--- title: "Read an authorization trace" method: GET path: "/api/v1/authorizations/{authorization_id}" tags: ["canonical"] --- # Read an authorization trace `GET /api/v1/authorizations/{authorization_id}` ## Request - Base URL: `https://app.graypass.org` (the document declares no server; this is the origin it was published from) - URL: `https://app.graypass.org/api/v1/authorizations/{authorization_id}` - Auth: HTTP bearer Retrieve the stored authorization identified by the request path. To resolve a challenge or review child, fetch the resulting child authorization ID explicitly. ## Path parameters - `authorization_id` string, required ## Response `200` Full trace including original binding, parent relation and nested challenge/proof/review/outcome state. - AuthorizationTrace: Server-readable record of the original request binding, decision and subsequent challenge, proof, review and outcome state. - `action` string, required: Registered action key, such as payout.destination.change. - `action_hash` string, required: SHA-256 digest binding the canonical authorization material. Compare it with the hash computed from the original server-held request. - `actor` string, required: Bound human actor identifier. - `actor_type` 'human', required: Bound actor category; only human is supported. - `assurance` AssuranceProfile, required: Server assessment of available evidence for one subject and session. It contains no calibrated confidence score. - `active_seconds` number: Duration of accepted active evidence in seconds. - `assessed_at` string, required: Assessment time as an ISO 8601 timestamp. - `claims` AssuranceClaim[], required: Individual assurance claims with their own status and limitations. - `claim` string, required: Claim name, such as operator_continuity or human_presence. Capability availability is separately reported by metadata. - `coverage` 'none' | 'sparse' | 'partial' | 'sufficient', required: Evidence-coverage category: none, sparse, partial or sufficient. Describes the amount and variety of accepted evidence. - `evidence_refs` string[]: Opaque references to the evidence supporting this claim. - `freshness_ms` integer, nullable: Age of the relevant evidence in milliseconds; null when freshness cannot be established. - `limitations` string[]: Applicable limitations that must accompany interpretation of the result. - `reason_codes` string[]: Stable reason identifiers explaining acceptance, limitations or a decision; resolve them in the reason-code catalog. - `status` 'confirmed' | 'likely' | 'uncertain' | 'not_confirmed' | 'detected' | 'not_detected' | 'not_present' | 'insufficient_evidence' | 'unsupported', required: Permitted statuses for a named assurance claim. Read the status with the claim definition, coverage, freshness, and assessment context. - `coverage` 'none' | 'sparse' | 'partial' | 'sufficient', required: Evidence-coverage category: none, sparse, partial or sufficient. Describes the amount and variety of accepted evidence. - `evidence_windows` integer: Number of accepted, non-overlapping evidence windows accounted for in this session or profile. - `feature_schema_version` string, required: Version identifier for the feature representation used by the session or assessment. - `freshness_ms` integer, nullable: Age of the relevant evidence in milliseconds; null when freshness cannot be established. - `id` string, required: Identifier of this record. Treat it as opaque and retain it for subsequent operations. - `insufficient_evidence` boolean, required: True when evidence is insufficient for the assessment’s supported claims. - `limitations` string[]: Applicable limitations that must accompany interpretation of the result. - `modalities_present` string[]: Names of observed evidence modalities included in coverage accounting. - `model_version` string, required: Version identifier for the model used in this assessment. Retain it when comparing assessment results. - `rule_version` string, required: Version identifier for the assurance rules used in this assessment. - `session` string, nullable: Observation or enrollment session identifier, as required by the operation. - `subject` string, required: Pseudonymous subject identifier in the authenticated tenant and environment. - `audience` string, required: Expected relying-party audience. It must be permitted by the action and independently known to the verifier. - `challenge` ChallengeTrace: Challenge lifecycle state embedded in an authorization trace. - `completed_at` string, nullable: Completion time as an ISO 8601 timestamp, or null before completion. - `expires_at` string, required: Expiry time as an ISO 8601 timestamp. Use the capability before this time; obtain a fresh one afterward. - `id` string, required: Identifier of this record. Treat it as opaque and retain it for subsequent operations. - `method_used` string, nullable: Method used to complete the challenge, or null before completion. - `status` string, required: Lifecycle state of this record; use the operation-specific values listed in the schema. - `strength` string, nullable: Recorded challenge assurance label. Distinguishes action-bound passkey confirmation from sandbox simulation. - `context_digest` string, required: Digest of the context binding. Render your independently retained business details for user confirmation. - `decided_at` string, required: Decision time as an ISO 8601 timestamp. - `decision` 'allow' | 'challenge' | 'hold' | 'deny', required: Policy result: allow, challenge, hold or deny. Inspect mode and proof requirements before performing any business mutation. - `id` string, required: Identifier of this record. Treat it as opaque and retain it for subsequent operations. - `latency_ms` integer, required: Server-recorded decision latency in milliseconds. - `mode` 'test' | 'shadow' | 'enforce', required: Action evaluation mode. Test and shadow return decisions without enforceable proofs. An eligible enforce-mode allow can carry a proof. - `outcome` string, nullable: Business outcome reported by the customer application, with supporting evidence maintained by the customer. - `outcome_reported_at` string, nullable: Recorded business-outcome time as an ISO 8601 timestamp, or null. - `parent` string, nullable: Parent authorization identifier for a challenge or review child; null for an original request. - `policy_version` integer, nullable: Immutable policy version number evaluated for this decision. - `proof` ProofTrace: Signed proof and current state associated with an authorization trace. - `compact` string, nullable: Compact JWS when available; keep it out of logs and browser-controlled execution decisions. - `expires_at` string, nullable: Expiry time as an ISO 8601 timestamp. Use the capability before this time; obtain a fresh one afterward. - `id` string, required: Identifier of this record. Treat it as opaque and retain it for subsequent operations. - `status` string, required: Lifecycle state of this record; use the operation-specific values listed in the schema. - `proof_id` string, nullable: Proof identifier (jti), or null when no proof was issued. - `reason_codes` string[], required: Stable reason identifiers explaining acceptance, limitations or a decision; resolve them in the reason-code catalog. - `requested_at` string, required: Recorded request time as an ISO 8601 timestamp in the trace, distinct from the caller’s Unix-seconds input. - `resource_digest` string, required: One-way digest of the resource binding. - `resource_type` string, required: Customer-defined category of the protected resource, such as merchant. - `review_authorization_id` string, nullable: Child authorization produced by an approved review, or null. - `review_status` string, nullable: Recorded manual-review state, or null when no review occurred. - `reviewed_at` string, nullable: Manual-review time as an ISO 8601 timestamp, or null. - `reviewed_by` string, nullable: Identifier of the credential attributed to the manual review, or null. - `subject` string, required: Pseudonymous subject identifier in the authenticated tenant and environment. ## Other responses - `422`: The canonical handler returns a Problem for invalid input; correct the request before retrying. --- [API](https://skmtc.dev/graypass/apis/graypass-api.md) - [All operations](https://skmtc.dev/graypass/apis/graypass-api/llms.txt) - [OpenAPI document](https://skmtc.dev/graypass/apis/graypass-api/revisions/5f9ab64fdfdb?raw)