Admit a presence provider for this organisation
From then on an attestation signed under a key the provider's JWKS publishes verifies for this organisation, when the attestation's iss is the provider's. The organisation's own registered keys (POST /v1/execution/provider-keys, purpose presence_attestation) are consulted first and remain the way to pin a key by hand. Admitting again clears a revocation. Requires policy:write or org:* scope.
Authorization
ApiKeyAuth An organization API key. Its scopes decide what it may call;
decision:shadow is the narrowest: SHADOW evaluations through
POST /v1/authority/grants or its alias
POST /v1/authority/enforce-and-bind only (DECISION_SHADOW_MODE_DENIED
in any other mode; DECISION_SHADOW_FIELD_DENIED for a body carrying
context.decionis_policy, evidence or escalation), with no
integration dispatch. A key whose only scope is decision:shadow
(an AgentSafe hosted gateway's) reaches exactly those two,
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self; every other route
answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
decision:enforce is an enforced hosted gateway's key: evaluations
in SHADOW or ENFORCEMENT through POST /v1/authority/grants or its
alias (400 DECISION_ENFORCE_FIELD_DENIED for a body carrying
context.decionis_policy; it never holds policy:write), and the
grants and managed escalations they bind. A key whose scopes are
decision:enforce (with or without decision:shadow) reaches exactly
POST /v1/authority/enforce-and-bind, POST /v1/authority/grants,
GET /v1/authority/grants/{grant_id},
POST /v1/authority/grants/{grant_id}/claims,
POST /v1/authority/grants/{grant_id}/receipts,
POST /v1/authority/grants/{grant_id}/reconciliations,
POST /v1/execution/verify-token, POST /v1/execution/claim-token,
POST /v1/execution/consume-token, POST /v1/execution/finalize-token,
GET /v1/authority/escalations/{escalation_id},
DELETE /v1/authority/escalations/{escalation_id},
POST /v1/auth/credential-context, POST /v1/hosted-gateway/keys/confirm
and POST /v1/hosted-gateway/keys/revoke-self, each id a UUID; every
other route answers 403 HOSTED_GATEWAY_KEY_PATH_DENIED.
In: header
Path Parameters
^[a-z][a-z0-9_.:-]{0,63}$Query Parameters
Optional when the authenticated API key is already bound to an organization.
uuidResponse Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X PUT "https://example.com/v1/execution/presence-providers/string/admission"{ "service": "decionis", "provider_id": "string", "display_name": "string", "issuer": "string", "methods": [ "CARD_TAP" ], "admitted_at": "2019-08-24T14:15:22Z", "revoked_at": "2019-08-24T14:15:22Z", "provider_revoked_at": "2019-08-24T14:15:22Z"}Revoke a presence provider's admission, keeping its record DELETE
A revoked admission verifies no further attestations from the provider, and a grant admitted by one of its attestations can no longer be claimed. Requires policy:write or org:* scope.
Evaluate and bind authority for one UCP checkout completion POST
Accepts a complete UCP checkout response envelope negotiated at either 2026-04-08 or 2026-08-25. The seven UCP top-level checkout fields are required and extension members remain open. August responses must also carry ucp.payment_handlers; line items retain their official required fields and quantity floor; checkout totals contain exactly one subtotal and one total. Historical April callers retain the original adapter's optional payment-handler compatibility. Missing, ambiguous, or unsupported material fails before policy evaluation. Decionis authorizes; the connected merchant system remains responsible for execution. An ALLOW decision is not itself an execution grant. An authoritative response may carry an exact-action grant that must be claimed immediately before the merchant commits the checkout, then finalized as COMMITTED, FAILED, or INDETERMINATE.