---
title: "Browser-only explicit approval; never call from an agent"
method: POST
path: "/remote/operations/{id}/confirm"
---

# Browser-only explicit approval; never call from an agent

`POST /remote/operations/{id}/confirm`

## Request

- Base URL: `https://api.aifra.ru`
- URL: `https://api.aifra.ru/remote/operations/{id}/confirm`
- Auth: HTTP bearer

Requires exact Origin, Sec-Fetch-Site same-origin, X-Aifra-Csrf matching the host cookie and a private browser-generated management key in Authorization. Consumes a pending request once. Actual socket/trusted-ingress IP supplies create quota. Terms version must match current. Ambiguous results must not be retried.

## Path parameters

- `id` string, required

## Headers

- `X-Aifra-Csrf` string, required

## Request body

- object
  - `alias` string: Optional on create only. Normalized to lowercase ASCII letters, digits and inner hyphens; system names reserved. Omit for random URL. Not a private link.
  - `digest` string, required
  - `terms_version` string, required
  - `accept_terms` true, required
  - `anonymous_id` string, required

## Response `200`

Public receipt only

## Other responses

- `400`: Current terms not accepted
- `401`: Wrong management key
- `403`: CSRF/Origin failure
- `404`: Unknown operation
- `409`: Expired, claimed or wrong digest; preview_alias_unavailable alone allows manual retry with another name without reupload. Never replay uncertain results.
- `429`: Quota or rate limit

---

[API](https://skmtc.dev/aifra/apis/aifra-preview-api.md) · [All operations](https://skmtc.dev/aifra/apis/aifra-preview-api/llms.txt) · [OpenAPI document](https://skmtc.dev/aifra/apis/aifra-preview-api/revisions/276597d5361a?raw)