---
title: "Resolve the current credential's authoritative product context"
method: POST
path: "/v1/auth/credential-context"
---

# Resolve the current credential's authoritative product context

`POST /v1/auth/credential-context`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/auth/credential-context`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Returns the authenticated credential class and exact organization, role and scopes. Accounts owns OAuth and workspace issuance; Core consumes its signed purchased-workspace projection and never turns this response into a new OAuth or organization key. V1 base3 stays unchanged. V2 adds only its recognized profile/consent metadata. V3 privately adds oauth_authority and the existing signed oauth_source_authority for request-scoped product transport. The private evidence is never returned in MCP tools or persisted in reports. Service credentials are refused. Data and connected extensions are default off and require their exact freshly consented profiles.

## Request body

- object

## Response `200`

Bounded private result

- object
  - `authority` 'org_api_key' | 'accounts_oauth' | 'platform' | 'onboarding', required
  - `org_id` string, uuid, nullable, required
  - `role` unknown, required
  - `scopes` string[], required
  - `api_key_id` string, uuid, nullable, required
  - `onboarding_scope` 'pilot_setup'
  - `oauth_profile` 'commerce'
  - `oauth_resource` string, uri
  - `oauth_grant_id` string, uuid
  - `oauth_profile_version` unknown
  - `oauth_consent` object
    - `consent_id` string, uuid, required
    - `consent_text_version` 'commerce-data-consent-v1' | 'commerce-connected-consent-v1', required
    - `consent_sha256` string, required
  - `oauth_authority` CommerceConnectedAuthority
    - `version` 'commerce-connected-authority-v1', required
    - `account_user_id` string, required
    - `account_org_id` string, required
    - `workspace_id` string, required
    - `membership_id` string, required
    - `entitlement_id` string, required
    - `account_role` 'owner' | 'admin' | 'developer', required
    - `provider_tenant_id` string, uuid, required
    - `subscription_id` string, uuid, required
    - `source_revision` integer, required
    - `source_plan` object, required
      - `publisher_id` string, required
      - `offer_id` string, required
      - `plan_id` string, required
    - `supported_sources` string[], required
    - `expires_at` string, date-time, required
    - `history_assessment_limit_monthly` integer, nullable
  - `oauth_source_authority` CommerceConnectedSourceAuthority
    - `payload` object, required
      - `version` 'accounts-commerce-source-v3', required
      - `purpose` 'commerce_oauth_projection', required
      - `resource` string, uri, required
      - `oauth_grant_id` string, uuid, required
      - `account_sha256` string, required
      - `source_org_id` string, uuid, required
      - `provider` 'microsoft', required
      - `subscription_id` string, uuid, required
      - `publisher_id` string, required
      - `offer_id` string, required
      - `plan_id` string, required
      - `source_entitlement` object, required
        - `entitlement_id` string, required
        - `product` string, required
        - `product_plan` string, required
        - `revision` integer, required
        - `environment` 'production', required
        - `status` 'active', required
      - `issued_at` string, date-time, required
      - `expires_at` string, date-time, required
      - `provider_tenant_id` string, uuid, required
      - `authorization` object, required
        - `profile_version` 3, required
        - `client_id` string, required
        - `scopes` unknown[], required
          - unknown
        - `consent_id` string, uuid, required
        - `consent_text_version` 'commerce-connected-consent-v1', required
        - `consent_sha256` string, required
        - `consented_at` string, date-time, required
        - `account_role` 'owner' | 'admin' | 'developer', required
        - `supported_sources` string[], required
    - `evidence` object, required
      - `algorithm` 'Ed25519', required
      - `key_id` string, required
      - `payload_sha256` string, required
      - `signature` string, required
  - `initial_policy` CommerceInitialPolicy
    - `version` 'commerce-onboarding-shadow-v1', required
    - `bundle_id` string, uuid, required
    - `mode` 'SHADOW', required
    - `source` 'accounts_commerce_onboarding', required
    - `policy_digest` string, required

## Other responses

- `400`: Invalid, oversized or conflicting request fields
- `401`: Authentication required
- `403`: Current signed authority, source, scope, role or company permission denied
- `404`: Authorized source, document or evidence unavailable
- `409`: Exact source, policy, evidence or idempotency binding changed; an uncertain write is never retried
- `429`: Request rate limit reached
- `503`: Default-off capability or required dependency unavailable

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)