---
title: "Read and verify an execution grant without consuming it"
method: GET
path: "/v1/authority/grants/{grantId}"
---

# Read and verify an execution grant without consuming it

`GET /v1/authority/grants/{grantId}`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/authority/grants/{grantId}`
- Auth: HTTP bearer

The handler of the deprecated alias `POST /v1/execution/verify-token`.
A GET carries no body, so the execution token is presented in the
`x-decionis-execution-token` header (required; never logged) and the
intent hash, optionally, as the `intent_hash` query parameter.

Verifies the token's Ed25519 signature, issuer and lifetime; that the
caller is authorised for the organisation the grant names (the caller's
own organisation for an organisation API key); that the token's `jti`
is `{grantId}` (otherwise 409 `GRANT_ID_MISMATCH`); and, when
`intent_hash` is supplied, that the grant is bound to it (otherwise 409
`GRANT_BINDING_MISMATCH`). The intent hash commits to the tenant,
actor, action and downstream target the alias checks field by field.
Reading a grant never authorizes execution: only a claim does.

## Query parameters

- `intent_hash` string

## Headers

- `x-decionis-execution-token` string, required

## Response `200`

Valid grant

- ExecutionTokenResponse
  - `valid` boolean, required
  - `should_execute` boolean: Present on pre-commit claim responses. Only true after current-state and Presence revalidation, an atomic nonce claim with durable evidence, and a final database-time claim-lease check.
  - `would_block` boolean: Present on pre-commit claim responses for Shadow diagnostics.
  - `verdict` 'APPROVE' | 'ESCALATE' | 'REJECT' | 'REVIEW': Deterministic pre-commit revalidation verdict.
  - `reason_codes` string[], required
  - `claims` ExecutionTokenClaims, required
    - `iss` string, required
    - `sub` string
    - `aud` string
    - `org_id` string, uuid, required
    - `dossier_id` string, required
    - `decision_id` string, required
    - `chain_id` string
    - `action` string, required
    - `decision` 'allow', required
    - `scope` 'execute', required
    - `binding` object, required
      - `intent_hash` string, required
      - `execution_binding_digest` string
      - `execution_payload_digest` string: Signed digest of the exact downstream request parameters.
      - `execution_payload_canonicalization_profile` string: Canonicalization profile used for execution_payload_digest.
      - `execution_nonce` string
      - `execution_correlation_id` string
      - `expected_effect_digest` string: Expected downstream effect commitment carried by the grant.
      - `authority_protocol_version` '1.0' | '1.0.0' | '1.1': Protocol semantics governing execution eligibility and effect evidence validation for this grant. Protocol 1.1 grants reject the deprecated legacy effect-evidence shape.
    - `jti` string, required
    - `iat` integer, required
    - `nbf` integer, required
    - `exp` integer, required
  - `claim_token` string, nullable
  - `claim_validated_at` string, date-time, nullable: Database time of the final execution-eligibility confirmation. Qualifying effect observations must not predate this boundary.
  - `claim_lease_expires_at` string, date-time, nullable
  - `claim_attestation` string, nullable: Present only on a live claim. A compact EdDSA JWS over `ClaimAttestationClaims`, verifiable against the execution-grant JWKS. Absent or null whenever `should_execute` is not true.
  - `evidence` object
  - `evidence_durably_queued` boolean: True when the canonical revalidation evidence is durably queued in the same transaction as the nonce transition. This does not by itself mean the Protocol Decision Chain append has completed.
  - `decision_chain_evidence_recorded` boolean: True when the queued evidence has already been acknowledged by the Protocol Decision Chain. False evidence remains recoverable when evidence_durably_queued is true.

## Other responses

- `400`: Missing `x-decionis-execution-token`, or an invalid grant id or query
- `401`: Structured API error
- `403`: Structured API error
- `409`: Grant invalid or expired, GRANT_ID_MISMATCH, or GRANT_BINDING_MISMATCH
- `429`: Structured API error
- `503`: Grant verification unavailable; no execution is authorized

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)