Read and verify an execution grant without consuming it

The handler of the deprecated alias POST /v1/execution/verify-token. A GET carries no body, so the execution token is presented in the x-decionis-execution-token header (required; never logged) and the intent hash, optionally, as the intent_hash query parameter.

Verifies the token's Ed25519 signature, issuer and lifetime; that the caller is authorised for the organisation the grant names (the caller's own organisation for an organisation API key); that the token's jti is {grantId} (otherwise 409 GRANT_ID_MISMATCH); and, when intent_hash is supplied, that the grant is bound to it (otherwise 409 GRANT_BINDING_MISMATCH). The intent hash commits to the tenant, actor, action and downstream target the alias checks field by field. Reading a grant never authorizes execution: only a claim does.

get/v1/authority/grants/{grantId}

Request

  • Base URL: https://api.decionis.com
  • URL: https://api.decionis.com/v1/authority/grants/{grantId}
  • Auth: HTTP bearer

Query parameters

intent_hashstring

Headers

x-decionis-execution-tokenstring required

The execution token, as issued. Redacted from request logs.

Response

Valid grant

validboolean required
should_executeboolean

Present on pre-commit claim responses. Only true after current-state and Presence revalidation, an atomic nonce claim with durable evidence, and a final database-time claim-lease check.

would_blockboolean

Present on pre-commit claim responses for Shadow diagnostics.

verdict'APPROVE' | 'ESCALATE' | 'REJECT' | 'REVIEW'

Deterministic pre-commit revalidation verdict.

reason_codesstring[] required
claim_tokenstring nullable
claim_validated_atstring date-time nullable

Database time of the final execution-eligibility confirmation. Qualifying effect observations must not predate this boundary.

claim_lease_expires_atstring date-time nullable
claim_attestationstring nullable

Present only on a live claim. A compact EdDSA JWS over ClaimAttestationClaims, verifiable against the execution-grant JWKS. Absent or null whenever should_execute is not true.

evidenceobject
evidence_durably_queuedboolean

True when the canonical revalidation evidence is durably queued in the same transaction as the nonce transition. This does not by itself mean the Protocol Decision Chain append has completed.

decision_chain_evidence_recordedboolean

True when the queued evidence has already been acknowledged by the Protocol Decision Chain. False evidence remains recoverable when evidence_durably_queued is true.

Changes

No recorded changes to this operation across all 1 revision of this API.