Resolve the current credential's authoritative product context
Returns the authenticated credential class and exact organization, role and scopes. Accounts owns OAuth and workspace issuance; Core consumes its signed purchased-workspace projection and never turns this response into a new OAuth or organization key. V1 base3 stays unchanged. V2 adds only its recognized profile/consent metadata. V3 privately adds oauth_authority and the existing signed oauth_source_authority for request-scoped product transport. The private evidence is never returned in MCP tools or persisted in reports. Service credentials are refused. Data and connected extensions are default off and require their exact freshly consented profiles.
Opaque Accounts-issued Commerce OAuth access credential with resource-bound current purchase. Legacy base3, signed v2 ERP/history and fresh signed v3 nine-scope connected grants retain distinct route profiles. Refresh credentials never authenticate. Per-operation connection, current role, proof, quota and confirmation checks remain mandatory.
In: header
Request Body
application/json
Response Body
application/json
curl -X POST "https://example.com/v1/auth/credential-context" \ -H "Content-Type: application/json" \ -d '{}'{ "authority": "org_api_key", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "role": "OWNER", "scopes": [ "string" ], "api_key_id": "b0dd218e-3bcf-4bdb-a1e3-0689d60a8afd", "policy_id": "string", "onboarding_scope": "pilot_setup", "oauth_profile": "commerce", "oauth_resource": "http://example.com", "oauth_grant_id": "b142c270-10f0-4202-adea-b5c2cfd91bad", "oauth_profile_version": 2, "oauth_consent": { "consent_id": "b6c6f30d-b96b-4de6-8a03-238cde9dddba", "consent_text_version": "commerce-data-consent-v1", "consent_sha256": "string" }, "oauth_authority": { "version": "commerce-connected-authority-v1", "account_user_id": "string", "account_org_id": "string", "workspace_id": "string", "membership_id": "string", "entitlement_id": "string", "account_role": "owner", "provider_tenant_id": "a7ea4f15-dd9f-4219-9a85-287854c52e61", "subscription_id": "aa11a4c2-a467-43db-b413-c4ab0f5cf627", "source_revision": -9007199254740991, "source_plan": { "publisher_id": "string", "offer_id": "string", "plan_id": "string" }, "supported_sources": [ "business-central" ], "expires_at": "2019-08-24T14:15:22Z", "history_assessment_limit_monthly": 0 }, "oauth_source_authority": { "payload": { "version": "accounts-commerce-source-v3", "purpose": "commerce_oauth_projection", "resource": "http://example.com", "oauth_grant_id": "b142c270-10f0-4202-adea-b5c2cfd91bad", "account_sha256": "string", "source_org_id": "29615410-e5e8-4ed6-94d4-e2a8385cf2e0", "provider": "microsoft", "subscription_id": "aa11a4c2-a467-43db-b413-c4ab0f5cf627", "publisher_id": "string", "offer_id": "string", "plan_id": "string", "source_entitlement": { "entitlement_id": "string", "product": "string", "product_plan": "string", "revision": -9007199254740991, "environment": "production", "status": "active" }, "issued_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z", "provider_tenant_id": "a7ea4f15-dd9f-4219-9a85-287854c52e61", "authorization": { "profile_version": 3, "client_id": "string", "scopes": [ "decision:read", "decision:run", "policy:read", "erp:read", "history:assess", "marketplace:read", "erp:validate", "approval:request", "erp:configure" ], "consent_id": "b6c6f30d-b96b-4de6-8a03-238cde9dddba", "consent_text_version": "commerce-connected-consent-v1", "consent_sha256": "string", "consented_at": "2019-08-24T14:15:22Z", "account_role": "owner", "supported_sources": [ "business-central" ] } }, "evidence": { "algorithm": "Ed25519", "key_id": "string", "payload_sha256": "string", "signature": "string" } }, "initial_policy": { "version": "commerce-onboarding-shadow-v1", "bundle_id": "fc6f5a67-caa1-4339-9c14-a67826143b60", "mode": "SHADOW", "source": "accounts_commerce_onboarding", "policy_digest": "string" }}Revoke the calling organization key (offboarding, rotation, failed onboarding) POST
Any database-backed organization key may revoke itself; a hosted gateway key also stops being its tenant's current key. Protocol and AWS service credentials and platform keys are refused (403). A key already revoked or expired gets 401 UNAUTHORIZED from the org-key authentication.
Read one of the workspace's hosted gateways and the list of all of them GET
Account session scoped to the current workspace; reads require membership. The organization comes only from the session. Without deployment_id the answer is the workspace's primary gateway; with it, that gateway, or 404 GATEWAY_NOT_FOUND when the workspace holds no gateway with that id (never the primary). `deployments` lists every gateway the workspace holds and `deployment_limit` the capacity an operator granted it (default 1). Reservation is a name allocation, never evidence of DNS, TLS or runtime readiness.