Decionis Policy Evaluation API .well-known API

{
  "openapi": "3.1.0",
  "info": {
    "title": "Decionis Policy Evaluation API",
    "version": "0.6.0",
    "description": "Decionis evaluates captured execution intent against versioned policies\nbefore the caller performs the action. SDKs delegate policy judgment to this\nservice and locally enforce the signed decision. New SDK API keys can be\nassociated with an industry so Decionis provisions a starter encoded policy\nbinding server-side; applications do not receive or implement policy logic.\n\nv0.2 adds: escalation-ready proof-packet export for dossiers and decision\nchains; the ops spend-control gates (spend admission + disbursement authority\nwith duplicate-payment detection); native-surface decision federation; and the\nanonymous eBay Marketplace Account Deletion compliance endpoint required for an\neBay production keyset.\n\nv0.3 adds the policy-as-code draft endpoints: turn unstructured policy\nsources (PDF, JSON, XML, transaction and audit logs, uploads) and live\npolicy-source connectors (Jira, Confluence, Notion, Google Drive, Git\nrepositories, SAP) into a reviewable strategy draft or an executable,\ncompiler-validated policy pack.\n\nv0.4 adds the zero-human agent lane: anonymous provisional workspace\nminting with a signed issuer watermark, the public dossier verification\ntrio (verify, proof-bundle, reproduce) behind expiring share-link\ncapabilities, workspace claiming by email OTP, and org-wide share-link\nrevocation.\n\nv0.5 documents the UCP checkout authority and merchant verification-key\nsurfaces, exact UCP release negotiation, and additive Protocol 1.1 effect\nevidence without changing legacy finalization records.\n\nv0.6 makes the execution grant a REST resource: `/v1/authority/grants`\nissues it, and its `claims`, `receipts` and `reconciliations` claim it,\nfinalize it and resolve an INDETERMINATE attempt. `enforce-and-bind`,\n`verify-token`, `claim-token`, `consume-token` and `finalize-token` stay\nas deprecated aliases of the same handlers. It adds managed escalations,\npresence providers and provider keys, held allowances, governed plans,\npolicy records and proposals with workspace invariants, edge policy\nbundles, the execution-grant and policy-bundle key sets, outcome\nagreements, statements, charges and disputes, hosted-gateway\nauthorizations, keys and TCP resources, and the commerce payment and\nBusiness Central surfaces.\n"
  },
  "servers": [
    {
      "url": "https://api.decionis.com"
    }
  ],
  "security": [
    {
      "ApiKeyAuth": []
    }
  ],
  "paths": {
    "/v1/analytics/growth-reports/consent/{orgId}": {
      "put": {
        "operationId": "recordGrowthReportConsent",
        "summary": "Record or revoke aggregate-publication consent (platform operator only)",
        "description": "Record actual customer permission and an internal evidence reference. Consent is separate from analytics classification and is never inferred from product usage. Revocation affects future reports; previously frozen artifacts require editorial review.",
        "parameters": [
          {
            "name": "orgId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string",
              "format": "uuid"
            }
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "additionalProperties": false,
                "required": [
                  "opted_in",
                  "consent_reference"
                ],
                "properties": {
                  "opted_in": {
                    "type": "boolean"
                  },
                  "consent_reference": {
                    "type": "string",
                    "minLength": 1,
                    "maxLength": 500
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Consent recorded"
          },
          "403": {
            "description": "Platform operator authentication required"
          },
          "404": {
            "description": "Organization not found"
          }
        }
      }
    },
    "/v1/analytics/growth-reports/blast-radius/{month}": {
      "post": {
        "operationId": "prepareBlastRadiusReport",
        "summary": "Prepare or retrieve an immutable signed monthly aggregate (platform operator only)",
        "description": "Completed UTC calendar month only. Includes consented external production organizations, with at least five distinct organizations per published mode/outcome cell. Smaller cells and all cross-cell totals are suppressed. Empty eligible cohorts are not published. Existing months return the original artifact. This prepares evidence and does not publish or email it.",
        "parameters": [
          {
            "name": "month",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string",
              "pattern": "^20[0-9]{2}-(0[1-9]|1[0-2])$"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Previously frozen signed artifact"
          },
          "201": {
            "description": "Signed artifact prepared for editorial review"
          },
          "400": {
            "description": "Month has not completed"
          },
          "403": {
            "description": "Platform operator authentication required"
          },
          "409": {
            "description": "Insufficient consented cohort or concurrent freeze; no replacement"
          },
          "503": {
            "description": "Dedicated reporting key not configured"
          }
        }
      }
    },
    "/v1/analytics/growth-scorecard": {
      "get": {
        "operationId": "getGrowthScorecard",
        "summary": "Read the external production growth scorecard (platform operator only)",
        "description": "Counts durable decisions for reviewed external production organizations. Unclassified organizations are excluded and reported separately; empty cohorts have null rates. Requires the platform API key, not an organization key.",
        "responses": {
          "200": {
            "description": "UTC cohort counts, measured durations, and nullable rates"
          },
          "403": {
            "description": "Platform operator authentication required"
          }
        }
      }
    },
    "/v1/analytics/growth-scorecard/orgs/{orgId}": {
      "put": {
        "operationId": "classifyGrowthOrganization",
        "summary": "Classify organization traffic for growth measurement (platform operator only)",
        "description": "First classification freezes surface and source_utm. Subsequent calls update environment and audience only. This is an analytics classification, not execution policy.",
        "parameters": [
          {
            "name": "orgId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string",
              "format": "uuid"
            }
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "additionalProperties": false,
                "required": [
                  "environment",
                  "audience",
                  "surface"
                ],
                "properties": {
                  "environment": {
                    "type": "string",
                    "enum": [
                      "prod",
                      "staging",
                      "dev"
                    ]
                  },
                  "audience": {
                    "type": "string",
                    "enum": [
                      "external",
                      "internal",
                      "sandbox",
                      "demo"
                    ]
                  },
                  "surface": {
                    "type": "string",
                    "pattern": "^[a-z][a-z0-9_]{0,79}$"
                  },
                  "source_utm": {
                    "type": "object",
                    "properties": {
                      "source": {
                        "type": "string",
                        "maxLength": 120
                      },
                      "medium": {
                        "type": "string",
                        "maxLength": 120
                      },
                      "campaign": {
                        "type": "string",
                        "maxLength": 120
                      }
                    }
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Current classification and immutable first-touch attribution"
          },
          "403": {
            "description": "Platform operator authentication required"
          },
          "404": {
            "description": "Organization not found"
          }
        }
      }
    },
    "/v1/analytics/growth-scorecard/baselines/{name}": {
      "post": {
        "operationId": "freezeGrowthBaseline",
        "summary": "Freeze a growth scorecard snapshot once (platform operator only)",
        "parameters": [
          {
            "name": "name",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string",
              "pattern": "^[a-zA-Z0-9_-]{1,80}$"
            }
          }
        ],
        "responses": {
          "201": {
            "description": "Immutable measured baseline captured"
          },
          "403": {
            "description": "Platform operator authentication required"
          },
          "409": {
            "description": "Baseline name already frozen; no replacement performed"
          }
        }
      }
    },
    "/v1/health": {
      "get": {
        "operationId": "getHealth",
        "summary": "Validate API connectivity",
        "responses": {
          "200": {
            "description": "API is reachable",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HealthResponse"
                }
              }
            }
          }
        }
      }
    },
    "/v1/protocol/evaluate-decision": {
      "post": {
        "operationId": "evaluateDecision",
        "summary": "Evaluate captured execution intent without executing it",
        "description": "Canonical SDK/API route for Decionis execution-gate decisions.",
        "parameters": [
          {
            "$ref": "#/components/parameters/CorrelationId"
          },
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ProtocolEvaluateDecisionRequest"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Policy decision",
            "headers": {
              "x-decionis-warning": {
                "$ref": "#/components/headers/DecionisWarning"
              }
            },
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ProtocolEvaluateDecisionResponse"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/Error"
          },
          "401": {
            "$ref": "#/components/responses/Error"
          },
          "429": {
            "$ref": "#/components/responses/Error"
          },
          "500": {
            "$ref": "#/components/responses/Error"
          }
        }
      }
    },
    "/v1/protocol/evaluation-receipts": {
      "get": {
        "operationId": "getProtocolEvaluationReceipt",
        "summary": "Recover a recorded evaluation receipt after an ambiguous response",
        "description": "Read-only recovery for an authenticated protocol service identity and its\nauthorized organization. Ordinary organization and platform API keys are\nrejected. Requires the service bearer token and X-Org-ID header. Does not\nevaluate an action or return request, customer, or decision payloads.\nThe mode is the original persisted effective response mode, corroborated\nby the evaluation row. Missing, unknown, or conflicting mode evidence\nreturns null; it is never inferred from requested mode or current workspace\nsettings. Consumers must not treat null, SHADOW, or PARALLEL as paid\nenforcement. A not_found receipt is not evidence of a completed evaluation.\n",
        "security": [
          {
            "ProtocolServiceAuth": []
          }
        ],
        "parameters": [
          {
            "name": "X-Org-ID",
            "in": "header",
            "required": true,
            "schema": {
              "type": "string",
              "format": "uuid"
            }
          },
          {
            "name": "idempotency_key",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string",
              "minLength": 1,
              "maxLength": 200
            }
          },
          {
            "name": "org_id",
            "in": "query",
            "description": "Optional assertion; must match the authenticated organization.",
            "schema": {
              "type": "string",
              "format": "uuid"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Opaque receipt and nullable recorded effective mode; private and not cacheable",
            "headers": {
              "Cache-Control": {
                "schema": {
                  "type": "string",
                  "const": "private, no-store"
                }
              }
            },
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ProtocolEvaluationReceipt"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/Error"
          },
          "401": {
            "$ref": "#/components/responses/Error"
          },
          "403": {
            "$ref": "#/components/responses/Error"
          },
          "503": {
            "description": "Receipt store unavailable; no inference about completion or mode is safe"
          }
        }
      }
    },
    "/v1/authority/enforce-and-bind": {
      "post": {
        "operationId": "enforceAndBindAgentAction",
        "deprecated": true,
        "summary": "Evaluate and bind one exact agent action to a single-use execution grant",
        "description": "Deprecated alias of `POST /v1/authority/grants`: the same handler,\nkept registered so AgentSafe 0.3.8, the Go govern client and installed\nSDKs keep working byte-for-byte. Removal is a later, separate decision.\n\nAgent-Safe enforcement route. Decionis recomputes the SHA-256\nhash of the canonical execution intent, evaluates policy in ENFORCEMENT\nmode, and issues a short-lived Ed25519 execution grant only for an ALLOW\nevaluated in ENFORCEMENT mode. SHADOW records the same exact intent and\ndossier evidence without issuing an execution grant.\nWhen Idempotency-Key is supplied, it must exactly match the intent_id\nembedded in the signed intent; intent_id is the grant issuance boundary.\nThe intent's own `context.idempotency_key` is hashed into the intent\nand is not this header: any other header value answers 400\nAUTHORITY_IDEMPOTENCY_KEY_MISMATCH, with a `message` saying so.\nESCALATE, REVIEW_REQUIRED, BLOCK, dependency errors, and binding errors\nnever receive a grant. A Presence approval is accepted only after\nDecionis verifies the action-bound request and sealed receipt directly\nwith Presence; approval then becomes evidence for a fresh policy\nevaluation, not authority by itself.\nA presence attestation (`evidence.humanApproval.provider`\n`attestation`) is a presence provider's compact JWS, typ\n`decionis-presence-attestation+jwt`, verified against a key the\norganisation registered at `/v1/execution/provider-keys` with purpose\n`presence_attestation` (see PresenceAttestationClaims). On success its\nfacts are written to `agent_safe.human_approval` (provider, verified,\nmethod, approver_role, subject, attestation_id, key_id,\napproved_action_digest, approved_at, expires_at, and token_match /\nnetwork_validated when the provider sent them) for policy rules to\nmatch, and the resulting ExecutionBinding records the attested\napproval. An ESCALATE becomes an ALLOW only when the organisation's\npolicy has a rule matching those facts. A refused attestation is a 409\nwith one of the PresenceAttestationRefusal codes, and no evaluation\nruns.\nA signed producer signal (`evidence.signals[].token`) is a producer's\ncompact JWS, typ `decionis-signed-signal+jwt`, standing for up to\nthirty days and bound to no intent: a cardholder's delegation to an\nagent, say (see SignedSignalClaims). Each is verified before any\nevaluation against a key the organisation registered at\n`/v1/execution/provider-keys` with purpose `signed_signal`, or\nagainst the JWKS of an admitted presence provider, and its facts are\nwritten to `agent_safe.signed_signals.<name>` (verified, producer,\nmethod, subject, signal_id, key_id, issued_at, expires_at,\nevidence_digest, what it asserted, and `covers` / `covers_intent`:\nwhat of this intent it covers). A policy names the fact with\n`required_signals` as a dotted path\n(`agent_safe.signed_signals.card_delegation`) and decides with rules;\nthe ExecutionBinding records the facts, and the claim rebuilds them\nand re-checks the key and the expiry. Signals may come with or\nwithout a human approval, in any mode, and beside a managed\nescalation. A refused signal is a 409 with one of the\nSignedSignalRefusal codes; no evaluation runs and no event fires.\nThe token itself is never recorded, only its SHA-256 as\n`evidence_digest`.\nA runtime that read the target before asking states what it read in\n`context.agent_safe.precondition` (ExecutionTargetPrecondition:\n`version`, optional `state`, `source`, `read_at`), inside the intent\nhash. Policy reads it as `agent_safe.precondition`, and a bundle's\n`allowed_transitions` read its `state`; the grant binds `version` as\n`binding.expected_state_version`, and the claim's attestation carries\nit to a verifying provider, which refuses the write\n(`TARGET_STATE_CHANGED`) once the target has moved on. A malformed\nprecondition is a 400 `INTENT_PRECONDITION_INVALID`, and nothing is\nevaluated.\nAn ESCALATE in ENFORCEMENT, direct or managed, is queued to the\norganisation's event subscribers as `authority.escalation_required`,\ncarrying the policy's selector and who proves the person (the\n`verification` block: `provider`, `methods`, `level`); and once the\nintent is presented again with human approval evidence, the answer\nis queued as `authority.escalation_resolved` (the fresh decision's\noutcome, or REFUSED with the refusal code), with the proof's facts\nand never the proof. Delivery never affects a decision. The same\nrouting rides on an ESCALATE decision as `escalation_requirement`\nfor the runtime from agent-safe-pipeline/0.3.7 on, and for no other\nclient.\nWhen escalation.mode is MANAGED and policy returns ESCALATE, Decionis\npersists the original exact intent and orchestrates the policy-issued\nPresence ceremony. The response remains non-authorizing and carries a\nmanaged_escalation status locator; no ExecutionBinding or execution\ntoken exists until signed Presence evidence is independently verified\nand current policy is evaluated again.\nThe decision carries the dossier's `verification` envelope (the same\nshare-safe page `evaluate-decision` attaches) for a client that can\nread it: one identifying itself as `agent-safe-pipeline/0.2.0` or\nlater, or as `govern/2.0.0` or later (the workflow gate), in its\nUser-Agent. Every other client receives the decision exactly as\nbefore, so a gate that mirrors this schema strictly never meets a\nfield it does not know.\nOn this operation, a `context.decionis_policy` is treated as on\nevaluate-decision: its `sha256` must be the SHA-256 of its `content`,\nand one that asks for `enforce: true` has its policy file published as\nthe workspace's enforced policy only when the key holds\n`policy:write`, `policy:*` or `org:*`; for any other key the decision\nis unaffected, nothing is published, and the response carries\n`x-decionis-warning: POLICY_ENFORCE_SCOPE_MISSING`. No other\noperation whose body or answer carries an execution intent\n(verify-token, consume-token, claim-token, or the execution grant of\n/v1/ucp/checkout/authorize) publishes a policy file or sends that\nheader, whatever the key holds.\nA key whose only evaluation scope is `decision:shadow` (an AgentSafe\nhosted gateway's) runs SHADOW and nothing else: any other mode answers\n403 DECISION_SHADOW_MODE_DENIED, a body carrying\n`context.decionis_policy`, `evidence` or `escalation` answers 400\nDECISION_SHADOW_FIELD_DENIED (naming the `field`), and the evaluation\nis recorded and signed without dispatching to the organization's\nintegrations.\nA key whose evaluation scope is `decision:enforce` (an enforced\nAgentSafe hosted gateway's) runs SHADOW or ENFORCEMENT, may open a\nmanaged escalation, and answers 400 DECISION_ENFORCE_FIELD_DENIED for a\nbody carrying `context.decionis_policy`: it never publishes policy.\nThe scopes each mode needs: SHADOW takes one of `decision:write`,\n`decision:run`, `decision:*`, `org:*`, `decision:shadow` or\n`decision:enforce`; PARALLEL and ENFORCEMENT take one of\n`decision:write`, `decision:*`, `org:*` or `decision:enforce`, so a key\nthat runs SHADOW can still answer 403 FORBIDDEN in ENFORCEMENT. The\nworkspace counts too: a provisional workspace that no owner has claimed,\nor an AWS service workspace, runs SHADOW only, and any other mode\nanswers 403 PROVISIONAL_WORKSPACE_SHADOW_ONLY (or\nSERVICE_WORKSPACE_SHADOW_ONLY) whatever the key holds, with a\n`message`. An owner claims a provisional workspace through\n`POST /v1/orgs/{org_id}/claim/start` and `/claim/verify`; claiming\ndoes not widen a key's scopes. A SHADOW success therefore says nothing\nabout whether ENFORCEMENT will be accepted.\nWhen a grant is issued under Protocol 1.1 and the intent named no\n`expected_effect_digest`, the decision is unchanged and\n`x-decionis-warning` carries EXPECTED_EFFECT_DIGEST_MISSING: that grant\naccepts no effect evidence at finalization or reconciliation, so its\neffect can never be confirmed.\nA held allowance (`/v1/authority/allowances`) is a named,\norganisation-scoped counter that policy draws on: the rule that\napproved the action names it in `then.allowance`, with the amount\nfixed or read from `action.parameters` by JSON pointer, and the\nExecutionBinding records the draw as `allowance_draws`. A grant is\nissued only once that amount is reserved against the allowance, tied\nto the grant. When it cannot be, no grant is issued and the decision\nis `BLOCK` (`should_execute` false, `execution_eligible` false,\n`execution_binding_digest` null) with one of these reason codes after\nthe evaluation's own:\n`ALLOWANCE_EXHAUSTED` (what remains, the limit less what unclaimed\ngrants reserve, what open or unknown claims hold, and what committed\nclaims consumed within the window, is less than the amount),\n`ALLOWANCE_UNDEFINED` (the organisation defines no allowance under\nthat key) or `ALLOWANCE_AMOUNT_INVALID` (the parameters give no\npositive whole amount). It is a refusal and not an ESCALATE because\nno approval creates capacity: only raising the allowance's own limit\ndoes (a top-up, which needs `policy:write` or `org:*` and so never an\nagent's key), after which the action may be proposed again. The\ndossier keeps the evaluation as it was decided; the refusal is the\nauthority's, at the moment of the grant. The claim converts the\nreservation in the transaction that consumes the grant, and\nfinalization settles it: COMMITTED keeps it, FAILED releases it,\nINDETERMINATE holds it until reconciliation, and a grant never claimed\nreleases it when it expires. An allowance is a counter and never a\nconcurrency scope: grants drawing on one allowance are claimed and\ncarried out concurrently while it has room.\n",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ExecutionAuthorityRequest"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Bound policy decision; only ALLOW carries an execution token. A draw on a held allowance that cannot be reserved answers BLOCK with ALLOWANCE_EXHAUSTED, ALLOWANCE_UNDEFINED or ALLOWANCE_AMOUNT_INVALID.",
            "headers": {
              "x-decionis-warning": {
                "$ref": "#/components/headers/DecionisWarning"
              }
            },
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ExecutionAuthorityDecision"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/Error"
          },
          "401": {
            "$ref": "#/components/responses/Error"
          },
          "403": {
            "$ref": "#/components/responses/Error"
          },
          "409": {
            "description": "Presence evidence, a presence attestation or a signed signal failed verification, MANAGED escalation was combined with human-approval evidence, or the idempotency key is already bound",
            "content": {
              "application/json": {
                "schema": {
                  "oneOf": [
                    {
                      "$ref": "#/components/schemas/PresenceAttestationRefusal"
                    },
                    {
                      "$ref": "#/components/schemas/SignedSignalRefusal"
                    },
                    {
                      "$ref": "#/components/schemas/ErrorResponse"
                    },
                    {
                      "$ref": "#/components/schemas/ExecutionAuthorityDecision"
                    }
                  ]
                }
              }
            }
          },
          "429": {
            "$ref": "#/components/responses/Error"
          },
          "503": {
            "description": "Authority or grant store unavailable; no execution is authorized",
            "content": {
              "application/json": {
                "schema": {
                  "oneOf": [
                    {
                      "$ref": "#/components/schemas/ErrorResponse"
                    },
                    {
                      "$ref": "#/components/schemas/ExecutionAuthorityDecision"
                    }
                  ]
                }
              }
            }
          }
        }
      }
    },
    "/v1/authority/grants": {
      "post": {
        "operationId": "createAuthorityGrant",
        "summary": "Evaluate one exact agent action and bind it to a single-use execution grant",
        "description": "The grant resource. Decionis recomputes the SHA-256 hash of the\ncanonical execution intent, evaluates policy, and issues a\nshort-lived Ed25519 execution grant only for an ALLOW evaluated in\nENFORCEMENT mode. This is the handler of the deprecated alias\n`POST /v1/authority/enforce-and-bind`, registered twice: every rule\ndocumented there (Idempotency-Key binding, Presence and attestation\nevidence, signed signals, MANAGED escalation, the verification\nenvelope by client version, `context.decionis_policy`, the\n`decision:shadow` confinement, the scopes each mode needs and the\nworkspace-owner rule, the EXPECTED_EFFECT_DIGEST_MISSING warning, and\nthe BLOCK when a held allowance cannot be reserved) applies here\nunchanged.\n\nThe issued grant is addressed afterwards as\n`/v1/authority/grants/{grantId}`, where `grantId` is the grant's\n`jti`: the `execution_token_jti` of this response, the `jti` recorded\nfor the grant, and the `jti` claim of the signed execution token.\n\n`POST /v1/authority/evaluate` and `POST /v1/authority/enforce`, which\nthe legacy `@decionis/sdk-node` 0.1.0 calls and this API never served,\nanswer 410 `LEGACY_AUTHORITY_ROUTE_RETIRED` naming this route and\n`@decionis/sdk`, which replaces that package.\n\n`executor` (optional) says who will carry the grant out. It is never\npart of the canonical intent, its hash, or the grant's binding. When\n`executor.style` is `permit` and a grant was issued, the decision also\ncarries `permit_id` (the grant's jti), `intent_sha256` (the intent\nhash as bare hex, written as `dossier_sha256` is) and `expires_at`\n(`execution_token_expires_at`). Without `executor`, or with\n`dispatch`, the response is exactly the enforce-and-bind response. A\nMANAGED escalation's locator-only summary carries no grant, so it never\ncarries permit fields.\n",
        "parameters": [
          {
            "$ref": "#/components/parameters/IdempotencyKey"
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ExecutionAuthorityRequest"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Bound policy decision; only ALLOW carries an execution token",
            "headers": {
              "x-decionis-warning": {
                "$ref": "#/components/headers/DecionisWarning"
              }
            },
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ExecutionAuthorityDecision"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/Error"
          },
          "401": {
            "$ref": "#/components/responses/Error"
          },
          "403": {
            "$ref": "#/components/responses/Error"
          },
          "409": {
            "description": "Presence evidence, a presence attestation or a signed signal failed verification, MANAGED escalation was combined with human-approval evidence, or the idempotency key is already bound",
            "content": {
              "application/json": {
                "schema": {
                  "oneOf": [
                    {
                      "$ref": "#/components/schemas/PresenceAttestationRefusal"
                    },
                    {
                      "$ref": "#/components/schemas/SignedSignalRefusal"
                    },
                    {
                      "$ref": "#/components/schemas/ErrorResponse"
                    },
                    {
                      "$ref": "#/components/schemas/ExecutionAuthorityDecision"
                    }
                  ]
                }
              }
            }
          },
          "429": {
            "$ref": "#/components/responses/Error"
          },
          "503": {
            "description": "Authority or grant store unavailable; no execution is authorized",
            "content": {
              "application/json": {
                "schema": {
                  "oneOf": [
                    {
                      "$ref": "#/components/schemas/ErrorResponse"
                    },
                    {
                      "$ref": "#/components/schemas/ExecutionAuthorityDecision"
                    }
                  ]
                }
              }
            }
          }
        }
      }
    },
    "/v1/authority/grants/{grantId}": {
      "parameters": [
        {
          "$ref": "#/components/parameters/GrantId"
        }
      ],
      "get": {
        "operationId": "getAuthorityGrant",
        "summary": "Read and verify an execution grant without consuming it",
        "description": "The handler of the deprecated ali

# --- truncated at 32 KB (1433 KB total) ---
# Full source: https://artifacts.apis.io/decionis-com/openapi/_original/decionis-com-well-known-openapi.json