Finish claiming a provisional workspace
Second half of the claim: org-key authed, with a timing-safe check of the emailed OTP (3 attempts per challenge). Attaches an existing account by email or creates one — a new account requires a password so the claimed identity can sign back in. The claim is atomic; the API key and every dossier minted before the claim survive. 10 requests per minute.
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Path Parameters
uuidRequest Body
application/json
emaillength <= 200^\d{6}$Required only when the email has no existing account — it becomes sign-in.
8 <= length <= 256length <= 200Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/orgs/497f6eca-6276-4993-bfeb-53cbbbba6f08/claim/verify" \ -H "Content-Type: application/json" \ -d '{ "owner_email": "user@example.com", "otp_code": "string" }'{ "claimed": true, "org": { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string" }, "user": { "id": "string", "email": "user@example.com", "name": "string" }, "existing_user": true, "next": {}}Start claiming a provisional workspace (email OTP) POST
First half of attaching a human owner to an anonymously minted workspace. Org-key authed — holding the workspace's key is the possession proof that decides who may attach an owner. The org must be provisional and unclaimed. Emails a six-digit OTP with a 5-minute expiry to owner_email; 10 requests per minute.
Revoke the calling organization key (offboarding, rotation, failed onboarding) POST
Any database-backed organization key may revoke itself; a hosted gateway key also stops being its tenant's current key. Protocol and AWS service credentials and platform keys are refused (403). A key already revoked or expired gets 401 UNAUTHORIZED from the org-key authentication.