---
title: "Recover the current identity of an Accounts-owned enrollment"
method: POST
path: "/v1/internal/native-enrollments/status"
---

# Recover the current identity of an Accounts-owned enrollment

`POST /v1/internal/native-enrollments/status`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/internal/native-enrollments/status`
- Auth: HTTP bearer

Default off. Accounts authorizes the current owner/admin of the exact existing Commerce workspace and signs a command. Core checks current Accounts JWKS and the SYNCED human workspace projection; no org, membership, merchant ADMIN key or Marketplace purchase is created. A command lease lasts at most 30 seconds, with at most 5 seconds future clock skew. JSON only; no query, Origin or Cookie. command_id has immutable semantic content; retries may refresh only issued_at and authorization_expires_at. No route executes a commerce or payment transaction. Requires current workspace owner/admin and exact retained enrollment_id, without an old Microsoft proof or known connection ID. Recovers pending, active or revoked records. Historical provider observation time/guard flags never become fresh evidence. read_granted is computed from current persisted enrollment/grant and managed assignment eligibility; unavailable assignment authority reports false. No permission is created or renewed.

## Request body

- AccountsNativeEnrollmentStatusEnvelope
  - `payload` AccountsNativeEnrollmentStatusCommand, required
    - `version` 'accounts-native-enrollment-v1', required
    - `account_org_id` string, required
    - `account_workspace_id` string, required
    - `product` 'commerce', required
    - `workspace_environment` 'sandbox' | 'production', required
    - `command_id` string, uuid, required
    - `enrollment_id` string, uuid, required
    - `purpose` 'native_connection_enrollment', required
    - `account_user_id` string, required
    - `role` 'owner' | 'admin', required
    - `issued_at` string, date-time, required
    - `authorization_expires_at` string, date-time, required
    - `action` 'status', required
  - `evidence` AccountsNativeEnrollmentEvidence, required
    - `algorithm` 'Ed25519', required
    - `key_id` string, required
    - `payload_sha256` string, required
    - `signature` string, required

## Response `200`

Bounded enrollment metadata; execution_available remains false

- AccountsNativeEnrollmentRecoveryResult
  - `version` 'accounts-native-enrollment-v1', required
  - `account_org_id` string, required
  - `account_workspace_id` string, required
  - `product` 'commerce', required
  - `workspace_environment` 'sandbox' | 'production', required
  - `command_id` string, uuid, required
  - `enrollment_id` string, uuid, required
  - `connection_id` string, uuid, required
  - `connection_revision` integer, required
  - `platform` 'D365_BC', required
  - `tenant_id` string, uuid, required
  - `environment_name` string, required
  - `company_id` string, uuid, required
  - `execution_available` false, required
  - `status` 'recorded', required
  - `read_granted` boolean, required
  - `provider_read_observed_at` string, date-time, nullable, required
  - `guard_enabled` boolean, nullable, required
  - `guard_configured` boolean, nullable, required
  - `enrollment_status` 'pending' | 'active' | 'revoked', required

## Other responses

- `400`: Invalid bounded command or transport
- `401`: Dedicated Accounts service bearer required
- `403`: Current Accounts, identity or managed assignment authority denied
- `404`: Exact enrollment is not in the authorized workspace
- `409`: Command conflict, concurrent attempt or changed connection revision
- `413`: Command exceeds 8192 bytes
- `429`: Durable address or workspace request limit reached
- `503`: Enrollment disabled or required dependency unavailable

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)