Revalidate a named human review's current source and dossier
Default off; only a dedicated commerceConnectedTransport credential is admitted. Enabled automatic onboarding additionally requires accountSourceAuthority:true with orgIds omitted. This is not a generic wildcard org key. Each handler independently verifies fresh Accounts signed authority, exact resource/source/plan/tenant/revision and the synced projection before disclosing any result. Generic fixed-orgIds service keys keep their existing permissions. The body authority is mandatory fresh Accounts accounts-commerce-human-review-v1 evidence with purpose commerce_human_review, bound to the exact case revision/context/action/dossier and expected source/workspace. A live product-session token is sent only to Accounts by the trusted BFF; this consumer accepts signed evidence only. It checks current source/policy/dossier and native company permissions. Commerce separately enforces named assignment, requester separation and the atomic human decision. No execution or stale OAuth extension is available.
Authorization
CommerceConnectedTransport Dedicated service credential registered only for connected policy, comparison and human evidence transport. Requires a separate current signed source proof per call; never use a customer OAuth, refresh or product-session credential.
In: header
Header Parameters
Must equal the body/query organization and the independently verified Accounts source UUID.
uuidRequest Body
application/json
uuiduuid1 <= length <= 100Response Body
application/json
curl -X POST "https://example.com/v1/internal/commerce/connected/approvals/revalidate" \ -H "x-org-id: 497f6eca-6276-4993-bfeb-53cbbbba6f08" \ -H "Content-Type: application/json" \ -d '{ "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "dossier_id": "8a9bfc13-db6c-4e62-a117-1a4399450d29", "policy_version": "string", "case": { "case_id": "c74269e5-1f97-4e20-9164-ffbe3494d8d6", "revision": -9007199254740991, "context_sha256": "string", "action_sha256": "string", "dossier_sha256": "string" }, "expected": { "org_id": "string", "workspace_id": "string", "entitlement_id": "string", "source_org_id": "29615410-e5e8-4ed6-94d4-e2a8385cf2e0", "subscription_id": "aa11a4c2-a467-43db-b413-c4ab0f5cf627", "provider_tenant_id": "a7ea4f15-dd9f-4219-9a85-287854c52e61", "source_revision": -9007199254740991 }, "source": { "platform": "business-central", "connection_id": "d3547de1-d1f2-4344-b4c2-17169b7526f9", "revision": -9007199254740991 } }'{ "version": "commerce-human-review-evidence-v1", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "case": { "case_id": "c74269e5-1f97-4e20-9164-ffbe3494d8d6", "revision": -9007199254740991, "context_sha256": "string", "action_sha256": "string", "dossier_sha256": "string" }, "actor": { "user_id": "string", "org_id": "string", "workspace_id": "string", "membership_id": "string", "entitlement_id": "string", "role": "owner", "product": "commerce", "environment": "production" }, "supported_sources": [ "business-central" ], "expires_at": "2019-08-24T14:15:22Z", "source": { "platform": "business-central", "connection_id": "d3547de1-d1f2-4344-b4c2-17169b7526f9", "revision": -9007199254740991 }, "evidence": { "version": "commerce-approval-evidence-v1", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "dossier_id": "8a9bfc13-db6c-4e62-a117-1a4399450d29", "dossier_sha256": "string", "evaluation_id": "4108ec8e-6efd-4b9b-bace-0bb4c296c324", "action_type": "ORDER_ACCEPTANCE", "action_sha256": "string", "platform": "business-central", "order_id": "string", "amount": 0, "currency": "string", "policy": { "bundle_id": "fc6f5a67-caa1-4339-9c14-a67826143b60", "version": "string", "policy_digest": "string" }, "mode": "SHADOW", "outcome": "APPROVE", "preflight": { "version": "commerce-preflight-v2", "action_type": "PRICE_CHANGE", "action_digest": "string", "facts_digest": "string", "policy_version": "string", "idempotency_key": "string", "evaluated_at": "2019-08-24T14:15:22Z", "disposition": "PROCEED", "execution_available": false, "checks": [ { "id": "P01", "status": "evaluated", "verdict": "PROCEED", "reason_codes": [ "string" ], "missing_facts": [ "string" ], "measurements": { "property1": 0, "property2": 0 } }, { "id": "P01", "status": "evaluated", "verdict": "PROCEED", "reason_codes": [ "string" ], "missing_facts": [ "string" ], "measurements": { "property1": 0, "property2": 0 } }, { "id": "P01", "status": "evaluated", "verdict": "PROCEED", "reason_codes": [ "string" ], "missing_facts": [ "string" ], "measurements": { "property1": 0, "property2": 0 } }, { "id": "P01", "status": "evaluated", "verdict": "PROCEED", "reason_codes": [ "string" ], "missing_facts": [ "string" ], "measurements": { "property1": 0, "property2": 0 } }, { "id": "P01", "status": "evaluated", "verdict": "PROCEED", "reason_codes": [ "string" ], "missing_facts": [ "string" ], "measurements": { "property1": 0, "property2": 0 } }, { "id": "P01", "status": "evaluated", "verdict": "PROCEED", "reason_codes": [ "string" ], "missing_facts": [ "string" ], "measurements": { "property1": 0, "property2": 0 } }, { "id": "P01", "status": "evaluated", "verdict": "PROCEED", "reason_codes": [ "string" ], "missing_facts": [ "string" ], "measurements": { "property1": 0, "property2": 0 } }, { "id": "P01", "status": "evaluated", "verdict": "PROCEED", "reason_codes": [ "string" ], "missing_facts": [ "string" ], "measurements": { "property1": 0, "property2": 0 } }, { "id": "P01", "status": "evaluated", "verdict": "PROCEED", "reason_codes": [ "string" ], "missing_facts": [ "string" ], "measurements": { "property1": 0, "property2": 0 } }, { "id": "P01", "status": "evaluated", "verdict": "PROCEED", "reason_codes": [ "string" ], "missing_facts": [ "string" ], "measurements": { "property1": 0, "property2": 0 } }, { "id": "P01", "status": "evaluated", "verdict": "PROCEED", "reason_codes": [ "string" ], "missing_facts": [ "string" ], "measurements": { "property1": 0, "property2": 0 } }, { "id": "P01", "status": "evaluated", "verdict": "PROCEED", "reason_codes": [ "string" ], "missing_facts": [ "string" ], "measurements": { "property1": 0, "property2": 0 } }, { "id": "P01", "status": "evaluated", "verdict": "PROCEED", "reason_codes": [ "string" ], "missing_facts": [ "string" ], "measurements": { "property1": 0, "property2": 0 } }, { "id": "P01", "status": "evaluated", "verdict": "PROCEED", "reason_codes": [ "string" ], "missing_facts": [ "string" ], "measurements": { "property1": 0, "property2": 0 } }, { "id": "P01", "status": "evaluated", "verdict": "PROCEED", "reason_codes": [ "string" ], "missing_facts": [ "string" ], "measurements": { "property1": 0, "property2": 0 } }, { "id": "P01", "status": "evaluated", "verdict": "PROCEED", "reason_codes": [ "string" ], "missing_facts": [ "string" ], "measurements": { "property1": 0, "property2": 0 } } ] }, "source_evidence": { "provenance": "supplied_evidence", "connection_id": "d3547de1-d1f2-4344-b4c2-17169b7526f9", "revision": -9007199254740991, "snapshot_sha256": "string" }, "review": { "summary": "string", "facts": [ { "key": "resource_id", "value": "string" } ] }, "verification": { "signature_verified": true, "inputs_commitment_verified": true, "policy_current": true }, "execution_available": false }}Compare bounded observed Walmart or Adobe history POST
Default off; only a dedicated commerceConnectedTransport credential is admitted. Enabled automatic onboarding additionally requires accountSourceAuthority:true with orgIds omitted. This is not a generic wildcard org key. Each handler independently verifies fresh Accounts signed authority, exact resource/source/plan/tenant/revision and the synced projection before disclosing any result. Generic fixed-orgIds service keys keep their existing permissions. Requires the transient source proof header and its exact supported marketplace source. Pure comparison of at most 100 documents over the previous 90 complete UTC dates against the exact policy digest. Evaluates only supported historical undercost, margin, discount stacking and price discrepancy facts; missing evidence is not_assessed. The report is unsigned, performs no full policy replay or external action, and is not a 90-day trial. Commerce owns source reads, report reservations and immutable persistence.
Create a Core protocol key for an Accounts-authorized workspace POST
Disabled until the dedicated Accounts service credential is configured. Accounts authorizes current owner/admin membership and Commerce access, then signs a command bound to its exact organization, workspace, user, environment and protocol purpose. Core requires a synchronized existing workspace projection, verifies the signature through the configured Accounts JWKS and checks authorization expiry after lock waits. Commands expire within 60 seconds; issued_at may be at most 5 seconds ahead. command_id is globally immutable across actors, workspaces and actions; only authorization timestamps may change on retry. JSON only, no query parameters, cookies or Origin header. This creates no native platform connection and grants no ERP execution authority. Core uses its existing key generator and hash storage with fixed MEMBER decision:read/decision:write scopes. Only the first successful response discloses raw_key. No recoverable response ciphertext is stored. An authorized retry returns already_issued metadata; a lost first response requires explicit revocation and a new command.