---
title: "Read Decionis-managed Presence authorization status"
method: GET
path: "/v1/authority/escalations/{escalationId}"
---

# Read Decionis-managed Presence authorization status

`GET /v1/authority/escalations/{escalationId}`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/authority/escalations/{escalationId}`
- Auth: HTTP bearer

Returns tenant-scoped orchestration state without exposing Presence
credentials, invitation locators, authentication assertions, or biometric
material. A normal execution grant is present only at GRANT_READY, after
Decionis has independently verified Presence evidence and re-evaluated
current policy for the original exact intent.

## Response `200`

Current managed escalation state

- ManagedEscalationStatus
  - `escalation_id` string, required
  - `intent_id` string, uuid, required
  - `action_hash` string, required
  - `status` 'PENDING_PRESENCE' | 'PRESENCE_REQUESTED' | 'AWAITING_APPROVER' | 'PRESENCE_VERIFIED' | 'REAUTHORIZING' | 'GRANT_READY' | 'EXPIRED' | 'REJECTED' | 'BLOCKED' | 'CANCELLED' | 'FAILED', required
  - `outcome` 'ESCALATE_PENDING' | 'ALLOW' | 'BLOCK' | 'ERROR', required
  - `expires_at` string, date-time, required
  - `reason_codes` string[], required
  - `decision` ExecutionAuthorityDecision, required
    - `decision_id` string, required
    - `chain_id` string, nullable, required
    - `status` 'ALLOW' | 'BLOCK' | 'ESCALATE' | 'REVIEW_REQUIRED' | 'ERROR', required
    - `should_execute` boolean, required
    - `authority_classification` 'AUTHORITATIVE' | 'OBSERVATIONAL', required: Authority possessed by an artifact, independent of its verdict. Only AUTHORITATIVE artifacts may become execution-eligible.
    - `execution_eligible` boolean, required: True only for an AUTHORITATIVE ALLOW carrying an exact-action ExecutionBinding and executable grant.
    - `execution_binding_digest` string, nullable, required
    - `reason_codes` string[], required
    - `action_hash` string, required
    - `policy_version` string, nullable, required
    - `mode` 'SHADOW' | 'PARALLEL' | 'ENFORCEMENT' | 'null', nullable, required
    - `execution_token` string, nullable, required: Present only when status is ALLOW and should_execute is true.
    - `execution_token_jti` string, nullable, required: Single-use identifier of the issued execution token.
    - `execution_token_key_id` string, nullable, required: Identifier of the key that signed the issued execution token.
    - `execution_token_expires_at` string, date-time, nullable, required
    - `dossier_id` string, nullable, required
    - `dossier_sha256` string, nullable, required
    - `dossier_url` string, nullable, required
    - `approval_request_id` string, nullable, required
    - `ledger_entry_id` string, nullable, required
    - `managed_escalation` ManagedEscalationReference: Non-authorizing status locator. It is not an ExecutionBinding, claim token, invitation, or executable capability.
      - `outcome` 'ESCALATE_PENDING' | 'ALLOW' | 'BLOCK' | 'ERROR', required
      - `escalation_id` string, required
      - `intent_id` string, uuid, required
      - `status` 'PENDING_PRESENCE' | 'PRESENCE_REQUESTED' | 'AWAITING_APPROVER' | 'PRESENCE_VERIFIED' | 'REAUTHORIZING' | 'GRANT_READY' | 'EXPIRED' | 'REJECTED' | 'BLOCKED' | 'CANCELLED' | 'FAILED', required
      - `expires_at` string, date-time, required
      - `reason_codes` string[], required
    - `verification` DecisionDossierVerificationEnvelope: The share-safe way to verify a Decision Dossier without an account: a page and an API URL carrying an expiring share-link capability (`?sig=`, `&exp=`) that gates access, and the pointers to the Ed25519 proof that establishes authenticity. The capability is an access gate, never proof; the signatures in the proof bundle are the proof.
      - `verification_page_url` string, uri, required: The public page that runs the verification for anyone who opens it.
      - `verification_url` string, uri, required: The public verify route, `/v1/public/decision-dossiers/{dossier_id}/verify`, with its capability.
      - `verification_api_path` string
      - `signature` string, required
      - `signature_algorithm` string
      - `signature_scheme` 'hmac-v1' | 'hmac-v2-org-scoped'
      - `link_expires_at` string, date-time, nullable
      - `link_exp` string, nullable: The expiry in epoch seconds, as it appears in the link.
      - `asymmetric_proof` object, nullable
      - `asymmetric_proof_bundle` object, nullable
    - `escalation_requirement` EscalationRequirement: Where an ESCALATE goes: which authority the policy requires (its kind and role, never a person) and who proves that person, by which method. The runtime holding the intent hands the cardholder's tap to the provider named here and resumes with the attestation; a bank role goes to Decionis Presence. Only a fresh evaluation with the proof as evidence can turn the hold into a grant.
      - `requirement_id` string, nullable, required: The issued Presence requirement's id when one was issued (a managed escalation); null for a direct one.
      - `expires_at` string, date-time, required
      - `selector` object, nullable, required
        - `kind` 'ROLE' | 'PRINCIPAL', required
        - `role_id` string
      - `verification` object, nullable, required
        - `provider` string, required: `decionis` for Decionis Presence; otherwise the admitted presence provider's id.
        - `methods` string[], required
        - `level` 'STANDARD' | 'HIGH_CONFIDENCE', required
    - `permit_id` string, uuid: Present only when the request named a `permit` executor and a grant was issued: the grant's jti (`execution_token_jti`), the `{grantId}` of `/v1/authority/grants/{grantId}`.
    - `intent_sha256` string: Present with `permit_id`: the intent hash (`action_hash`) as bare lowercase hex, written as `dossier_sha256` is.
    - `expires_at` string, date-time: Present with `permit_id`: when the grant stops being claimable (`execution_token_expires_at`).

## Other responses

- `401`: Structured API error
- `403`: Structured API error
- `404`: Structured API error
- `503`: Structured API error

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)