{ "openapi": "3.1.0", "info": { "title": "Decionis Policy Evaluation API", "version": "0.3.0", "description": "Decionis evaluates captured execution intent against versioned policies\nbefore the caller performs the action. SDKs delegate policy judgment to this\nservice and locally enforce the signed decision. New SDK API keys can be\nassociated with an industry so Decionis provisions a starter encoded policy\nbinding server-side; applications do not receive or implement policy logic.\n\nv0.2 adds: escalation-ready proof-packet export for dossiers and decision\nchains; the ops spend-control gates (spend admission + disbursement authority\nwith duplicate-payment detection); native-surface decision federation; and the\nanonymous eBay Marketplace Account Deletion compliance endpoint required for an\neBay production keyset.\n\nv0.3 adds the policy-as-code draft endpoints: turn unstructured policy\nsources (PDF, JSON, XML, transaction and audit logs, uploads) and live\npolicy-source connectors (Jira, Confluence, Notion, Google Drive, Git\nrepositories, SAP) into a reviewable strategy draft or an executable,\ncompiler-validated policy pack.\n" }, "servers": [ { "url": "https://api.decionis.com" } ], "security": [ { "ApiKeyAuth": [] } ], "paths": { "/v1/health": { "get": { "operationId": "getHealth", "summary": "Validate API connectivity", "responses": { "200": { "description": "API is reachable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HealthResponse" } } } } } } }, "/v1/protocol/evaluate-decision": { "post": { "operationId": "evaluateDecision", "summary": "Evaluate captured execution intent without executing it", "description": "Canonical SDK/API route for Decionis execution-gate decisions.", "parameters": [ { "$ref": "#/components/parameters/CorrelationId" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolEvaluateDecisionRequest" } } } }, "responses": { "200": { "description": "Policy decision", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolEvaluateDecisionResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "429": { "$ref": "#/components/responses/Error" }, "500": { "$ref": "#/components/responses/Error" } } } }, "/v1/authority/enforce-and-bind": { "post": { "operationId": "enforceAndBindAgentAction", "summary": "Evaluate and bind one exact agent action to a single-use execution grant", "description": "Canonical Agent-Safe enforcement route. Decionis recomputes the SHA-256\nhash of the canonical execution intent, evaluates policy in ENFORCEMENT\nmode, and issues a short-lived Ed25519 execution grant only for ALLOW.\nWhen Idempotency-Key is supplied, it must exactly match the intent_id\nembedded in the signed intent; intent_id is the grant issuance boundary.\nESCALATE, REVIEW_REQUIRED, BLOCK, dependency errors, and binding errors\nnever receive a grant. A Presence approval is accepted only after\nDecionis verifies the action-bound request and sealed receipt directly\nwith Presence; approval then becomes evidence for a fresh policy\nevaluation, not authority by itself.\n", "parameters": [ { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionAuthorityRequest" } } } }, "responses": { "200": { "description": "Bound policy decision; only ALLOW carries an execution token", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionAuthorityDecision" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "409": { "description": "Presence evidence failed verification or the idempotency key is already bound", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Error" }, { "$ref": "#/components/schemas/ExecutionAuthorityDecision" } ] } } } }, "429": { "$ref": "#/components/responses/Error" }, "503": { "description": "Authority or grant store unavailable; no execution is authorized", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Error" }, { "$ref": "#/components/schemas/ExecutionAuthorityDecision" } ] } } } } } } }, "/v1/execution/verify-token": { "post": { "operationId": "verifyAgentExecutionToken", "summary": "Verify an execution grant without consuming it", "description": "Verifies the Ed25519 signature, issuer, audience, lifetime, action,\nactor, tenant, and exact intent hash. This endpoint does not authorize\nexecution by itself because it does not atomically consume the grant.\n", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionTokenRequest" } } } }, "responses": { "200": { "description": "Valid grant", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionTokenResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "409": { "description": "Grant invalid, expired, or not bound to the supplied intent", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionTokenResponse" } } } }, "429": { "$ref": "#/components/responses/Error" }, "503": { "description": "Grant verification unavailable; no execution is authorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionTokenResponse" } } } } } } }, "/v1/execution/consume-token": { "post": { "operationId": "consumeAgentExecutionToken", "summary": "Atomically consume an exact intent-bound execution grant", "description": "Required immediately before the downstream mutation. The grant and\ndurable grant ledger must both match the tenant, decision, action, and\ncanonical intent hash. Exactly one concurrent request can consume a\ngrant; replay, expiry, store failure, or any mismatch fails closed.\n", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionTokenRequest" } } } }, "responses": { "200": { "description": "Grant consumed; the caller may execute the bound action once", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionTokenResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "409": { "description": "Grant replay, expiry, mismatch, or unknown grant", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionTokenResponse" } } } }, "429": { "$ref": "#/components/responses/Error" }, "503": { "description": "Grant store unavailable; no execution is authorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExecutionTokenResponse" } } } } } } }, "/v1/decisions/evaluate": { "post": { "operationId": "evaluateDecisionSdkAlias", "summary": "Evaluate captured execution intent through the SDK compatibility route", "deprecated": true, "description": "Backwards-compatible alias for SDKs before the canonical protocol route.", "parameters": [ { "$ref": "#/components/parameters/CorrelationId" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecisionRequest" } } } }, "responses": { "200": { "description": "Policy decision", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecisionResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "429": { "$ref": "#/components/responses/Error" }, "500": { "$ref": "#/components/responses/Error" } } } }, "/v1/dossiers/{decision_id}": { "get": { "operationId": "createDossier", "summary": "Persist or retrieve the Decision Dossier for a decision", "parameters": [ { "name": "decision_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Decision Dossier", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecisionDossier" } } } }, "404": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/decision-chains/{chain_id}": { "get": { "operationId": "getDecisionChain", "summary": "Retrieve workflow lineage for linked Decionis decisions", "description": "Returns the protocol-owned Decision Chain for a workflow. Decision\nChains link evaluated execution intents into a causal graph without\nexposing policy rules or application-side guardrail logic.\n", "parameters": [ { "name": "chain_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "org_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Decision Chain", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecisionChain" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/dossiers/{dossier_id}/proof-packet": { "get": { "operationId": "getDossierProofPacket", "summary": "Export a single Decision Dossier as a portable, signed proof packet", "description": "Returns an escalation-ready proof packet for one dossier: the dossier\npayload, policy snapshot, ledger anchor, the Ed25519 proof bundle, and a\ncryptographic verification result with verify instructions. Suitable for\nrefund/overcharge dispute escalation and audit.\n", "parameters": [ { "name": "dossier_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "org_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Signed proof packet", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecisionDossierProofPacket" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/decision-chains/{chain_id}/proof-packet": { "get": { "operationId": "getDecisionChainProofPacket", "summary": "Export a full Decision Chain as a portable, signed proof packet", "description": "Returns a proof packet covering every dossier in a decision chain, each\nindependently verified, with an overall verification rollup.\n", "parameters": [ { "name": "chain_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "org_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Signed chain proof packet", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecisionChainProofPacket" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/ops/spend-admission/verify": { "post": { "operationId": "opsSpendAdmissionVerify", "summary": "Govern a spend request (Gate 1 — spend admission)", "description": "Evaluates an expense / vendor-payment / refund / credit request against the\nops spend-control vertical pack (approval threshold + dual authorization,\nvendor verification, refund/credit limits). Runs the full shared\nevaluate-decision pipeline and returns a signed dossier reference.\n", "parameters": [ { "$ref": "#/components/parameters/CorrelationId" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpsGateRequest" } } } }, "responses": { "200": { "description": "Ops gate verdict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpsGateVerdict" } } } }, "401": { "$ref": "#/components/responses/Error" }, "502": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/ops/disbursement-authority/verify": { "post": { "operationId": "opsDisbursementAuthorityVerify", "summary": "Govern a disbursement (Gate 2 — disbursement authority)", "description": "Evaluates a vendor payment at release time: authorized role, segregation of\nduties, dual authorization, and duplicate-payment detection (a vendor +\ninvoice/amount fingerprint compared against prior org evaluations in the\nlookback window).\n", "parameters": [ { "$ref": "#/components/parameters/CorrelationId" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpsGateRequest" } } } }, "responses": { "200": { "description": "Ops gate verdict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpsGateVerdict" } } } }, "401": { "$ref": "#/components/responses/Error" }, "502": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/surfaces/decisions": { "post": { "operationId": "federateSurfaceDecision", "summary": "Federate a native-surface decision into the shared audit ledger", "description": "Records a decision made by a Layer-A commerce surface (Amazon, eBay,\nShopify) into the cross-surface SHA-256 audit ledger. When the full signed\ndossier is included it is persisted and becomes retrievable + exportable as\na proof packet; otherwise only a ledger entry is appended (backward\ncompatible).\n", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SurfaceDecisionRequest" } } } }, "responses": { "200": { "description": "Federation result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SurfaceDecisionResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "502": { "$ref": "#/components/responses/Error" } } } }, "/ebay/marketplace-account-deletion": { "get": { "operationId": "ebayAccountDeletionChallenge", "summary": "eBay Marketplace Account Deletion validation challenge", "description": "Anonymous endpoint required for an eBay PRODUCTION keyset. eBay sends a\n`challenge_code`; the response is the hex SHA-256 of\nchallengeCode + verificationToken + endpointURL. Requires\nEBAY_VERIFICATION_TOKEN and EBAY_DELETION_ENDPOINT_URL to be configured.\nNo authentication — eBay sends no credentials.\n", "security": [], "parameters": [ { "name": "challenge_code", "in": "query", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Challenge response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EbayChallengeResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } } }, "post": { "operationId": "ebayAccountDeletionNotification", "summary": "eBay Marketplace Account Deletion notification", "description": "Anonymous endpoint that receives an eBay account-deletion notification and\nacknowledges it. Decionis stores no eBay consumer PII, so there is nothing\nto purge beyond acknowledgement.\n", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MarketplaceDeletionNotification" } } } }, "responses": { "200": { "description": "Acknowledged", "content": { "application/json": { "schema": { "type": "object", "properties": { "ok": { "type": "boolean" } } } } } } } } }, "/v1/policies/validate": { "post": { "operationId": "validatePolicy", "summary": "Validate an encoded policy document", "parameters": [ { "$ref": "#/components/parameters/CorrelationId" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Policy validation result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyValidationResponse" } } } } } } }, "/v1/protocol/policies/bundles": { "post": { "operationId": "encodePolicyBundle", "summary": "Submit a versioned policy bundle artifact for Decionis encoding", "description": "Use this endpoint only when an integration participates in policy\nauthoring. The SDK submits a reviewed policy bundle artifact to\nDecionis; it does not evaluate or enforce policy rules locally.\n", "parameters": [ { "$ref": "#/components/parameters/CorrelationId" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyBundle" } } } }, "responses": { "202": { "description": "Policy bundle accepted for encoding", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArtifactAcceptedResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" } } } }, "/v1/orgs/{org_id}/policies/strategies/draft": { "post": { "operationId": "draftPolicyStrategy", "summary": "Draft a reviewable policy strategy from unstructured sources", "description": "Turns scattered policy material — pasted text and uploaded files\n(PDF, XLSX, XML, HTML, JSON, plain text such as transaction or audit\nlogs) plus optional live policy-source connectors (Jira, Confluence,\nNotion, Google Drive, Git repository, SAP) — into a strategy-shaped\nDecionis draft with clauses bucketed for automatic execution,\nescalation, and blocking. The draft is not persisted: review it, then\nencode the accepted version. Drafting is LLM-assisted when a provider\nis configured and falls back to deterministic extraction otherwise;\n`used_llm` reports which path ran. Requires an org API key with the\nADMIN role and the `autonomous:manage` or `org:*` scope.\n", "parameters": [ { "name": "org_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "$ref": "#/components/parameters/CorrelationId" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyDraftRequest" } } } }, "responses": { "200": { "description": "Non-persistent policy strategy draft", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyStrategyDraftResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "502": { "$ref": "#/components/responses/Error" } } } }, "/v1/orgs/{org_id}/policies/packs/draft": { "post": { "operationId": "draftPolicyPack", "summary": "Draft an executable policy pack from unstructured sources", "description": "Same inputs as the strategy draft, but the output is the executable\nDecionis policy pack — `{ name, all|any: [{field, op, value}], action }`\nrules. Every synthesized rule is validated through the rules compiler\nbefore it is returned; anything that cannot become an executable\npredicate is returned under `review`, never as a broken rule. The\ndraft is persisted for the org (`pack_id`) so it can be reviewed,\nedited, and finalized. Requires an org API key with the ADMIN role\nand the `autonomous:manage` or `org:*` scope.\n", "parameters": [ { "name": "org_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "$ref": "#/components/parameters/CorrelationId" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyDraftRequest" } } } }, "responses": { "200": { "description": "Persisted executable policy pack draft", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyPackDraftResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "502": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/shadow/evaluate-decision/reports": { "get": { "operationId": "listShadowEvaluateDecisionReports", "summary": "List shadow-mode decision evaluation reports", "description": "Returns protocol-owned shadow reports derived from saved\nevaluate-decision records. Reports summarize what Decionis would\ncontinue, stop, hand off, or review without exposing policy rules.\n", "parameters": [ { "name": "org_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "mode", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ], "default": "SHADOW" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 500, "default": 50 } }, { "name": "since", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } } ], "responses": { "200": { "description": "Shadow report list", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ShadowEvaluateDecisionReportsResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" } } } }, "/v1/protocol/shadow/evaluate-decision/reports/summary": { "get": { "operationId": "summarizeShadowEvaluateDecisionReports", "summary": "Summarize shadow-mode decision evaluation reports", "description": "Returns aggregate protocol-owned shadow report metrics for saved\nevaluate-decision records.\n", "parameters": [ { "name": "org_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "mode", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ], "default": "SHADOW" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 500, "default": 50 } }, { "name": "since", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } } ], "responses": { "200": { "description": "Shadow report summary", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ShadowEvaluateDecisionReportsSummaryResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" } } } }, "/v1/analytics/events": { "post": { "operationId": "recordAnalyticsEvent", "summary": "Ingest a public experiment analytics event", "description": "Public sink for proof-led A/B exposure and conversion events. Events are\nidempotent on visitor_id, experiment, event, and occurred_at.\n", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AnalyticsEventRequest" } } } }, "responses": { "202": { "description": "Analytics event accepted", "content": { "application/json": { "schema": { "type": "object", "required": [ "accepted", "event_id", "idempotent_replay", "experiment", "variant", "report" ], "properties": { "accepted": { "type": "boolean" }, "event_id": { "type": "string", "format": "uuid" }, "idempotent_replay": { "type": "boolean" }, "experiment": { "type": "string" }, "variant": { "type": "string", "enum": [ "A", "B" ] }, "report": { "$ref": "#/components/schemas/AnalyticsExperimentReport" } } } } } }, "400": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } } } }, "/v1/analytics/experiments/{experiment}/report": { "get": { "operationId": "getAnalyticsExperimentReport", "summary": "Report exposure-to-conversion rates for an experiment", "parameters": [ { "name": "experiment", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "window_days", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 365, "default": 90 } }, { "name": "conversion_event", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Experiment conversion report", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AnalyticsExperimentReport" } } } }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } } } }, "/v1/compliance/evidence-pack": { "post": { "operationId": "createComplianceEvidencePack", "summary": "Generate and persist a signed compliance evidence pack", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ComplianceEvidencePackRequest" } } } }, "responses": { "201": { "description": "Signed evidence pack", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ComplianceEvidencePackResponse" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "403": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } } } }, "/v1/verify/evidence/{pack_id}": { "get": { "operationId": "verifyComplianceEvidencePack", "summary": "Publicly verify a signed compliance evidence pack", "security": [], "parameters": [ { "name": "pack_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Evidence pack verification result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EvidencePackVerificationResponse" } } } }, "404": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } } } } }, "components": { "securitySchemes": { "ApiKeyAuth": { "type": "http", "scheme": "bearer" } }, "parameters": { "CorrelationId": { "name": "X-Correlation-ID", "in": "header", "required": false, "schema": { "type": "string" } }, "IdempotencyKey": { "name": "Idempotency-Key", "in": "header", "required": false, "schema": { "type": "string" } } }, "responses": { "Error": { "description": "Structured API error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } } }, "schemas": { "AnalyticsSegment": { "type": [ "string", "null" ], "enum": [ "compliance", "risk", "finance", "technical", null ] }, "AnalyticsEventRequest": { "type": "object", "required": [ "experiment", "variant", "event", "visitor_id", "page_path", "occurred_at" ], "properties": { "experiment": { "type": "string", "examples": [ "proof_led_page" ] }, "variant": { "type": "string", "enum": [ "A", "B" ] }, "event": { "type": "string", "examples": [ "exposure", "qualified_demo", "signup" ] }, "segment": { "$ref": "#/components/schemas/AnalyticsSegment" }, "visitor_id": { "type": "string" }, "page_path": { "type": "string", "examples": [ "/proof-led" ] }, "occurred_at": { "type": "string", "format": "date-time" }, "metadata": { "type": "object", "additionalProperties": true } }, "additionalProperties": false }, "AnalyticsConversionRate": { "type": "object", "required": [ "variant", "segment", "exposed_visitors", "converted_visitors", "conversion_rate" ], "properties": { "variant": { "type": "string", "enum": [ "A", "B" ] }, "segment": { "$ref": "#/components/schemas/AnalyticsSegment" }, "exposed_visitors": { "type": "integer", "minimum": 0 }, "converted_visitors": { "type": "integer", "minimum": 0 }, "conversion_rate": { "type": "number", "minimum": 0 } }, "additionalProperties": false }, "AnalyticsExperimentReport": { "type": "object", "required": [ "generated_at", "experiment", "window_days", "conversion_event", "variants", "segments" ], "properties": { "generated_at": { "type": "string", "format": "date-time" }, "experiment": { "type": "string" }, "window_days": { "type": "integer" }, "conversion_event": { "type": [ "string", "null" ] }, "variants": { "type": "array", "items": { "$ref": "#/components/schemas/AnalyticsConversionRate" } }, "segments": { "type": "array", "items": { "$ref": "#/components/schemas/AnalyticsConversionRate" } } }, "additionalProperties": false }, "ComplianceFrameworkId": { "type": "string", "enum": [ "eu_ai_act", "gdpr", "soc2" ] }, "ComplianceEvidencePackRequest": { "type": "object", "required": [ "org_id", "session_id", "workflow_label", "window_days", "frameworks" ], "properties": { "org_id": { "type": "string", "format": "uuid" }, "session_id": { "type": "string" }, "workflow_label": { "type": "string", "examples": [ "Vendor payments" ] }, "window_days": { "type": "integer", "minimum": 1, "maximum": 365 }, "frameworks": { "type": "array", "items": { "$ref": "#/components/schemas/ComplianceFrameworkId" } } }, "additionalProperties": false }, "ComplianceEvidencePackMetrics": { "type": "object", "required": [ "decisions", "blocked", "escalated", "human_oversight", "recordkeeping" ], "properties": { "decisions": { "type": "integer", "minimum": 0 }, "blocked": { "type": "integer", "minimum": 0 }, "escalated": { "type": "integer", "minimum": 0 }, "human_oversight": { "type": "integer", "minimum": 0 }, "recordkeeping": { "type": "integer", "minimum": 0 } }, "additionalProperties": false }, "ComplianceEvidenceControl": { "type": "object", "required": [ "ref", "name", "requirement", "evidence", "metric_value" ], "properties": { "ref": { "type": "string" }, "name": { "type": "string" }, "requirement": { "type": "string" }, "evidence": { "type": "string" }, "metric": { "type": "string", "enum": [ "decisions", "blocked", "escalated", "humanOversight", "recordkeeping" ] }, "metric_value": { "type": [ "integer", "null" ], "minimum": 0 } }, "additionalProperties": false }, "ComplianceEvidenceFramework": { "type": "object", "required": [ "id", "name", "controls" ], "properties": { "id": { "$ref": "#/components/schemas/ComplianceFrameworkId" }, "name": { "type": "string" }, "controls": { "type": "array", "items": { "$ref": "#/components/schemas/ComplianceEvidenceControl" } } }, "additionalProperties": false }, "ComplianceEvidencePackResponse": { "type": "object", "required": [ "pack_id", "generated_at", "signature", "verification_url", "metrics", "frameworks", "download_url" ], "properties": { "pack_id": { "type": "string", "format": "uuid" }, "generated_at": { "type": "string", "format": "date-time" }, "signature": { "type": "string", "examples": [ "ed25519:key-id:base64url-signature" ] }, "verification_url": { "type": "string", "format": "uri" }, "metrics": { "$ref": "#/components/schemas/ComplianceEvidencePackMetrics" }, "frameworks": { "type": "array", "items": { "$ref": "#/components/schemas/ComplianceEvidenceFramework" } }, "download_url": { "type": "string", "format": "uri" } }, "additionalProperties": false }, "EvidencePackVerificationResponse": { "type": "object", "required": [ "service", "verified", "valid", "checked_at", "pack", "signature" ], "properties": { "service": { "type": "string", "enum": [ "decionis" ] }, "verified": { "type": "boolean" }, "valid": { "type": "boolean" }, "checked_at": { "type": "string", "format": "date-time" }, "pack": { "type": "object", "additionalProperties": true }, "signature": { "type": "object", "additionalProperties": true } }, "additionalProperties": false }, "DecisionStatus": { "type": "string", "enum": [ "ALLOW", "BLOCK", "ESCALATE", "REVIEW_REQUIRED", "ERROR" ] }, "Actor": { "type": "object", "required": [ "id", "type" ], "properties": { "id": { "type": "string" }, "type": { "type": "string", "examples": [ "AI_AGENT", "TRADING_BOT", "HUMAN", "SERVICE" ] }, "role": { "type": "string" } }, "additionalProperties": true }, "Action": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string", "examples": [ "TRANSFER_FUNDS", "OPEN_POSITION" ] }, "resource": { "type": "string" } }, "additionalProperties": true }, "DecisionRequest": { "type": "object", "required": [ "tenant_id", "actor", "action" ], "properties": { "tenant_id": { "type": "string" }, "actor": { "$ref": "#/components/schemas/Actor" }, "action": { "$ref": "#/components/schemas/Action" }, "context": { "type": "object", "additionalProperties": true }, "policy_refs": { "type": "array", "items": { "type": "string" } }, "idempotency_key": { "type": "string" }, "correlation_id": { "type": "string" }, "shadow_mode": { "type": "boolean", "default": false }, "enforcement_mode": { "type": "string", "enum": [ "enforce", "shadow", "dry_run" ], "default": "enforce" } }, "additionalProperties": true }, "ExecutionIntentActor": { "type": "object", "additionalProperties": false, "required": [ "id", "type" ], "properties": { "id": { "type": "string", "minLength": 1, "maxLength": 200 }, "type": { "type": "string", "minLength": 1, "maxLength": 200 }, "runtime": { "type": "string", "minLength": 1, "maxLength": 200 }, "trust_level": { "type": "string", "minLength": 1, "maxLength": 80 } } }, "ExecutionIntentAction": { "type": "object", "additionalProperties": false, "required": [ "type", "resource", "parameters" ], "properties": { "type": { "type": "string", "minLength": 1, "maxLength": 120, "pattern": "^[a-z][a-z0-9._:-]*$" }, "resource": { "type": "string", "minLength": 1, "maxLength": 500 }, "parameters": { "type": "object", "additionalProperties": true } } }, "ExecutionDownstreamTarget": { "type": "object", "additionalProperties": false, "required": [ "system", "operation" ], "properties": { "system": { "type": "string", "minLength": 1, "maxLength": 200 }, "operation": { "type": "string", "minLength": 1, "maxLength": 200 }, "endpoint": { "type": "string", "minLength": 1, "maxLength": 500 } } }, "ExecutionIntentBinding": { "type": "object", "additionalProperties": false, "required": [ "protocol_version", "tenant_id", "intent_id", "captured_at", "expires_at", "actor", "action", "context", "downstream_target" ], "properties": { "protocol_version": { "type": "string", "const": "agent-safe.intent/1" }, "tenant_id": { "type": "string", "format": "uuid" }, "intent_id": { "type": "string", "format": "uuid" }, "captured_at": { "type": "string", "format": "date-time" }, "expires_at": { "type": "string", "format": "date-time", "description": "Must be later than captured_at and no more than five minutes after it." }, "actor": { "$ref": "#/components/schemas/ExecutionIntentActor" }, "action": { "$ref": "#/components/schemas/ExecutionIntentAction" }, "context": { "type": "object", "additionalProperties": true }, "downstream_target": { "$ref": "#/components/schemas/ExecutionDownstreamTarget" } } }, "PresenceHumanApprovalEvidence": { "type": "object", "additionalProperties": false, "required": [ "provider", "requestId", "receiptDossierId" ], "properties": { "provider": { "type": "string", "const": "presence" }, "requestId": { "type": "string", "maxLength": 200 }, "receiptDossierId": { "type": "string", "maxLength": 200 } } }, "ExecutionAuthorityRequest": { "unevaluatedProperties": false, "allOf": [ { "$ref": "#/components/schemas/ExecutionIntentBinding" }, { "type": "object", "required": [ "intent_hash", "mode" ], "properties": { "intent_hash": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$", "description": "SHA-256 of the UTF-8 canonical JSON ExecutionIntentBinding.\nObjects are recursively key-sorted using ECMAScript's default\nUTF-16 code-unit ordering and serialized with JSON.stringify semantics.\n" }, "mode": { "type": "string", "const": "ENFORCEMENT" }, "evidence": { "type": "object", "additionalProperties": false, "properties": { "humanApproval": { "$ref": "#/components/schemas/PresenceHumanApprovalEvidence" } } } } } ] }, "ExecutionAuthorityDecision": { "type": "object", "additionalProperties": false, "required": [ "decision_id", "chain_id", "status", "should_execute", "reason_codes", "action_hash", "execution_token", "execution_token_expires_at", "dossier_id", "dossier_url", "ledger_entry_id" ], "properties": { "decision_id": { "type": "string" }, "chain_id": { "type": [ "string", "null" ] }, "status": { "type": "string", "enum": [ "ALLOW", "BLOCK", "ESCALATE", "REVIEW_REQUIRED", "ERROR" ] }, "should_execute": { "type": "boolean" }, "reason_codes": { "type": "array", "items": { "type": "string" } }, "action_hash": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "execution_token": { "type": [ "string", "null" ], "description": "Present only when status is ALLOW and should_execute is true." }, "execution_token_expires_at": { "type": [ "string", "null" ], "format": "date-time" }, "dossier_id": { "type": [ "string", "null" ] }, "dossier_url": { "type": [ "string", "null" ] }, "ledger_entry_id": { "type": [ "string", "null" ] } } }, "ExecutionTokenRequest": { "type": "object", "additionalProperties": false, "required": [ "execution_token", "intent_hash", "intent" ], "properties": { "execution_token": { "type": "string", "minLength": 1, "maxLength": 20000 }, "intent_hash": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "intent": { "$ref": "#/components/schemas/ExecutionIntentBinding" }, "consumed_by": { "type": "string", "minLength": 1, "maxLength": 200 } } }, "ExecutionTokenClaims": { "type": "object", "additionalProperties": true, "required": [ "iss", "org_id", "dossier_id", "decision_id", "action", "decision", "scope", "binding", "jti", "iat", "nbf", "exp" ], "properties": { "iss": { "type": "string" }, "sub": { "type": "string" }, "aud": { "type": "string" }, "org_id": { "type": "string", "format": "uuid" }, "dossier_id": { "type": "string" }, "decision_id": { "type": "string" }, "chain_id": { "type": "string" }, "action": { "type": "string" }, "decision": { "type": "string", "const": "allow" }, "scope": { "type": "string", "const": "execute" }, "binding": { "type": "object", "required": [ "intent_hash" ], "properties": { "intent_hash": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } } }, "jti": { "type": "string" }, "iat": { "type": "integer" }, "nbf": { "type": "integer" }, "exp": { "type": "integer" } } }, "ExecutionTokenResponse": { "type": "object", "additionalProperties": false, "required": [ "valid", "reason_codes", "claims" ], "properties": { "valid": { "type": "boolean" }, "reason_codes": { "type": "array", "items": { "type": "string" } }, "claims": { "oneOf": [ { "$ref": "#/components/schemas/ExecutionTokenClaims" }, { "type": "null" } ] } } }, "ProtocolEvaluateDecisionRequest": { "type": "object", "required": [ "decision_type" ], "properties": { "org_id": { "type": "string", "format": "uuid", "description": "Optional when authenticated with an organization API key." }, "decision_type": { "type": "string" }, "amount": { "type": "number" }, "risk_score": { "type": "number", "minimum": 0, "maximum": 1 }, "channel": { "type": "string" }, "policy_version": { "type": "string" }, "objective_profile": { "type": "string" }, "mode": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ] }, "decision_band": { "type": "string" }, "transaction_type": { "type": "string" }, "workflow_key": { "type": "string" }, "vertical_pack": { "type": "string" }, "context": { "type": "object", "additionalProperties": true }, "idempotency_key": { "type": "string" }, "decision_chain": { "$ref": "#/components/schemas/DecisionChainRequest" } }, "additionalProperties": true }, "ProtocolEvaluateDecisionResponse": { "type": "object", "required": [ "outcome", "confidence", "policy_version", "objective_profile", "dossier_id", "evaluation_id", "mode", "fallback_to_legacy", "governance_metrics", "idempotent_replay" ], "properties": { "outcome": { "type": "string", "enum": [ "APPROVE", "ESCALATE", "REJECT", "REVIEW" ] }, "confidence": { "type": "number" }, "policy_version": { "type": "string" }, "objective_profile": { "type": "string" }, "dossier_id": { "type": "string", "format": "uuid" }, "dossier_sha256": { "type": "string", "nullable": true }, "evaluation_id": { "type": "string", "format": "uuid" }, "decision_resolution_id": { "type": "string", "format": "uuid", "nullable": true }, "ledger_entry_id": { "type": "string", "format": "uuid", "nullable": true }, "ledger_entry_hash": { "type": "string", "nullable": true }, "mode": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ] }, "fallback_to_legacy": { "type": "boolean" }, "fallback_reason": { "type": "string", "nullable": true }, "governance_metrics": { "type": "object", "additionalProperties": true }, "policy_guard": { "type": "object", "additionalProperties": true }, "policy_evaluation": { "type": "object", "additionalProperties": true }, "decision_chain": { "$ref": "#/components/schemas/DecisionChainSummary" }, "policy_snapshot": { "type": "object", "additionalProperties": true, "description": "Hash-backed reference to the encoded policy bundle evaluated by the protocol." }, "idempotent_replay": { "type": "boolean" } }, "additionalProperties": true }, "DecisionChainRequest": { "type": "object", "properties": { "chain_id": { "type": "string", "format": "uuid", "description": "Existing chain to append to. Optional when parent references are supplied." }, "workflow_id": { "type": "string", "description": "Customer workflow or execution instance identifier." }, "step_id": { "type": "string", "description": "Current workflow step being evaluated." }, "sequence": { "type": "integer", "minimum": 0 }, "parent_evaluation_ids": { "type": "array", "maxItems": 20, "items": { "type": "string", "format": "uuid" } }, "parent_dossier_ids": { "type": "array", "maxItems": 20, "items": { "type": "string", "format": "uuid" } }, "metadata": { "type": "object", "additionalProperties": true } }, "additionalProperties": true }, "DecisionChainSummary": { "type": "object", "required": [ "chain_id", "workflow_id", "step_id", "root_evaluation_id", "parent_evaluation_ids", "parent_dossier_ids", "lineage_depth", "integrity_hash", "chain_api_path" ], "properties": { "chain_id": { "type": "string", "format": "uuid" }, "workflow_id": { "type": "string" }, "step_id": { "type": "string" }, "sequence": { "type": "integer", "nullable": true }, "root_evaluation_id": { "type": "string", "format": "uuid" }, "parent_evaluation_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "parent_dossier_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "lineage_depth": { "type": "integer" }, "integrity_hash": { "type": "string" }, "chain_api_path": { "type": "string" } }, "additionalProperties": false }, "DecisionChainLink": { "type": "object", "required": [ "id", "chain_id", "workflow_id", "step_id", "decision_evaluation_id", "dossier_id", "parent_evaluation_ids", "parent_dossier_ids", "root_evaluation_id", "lineage_depth", "integrity_hash", "integrity_verified", "dossier_api_path", "created_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "chain_id": { "type": "string", "format": "uuid" }, "workflow_id": { "type": "string" }, "step_id": { "type": "string" }, "sequence": { "type": "integer", "nullable": true }, "decision_evaluation_id": { "type": "string", "format": "uuid" }, "dossier_id": { "type": "string", "format": "uuid" }, "parent_evaluation_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "parent_dossier_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "root_evaluation_id": { "type": "string", "format": "uuid" }, "lineage_depth": { "type": "integer" }, "integrity_hash": { "type": "string" }, "integrity_verified": { "type": "boolean" }, "outcome": { "type": "string" }, "policy_version": { "type": "string" }, "dossier_api_path": { "type": "string" }, "created_at": { "type": "string", "format": "date-time" } }, "additionalProperties": false }, "DecisionChain": { "type": "object", "required": [ "service", "protocol_version", "org_id", "chain_id", "count", "max_lineage_depth", "integrity_verified", "links" ], "properties": { "service": { "type": "string" }, "protocol_version": { "type": "string" }, "org_id": { "type": "string", "format": "uuid" }, "chain_id": { "type": "string", "format": "uuid" }, "workflow_id": { "type": "string", "nullable": true }, "root_evaluation_id": { "type": "string", "format": "uuid", "nullable": true }, "count": { "type": "integer" }, "max_lineage_depth": { "type": "integer" }, "integrity_verified": { "type": "boolean" }, "links": { "type": "array", "items": { "$ref": "#/components/schemas/DecisionChainLink" } } }, "additionalProperties": false }, "ShadowEvaluateDecisionReport": { "type": "object", "required": [ "evaluation_id", "dossier_id", "created_at", "decision_type", "policy_version", "mode", "outcome", "confidence", "would_execute", "execution_action", "reason", "dossier_api_path" ], "properties": { "evaluation_id": { "type": "string", "format": "uuid" }, "dossier_id": { "type": "string", "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "decision_type": { "type": "string" }, "decision_domain": { "type": "string", "nullable": true }, "amount": { "type": "number", "nullable": true }, "risk_score": { "type": "number", "nullable": true }, "channel": { "type": "string", "nullable": true }, "policy_version": { "type": "string" }, "mode": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ] }, "outcome": { "type": "string", "enum": [ "APPROVE", "ESCALATE", "REJECT", "REVIEW" ] }, "confidence": { "type": "number" }, "would_execute": { "type": "boolean" }, "execution_action": { "type": "string", "enum": [ "CONTINUE", "STOP", "HAND_OFF", "REVIEW" ] }, "reason": { "type": "string" }, "policy_guard_reason": { "type": "string", "nullable": true }, "policy_evaluation_resolution": { "type": "string", "nullable": true }, "selected_rule_id": { "type": "string", "nullable": true }, "dossier_api_path": { "type": "string" } }, "additionalProperties": false }, "ShadowEvaluateDecisionReportSummary": { "type": "object", "required": [ "total_evaluations", "would_approve_count", "would_block_count", "would_escalate_count", "review_required_count", "non_approve_count", "non_approve_rate", "policy_mismatch_count", "policy_mismatch_rate", "near_miss_count", "near_miss_rate" ], "properties": { "total_evaluations": { "type": "integer" }, "would_approve_count": { "type": "integer" }, "would_block_count": { "type": "integer" }, "would_escalate_count": { "type": "integer" }, "review_required_count": { "type": "integer" }, "non_approve_count": { "type": "integer" }, "non_approve_rate": { "type": "number" }, "policy_mismatch_count": { "type": "integer" }, "policy_mismatch_rate": { "type": "number" }, "near_miss_count": { "type": "integer" }, "near_miss_rate": { "type": "number" }, "outcome_counts": { "type": "object", "additionalProperties": { "type": "integer" } }, "top_decision_types": { "type": "array", "items": { "type": "object", "additionalProperties": true } }, "top_reason_patterns": { "type": "array", "items": { "type": "object", "additionalProperties": true } } }, "additionalProperties": false }, "ShadowEvaluateDecisionReportsResponse": { "type": "object", "required": [ "service", "protocol_version", "generated_at", "org_id", "mode", "count", "reports", "summary" ], "properties": { "service": { "type": "string" }, "protocol_version": { "type": "string" }, "generated_at": { "type": "string", "format": "date-time" }, "org_id": { "type": "string", "format": "uuid" }, "mode": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ] }, "since": { "type": "string", "format": "date-time", "nullable": true }, "count": { "type": "integer" }, "reports": { "type": "array", "items": { "$ref": "#/components/schemas/ShadowEvaluateDecisionReport" } }, "summary": { "$ref": "#/components/schemas/ShadowEvaluateDecisionReportSummary" } }, "additionalProperties": false }, "ShadowEvaluateDecisionReportsSummaryResponse": { "type": "object", "required": [ "service", "protocol_version", "generated_at", "org_id", "mode", "summary" ], "properties": { "service": { "type": "string" }, "protocol_version": { "type": "string" }, "generated_at": { "type": "string", "format": "date-time" }, "org_id": { "type": "string", "format": "uuid" }, "mode": { "type": "string", "enum": [ "SHADOW", "PARALLEL", "ENFORCEMENT" ] }, "since": { "type": "string", "format": "date-time", "nullable": true }, "summary": { "$ref": "#/components/schemas/ShadowEvaluateDecisionReportSummary" } }, "additionalProperties": false }, "DecisionSignature": { "type": "object", "required": [ "algorithm", "value" ], "properties": { "algorithm": { "type": "string", "enum": [ "Ed25519" ] }, "value": { "type": "string", "description": "Base64, base64url, or hex encoded signature bytes." } } }, "DecisionResponse": { "type": "object", "required": [ "decision_id", "status", "reason_codes", "explanation" ], "properties": { "decision_id": { "type": "string" }, "status": { "$ref": "#/components/schemas/DecisionStatus" }, "reason_codes": { "type": "array", "items": { "type": "string" } }, "explanation": { "type": "string" }, "dossier_url": { "type": "string", "format": "uri" }, "signature": { "$ref": "#/components/schemas/DecisionSignature" }, "latency_ms": { "type": "integer", "minimum": 0 } }, "additionalProperties": true }, "DecisionDossier": { "type": "object", "properties": { "decision_id": { "type": "string" }, "dossier_url": { "type": "string", "format": "uri" }, "status": { "$ref": "#/components/schemas/DecisionStatus" }, "audit_events": { "type": "array", "items": { "type": "object", "additionalProperties": true } } }, "additionalProperties": true }, "PolicyValidationResponse": { "type": "object", "required": [ "valid" ], "properties": { "valid": { "type": "boolean" }, "errors": { "type": "array", "items": { "type": "string" } }, "warnings": { "type": "array", "items": { "type": "string" } } }, "additionalProperties": true }, "PolicyBundle": { "type": "object", "required": [ "protocol_version", "bundle_id", "org_id", "version", "effective_from", "rules" ], "properties": { "protocol_version": { "type": "string", "pattern": "^1\\.[0-9]+(\\.[0-9]+)?$" }, "bundle_id": { "type": "string", "format": "uuid" }, "org_id": { "type": "string" }, "version": { "type": "string", "minLength": 1, "maxLength": 100 }, "effective_from": { "type": "string", "format": "date-time" }, "effective_to": { "type": "string", "format": "date-time" }, "rules": { "type": "array", "minItems": 1, "items": { "$ref": "#/components/schemas/PolicyRule" } }, "metadata": { "type": "object", "properties": { "author": { "type": "string" }, "source": { "type": "string" }, "change_ticket": { "type": "string" } }, "additionalProperties": false }, "signature": { "type": "object", "properties": { "algo": { "type": "string" }, "digest": { "type": "string" }, "signed_at": { "type": "string", "format": "date-time" }, "signed_by": { "type": "string" } }, "additionalProperties": false } }, "additionalProperties": false }, "PolicyRule": { "type": "object", "required": [ "rule_id", "name", "decision_domain", "when", "then", "priority", "enabled" ], "properties": { "rule_id": { "type": "string" }, "name": { "type": "string" }, "decision_domain": { "type": "string" }, "when": { "type": "object", "additionalProperties": true }, "then": { "type": "object", "required": [ "action" ], "properties": { "action": { "type": "string", "enum": [ "REQUIRE_REVIEW", "AUTO_APPROVE", "AUTO_REJECT", "ESCALATE", "REQUEST_INFO" ] }, "severity": { "type": "string", "enum": [ "routine", "elevated", "urgent" ] }, "assignee_role": { "type": "string" }, "sla_minutes": { "type": "integer", "minimum": 1 } }, "additionalProperties": false }, "priority": { "type": "integer" }, "enabled": { "type": "boolean" }, "rationale": { "type": "string" } }, "additionalProperties": false }, "PolicyDraftSource": { "type": "object", "required": [ "label", "source_type" ], "description": "One manual policy source. Provide `content` (inline text) or\n`content_base64` (file bytes; text is extracted server-side from PDF,\nXLSX, XML, HTML, JSON, and plain-text documents such as transaction\nor audit logs).\n", "properties": { "label": { "type": "string", "maxLength": 200 }, "source_type": { "type": "string", "maxLength": 80, "description": "Caller-chosen tag, e.g. upload, jira, confluence, audit_log." }, "content": { "type": "string", "maxLength": 250000 }, "content_base64": { "type": "string", "maxLength": 10000000 }, "content_type": { "type": "string", "maxLength": 200 }, "file_name": { "type": "string", "maxLength": 300 }, "external_reference": { "type": "string", "maxLength": 500 } }, "additionalProperties": false }, "PolicyDraftRequest": { "type": "object", "description": "Provide manual sources, live connector ids, or both — at least one of the two is required.\n", "properties": { "suggested_name": { "type": "string", "maxLength": 160 }, "workflow_key": { "type": "string", "maxLength": 120 }, "sources": { "type": "array", "maxItems": 20, "items": { "$ref": "#/components/schemas/PolicyDraftSource" } }, "live_connector_ids": { "type": "array", "maxItems": 6, "description": "Org policy-source connectors to pull live at draft time (Jira, Confluence, Notion, Google Drive, Git repository, SAP).\n", "items": { "type": "string", "format": "uuid" } } }, "additionalProperties": false }, "PolicyStrategyDraftResponse": { "type": "object", "required": [ "org", "generated_at", "draft" ], "properties": { "org": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "generated_at": { "type": "string", "format": "date-time" }, "draft": { "type": "object", "required": [ "used_llm", "suggested_name", "workflow_key", "summary", "strategy" ], "properties": { "used_llm": { "type": "boolean" }, "suggested_name": { "type": "string" }, "workflow_key": { "type": "string" }, "summary": { "type": "string" }, "strategy": { "type": "object", "description": "The strategy-shaped draft, including `strategy_rules` with clauses bucketed for automatic execution, escalation, and blocking.\n", "additionalProperties": true }, "extracted_sources": { "type": "array", "items": {} }, "review_checklist": { "type": "array", "items": {} }, "open_questions": { "type": "array", "items": {} }, "warnings": { "type": "array", "items": {} } }, "additionalProperties": true } }, "additionalProperties": false }, "PolicyPackDraftResponse": { "type": "object", "required": [ "org", "generated_at", "pack_id", "draft" ], "properties": { "org": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } }, "generated_at": { "type": "string", "format": "date-time" }, "pack_id": { "type": "string", "format": "uuid", "description": "The persisted draft pack, ready for review and finalization." }, "draft": { "type": "object", "required": [ "used_llm", "suggested_name", "workflow_key", "pack", "review" ], "properties": { "status": { "type": "string" }, "used_llm": { "type": "boolean" }, "suggested_name": { "type": "string" }, "workflow_key": { "type": "string" }, "pack": { "type": "object", "description": "The executable pack: compiler-validated rules of the shape `{ name, all|any: [{field, op, value}], action }` with action one of allow, block, restrain, escalate.\n", "properties": { "rules": { "type": "array", "items": { "type": "object", "additionalProperties": true } } }, "additionalProperties": true }, "source_summary": { "type": "array", "items": {} }, "review": { "type": "array", "description": "Clauses that could not become executable predicates — returned for human review instead of being synthesized into rules.\n", "items": {} } }, "additionalProperties": true } }, "additionalProperties": false }, "ArtifactAcceptedResponse": { "type": "object", "required": [ "accepted", "service", "protocol_version", "artifact", "artifact_id", "org_id", "received_at" ], "properties": { "accepted": { "type": "boolean" }, "service": { "type": "string" }, "protocol_version": { "type": "string" }, "artifact": { "type": "string", "enum": [ "policy_bundle" ] }, "artifact_id": { "type": "string" }, "org_id": { "type": "string" }, "received_at": { "type": "string", "format": "date-time" } }, "additionalProperties": true }, "HealthResponse": { "type": "object", "required": [ "status" ], "properties": { "status": { "type": "string", "examples": [ "ok" ] }, "version": { "type": "string" } } }, "ErrorResponse": { "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "message": { "type": "string" }, "request_id": { "type": "string" }, "status": { "type": "integer" } } }, "OpsGateRequest": { "type": "object", "description": "A spend/disbursement payload for the ops spend-control vertical pack.", "properties": { "object_type": { "type": "string", "examples": [ "Expense", "VendorPayment", "Refund", "Credit" ] }, "object_id": { "type": "string" }, "action": { "type": "string" }, "proposed_state": { "type": "object", "description": "amount, currency, vendor_id, invoice_number, vendor_status, expense_threshold, refund_limit, credit_limit, etc.", "additionalProperties": true }, "actor": { "type": "object", "description": "The acting principal and its role (e.g. role Controller or CFO).", "additionalProperties": true }, "context": { "type": "object", "description": "requested_by, approved_by, second_approver, org_id, etc.", "additionalProperties": true } }, "additionalProperties": true }, "OpsGateVerdict": { "type": "object", "properties": { "decision": { "type": "string", "enum": [ "ALLOW", "BLOCK", "ESCALATE", "DELAY" ] }, "outcome": { "type": "string", "enum": [ "APPROVE", "REJECT", "ESCALATE", "REVIEW" ] }, "reason": { "type": "string" }, "required_action": { "type": [ "string", "null" ] }, "gate": { "type": "string", "enum": [ "spend_admission", "disbursement_authority" ] }, "decision_domain": { "type": "string", "enum": [ "OPS_SPEND_ADMISSION", "OPS_DISBURSEMENT_AUTHORITY" ] }, "rule_id": { "type": [ "string", "null" ] }, "duplicate_suspected": { "type": "boolean" }, "policy_version": { "type": "string" }, "dossier_id": { "type": [ "string", "null" ] }, "dossier_sha256": { "type": [ "string", "null" ] }, "ledger_entry_id": { "type": [ "string", "null" ] }, "ledger_entry_hash": { "type": [ "string", "null" ] }, "federated": { "type": "boolean" }, "pipeline": { "type": "boolean" }, "idempotent_replay": { "type": "boolean" } }, "additionalProperties": true }, "SurfaceDecisionRequest": { "type": "object", "required": [ "surface", "decision", "dossier_id", "dossier_sha256" ], "properties": { "surface": { "type": "string", "examples": [ "amazon", "ebay", "shopify" ] }, "decision": { "type": "string", "enum": [ "authorize", "block", "review" ] }, "dossier_id": { "type": "string" }, "dossier_sha256": { "type": "string" }, "org_id": { "type": "string", "format": "uuid" }, "mode": { "type": "string", "enum": [ "shadow", "enforced" ] }, "dossier": { "type": "object", "description": "The full signed surface dossier. When present it is persisted and made exportable as a proof packet; when omitted only a ledger entry is appended.", "additionalProperties": true } }, "additionalProperties": true }, "SurfaceDecisionResponse": { "type": "object", "properties": { "federated": { "type": "boolean" }, "persisted": { "type": "boolean" }, "surface": { "type": "string" }, "org_id": { "type": "string" }, "dossier_id": { "type": "string" }, "ledger_entry_id": { "type": [ "string", "null" ] }, "ledger_entry_hash": { "type": [ "string", "null" ] }, "ledger_error": { "type": [ "string", "null" ] } }, "additionalProperties": true }, "EbayChallengeResponse": { "type": "object", "required": [ "challengeResponse" ], "properties": { "challengeResponse": { "type": "string", "description": "Hex SHA-256 of challengeCode + verificationToken + endpointURL." } } }, "MarketplaceDeletionNotification": { "type": "object", "description": "eBay account-deletion notification payload (subset Decionis reads).", "properties": { "metadata": { "type": "object", "properties": { "topic": { "type": "string" }, "schemaVersion": { "type": "string" } }, "additionalProperties": true }, "notification": { "type": "object", "properties": { "notificationId": { "type": "string" }, "data": { "type": "object", "properties": { "username": { "type": "string" }, "userId": { "type": "string" }, "eiasToken": { "type": "string" } }, "additionalProperties": true } }, "additionalProperties": true } }, "additionalProperties": true }, "DecisionDossierProofPacket": { "type": "object", "properties": { "service": { "type": "string" }, "protocol_version": { "type": "string" }, "packet_type": { "type": "string", "examples": [ "decionis.decision_dossier.proof_packet" ] }, "packet_version": { "type": "string" }, "issued_at": { "type": "string", "format": "date-time" }, "subject": { "type": "object", "properties": { "org_id": { "type": "string" }, "dossier_id": { "type": "string" } } }, "dossier": { "type": "object", "additionalProperties": true }, "policy_snapshot": { "type": [ "object", "null" ], "additionalProperties": true }, "ledger_anchor": { "type": "object", "additionalProperties": true }, "proof_bundle": { "type": [ "object", "null" ], "additionalProperties": true }, "verification": { "type": "object", "description": "signature_verified, policy_snapshot_verified, chain_integrity_verified, proof_bundle_verified, and overall (VERIFIED | PARTIAL | UNVERIFIED).", "additionalProperties": true }, "verify_instructions": { "type": "object", "additionalProperties": true } }, "additionalProperties": true }, "DecisionChainProofPacket": { "type": "object", "properties": { "service": { "type": "string" }, "protocol_version": { "type": "string" }, "packet_type": { "type": "string", "examples": [ "decionis.decision_chain.proof_packet" ] }, "packet_version": { "type": "string" }, "issued_at": { "type": "string", "format": "date-time" }, "subject": { "type": "object", "properties": { "org_id": { "type": "string" }, "chain_id": { "type": "string" } } }, "chain": { "type": "object", "additionalProperties": true }, "ledger_anchor": { "type": "object", "additionalProperties": true }, "links": { "type": "array", "items": { "type": "object", "additionalProperties": true } }, "overall": { "type": "string", "enum": [ "VERIFIED", "PARTIAL", "UNVERIFIED" ] }, "verify_instructions": { "type": "object", "additionalProperties": true } }, "additionalProperties": true } } } }