Recover the current identity of an Accounts-owned enrollment
Default off. Accounts authorizes the current owner/admin of the exact existing Commerce workspace and signs a command. Core checks current Accounts JWKS and the SYNCED human workspace projection; no org, membership, merchant ADMIN key or Marketplace purchase is created. A command lease lasts at most 30 seconds, with at most 5 seconds future clock skew. JSON only; no query, Origin or Cookie. command_id has immutable semantic content; retries may refresh only issued_at and authorization_expires_at. No route executes a commerce or payment transaction. Requires current workspace owner/admin and exact retained enrollment_id, without an old Microsoft proof or known connection ID. Recovers pending, active or revoked records. Historical provider observation time/guard flags never become fresh evidence. read_granted is computed from current persisted enrollment/grant and managed assignment eligibility; unavailable assignment authority reports false. No permission is created or renewed.
Authorization
AccountsNativeEnrollmentService Dedicated ACCOUNTS_NATIVE_ENROLLMENT_SERVICE_TOKEN plus a fresh Accounts Ed25519 command. Merchant runtime keys, product sessions and other service credentials do not authorize this route.
In: header
Request Body
application/json
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/internal/native-enrollments/status" \ -H "Content-Type: application/json" \ -d '{ "payload": { "version": "accounts-native-enrollment-v1", "account_org_id": "string", "account_workspace_id": "string", "product": "commerce", "workspace_environment": "sandbox", "command_id": "7d510d78-7444-4252-aeac-9e473949661e", "enrollment_id": "cd8e6b59-f5cf-4894-8850-4dc2dc1aaf8e", "purpose": "native_connection_enrollment", "account_user_id": "string", "role": "owner", "issued_at": "2019-08-24T14:15:22Z", "authorization_expires_at": "2019-08-24T14:15:22Z", "action": "status" }, "evidence": { "algorithm": "Ed25519", "key_id": "string", "payload_sha256": "string", "signature": "string" } }'{ "version": "accounts-native-enrollment-v1", "account_org_id": "string", "account_workspace_id": "string", "product": "commerce", "workspace_environment": "sandbox", "command_id": "7d510d78-7444-4252-aeac-9e473949661e", "enrollment_id": "cd8e6b59-f5cf-4894-8850-4dc2dc1aaf8e", "connection_id": "d3547de1-d1f2-4344-b4c2-17169b7526f9", "connection_revision": 1, "platform": "D365_BC", "tenant_id": "34f5c98e-f430-457b-a812-92637d0c6fd0", "environment_name": "string", "company_id": "b2e6a1c3-1a5e-44ae-a8fd-81f76fd715cf", "execution_available": false, "status": "recorded", "read_granted": true, "provider_read_observed_at": "2019-08-24T14:15:22Z", "guard_enabled": true, "guard_configured": true, "enrollment_status": "pending"}Revoke an Accounts-owned native registration POST
Default off. Accounts authorizes the current owner/admin of the exact existing Commerce workspace and signs a command. Core checks current Accounts JWKS and the SYNCED human workspace projection; no org, membership, merchant ADMIN key or Marketplace purchase is created. A command lease lasts at most 30 seconds, with at most 5 seconds future clock skew. JSON only; no query, Origin or Cookie. command_id has immutable semantic content; retries may refresh only issued_at and authorization_expires_at. No route executes a commerce or payment transaction. Requires current workspace owner/admin and the exact existing enrollment, connection and revision. No Microsoft login or provider access is needed. Removes READ permission, disconnects the sealed connection and advances revision. Exact retries do not increment again.
Mint a provisional anonymous workspace and API key POST
Zero-human onboarding entry point. Mints a provisional workspace, its org API key, and a seeded shadow-mode default policy — no account, no email. Hard caps: 10 requests per minute, 5 provisional workspaces per network per 24 hours, and an exploration allowance of 50 governed decisions per month. The raw key is returned exactly once. Every dossier a provisional workspace mints carries a SIGNED issuer_context tier of "provisional_anonymous" inside the dossier claims, so a verifier can always distinguish it from an owned org's dossier. Claiming (POST /v1/orgs/{org_id}/claim/start then /claim/verify) attaches a human owner; the key and the dossier ledger survive the claim. The workspace is stamped with what the caller's User-Agent says about where it came from and nothing else: the product and version, and for the open-source runtime's `agent-safe-pipeline/<version> (repo=<owner/name>; example=<name>; surface=github)` form and Govern's `govern/<version> (example=govern@<version>; surface=<runner>; repo=<owner/name>)` form, the repository, example and surface. The stamp is accounting for the acquisition funnel; it is never decision input and never verified.