GRgraypass
canonical

Register a protected action

Create an action definition and its initial active policy in shadow mode.

post/api/v1/actions

Request

  • Base URL
    https://app.graypass.org (the document declares no server; this is the origin it was published from)
  • URL
    https://app.graypass.org/api/v1/actions
  • Auth
    HTTP bearer

Request body

allowed_audiencesstring[] required

Relying-party audience identifiers allowed to receive proofs for this action.

allowed_callersstring[]

Credential identifiers allowed to authorize this action. An empty list permits any eligible server credential in the same environment.

consequencestring required

Plain-language consequence if the wrong person performs the protected action.

context_schemaobject

JSON Schema object applied to authorization context. Include every business value that must be bound to approval.

keystring required

Stable dotted action key used by authorization, such as payout.destination.change.

namestring required

Customer-visible display name for the action or evaluation.

proof_ttl_secondsinteger

Proof lifetime in seconds, measured from issuance; the accepted range is 30-900 seconds.

resource_typestring

Customer-defined category of the protected resource, such as merchant.

risk_class'low' | 'elevated' | 'high' | 'critical'

Customer-selected consequence category for the action: low, elevated, high or critical.

Response

ProtectedAction in shadow mode with its initial active policy version.

active_policy_versioninteger nullable

Currently active policy version number, or null when no version is active.

allowed_audiencesstring[] required

Relying-party audience identifiers allowed to receive proofs for this action.

allowed_callersstring[] required

Credential identifiers allowed to authorize this action. An empty list permits any eligible server credential in the same environment.

consequencestring required

Plain-language consequence if the wrong person performs the protected action.

context_schemaobject required

JSON Schema object applied to authorization context. Include every business value that must be bound to approval.

created_atstring required

Creation time as an ISO 8601 timestamp.

environmentstring required

Environment identifier that scopes this record; sandbox and live resources are separate.

idstring required

Identifier of this record. Treat it as opaque and retain it for subsequent operations.

keystring required

Stable dotted action key used by authorization, such as payout.destination.change.

mode'test' | 'shadow' | 'enforce' required

Action evaluation mode. Test and shadow return decisions without enforceable proofs. An eligible enforce-mode allow can carry a proof.

namestring required

Customer-visible display name for the action or evaluation.

proof_ttl_secondsinteger required

Proof lifetime in seconds, measured from issuance; the accepted range is 30-900 seconds.

resource_typestring required

Customer-defined category of the protected resource, such as merchant.

risk_class'low' | 'elevated' | 'high' | 'critical' required

Customer-selected consequence category for the action: low, elevated, high or critical.

updated_atstring required

Most recent update time as an ISO 8601 timestamp.

Changes

No recorded changes to this operation across all 1 revision of this API.