key. Each handler independently verifies fresh Accounts signed authority, exact resource/source/plan/tenant/revision and the synced projection before disclosing any result. Generic fixed-orgIds service keys keep their existing permissions. The body authority is mandatory fresh Accounts accounts-commerce-human-review-v1 evidence with purpose commerce_human_review, bound to the exact case revision/context/action/dossier and expected source/workspace. A live product-session token is sent only to Accounts by the trusted BFF; this consumer accepts signed evidence only. It checks current source/policy/dossier and native company permissions. Commerce separately enforces named assignment, requester separation and the atomic human decision. No execution or stale OAuth extension is available.
List Core key metadata for an Accounts-authorized workspace POST
Disabled until the dedicated Accounts service credential is configured. Accounts authorizes current owner/admin membership and Commerce access, then signs a command bound to its exact organization, workspace, user, environment and protocol purpose. Core requires a synchronized existing workspace projection, verifies the signature through the configured Accounts JWKS and checks authorization expiry after lock waits. Commands expire within 60 seconds; issued_at may be at most 5 seconds ahead. command_id is globally immutable across actors, workspaces and actions; only authorization timestamps may change on retry. JSON only, no query parameters, cookies or Origin header. This creates no native platform connection and grants no ERP execution authority. Returns at most 100 Accounts-provisioned credentials with a truncation indicator. Metadata contains no raw key or provider secret. Legacy connector credentials are outside this namespace.