---
title: "Propose a link between two keys"
method: POST
path: "/v2/workspaces/{id}/correspondences"
tags: ["Correspondences"]
---

# Propose a link between two keys

`POST /v2/workspaces/{id}/correspondences`

## Request

- Base URL: `https://api.infolang.ai`
- URL: `https://api.infolang.ai/v2/workspaces/{id}/correspondences`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer
  - HTTP bearer

State that two refs are related, and how. `corresponds` is the only relation that is a join; `relates` is worth showing beside, `translates` is a rendering in another language or schema, and `conflicts` asserts the two are DIFFERENT things.

No authority floor: anyone may propose, and anyone may withdraw. Keep the returned `link` id — it is the only handle `bottom` accepts, and in an append-only log an unwithdrawable proposal is permanent.

`corresponds` is SAME ENOUGH TO JOIN ON and nothing more: not identity, and NOT TRANSITIVE (CR2). `a—b` and `b—c` never yield `a—c`. No read on this surface unions two subjects' beliefs, and none ever will — that would merge two facts a human never agreed were one.

Only an operator `identify` says two refs are ONE THING, and the gateway's own credential cannot clear that floor: an identity written through an ordinary credential is stored, stays auditable, and folds INERT. That is the design (memory proposes, never disposes), not a gap.

Even an effective `identify` is FORWARD-ONLY (CR3): it emits an alias pair for write-time normalization and rewrites no history. Both keys keep their own neighborhoods and their own belief folds forever.

A `conflicts` link contributes a `disputed` MARK and nothing else (CR1) — no status change on either side, nothing retracted, no auto-resolution.

`band` is PAYLOAD (K6/CR4): the fold is invariant under permuting every band in the log. Filter on it if you like; never rank on it, or a confidence score starts outranking a person.

There is NO delete. Withdrawing a link is `bottom`, an append.

Requires the `coord:write` scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an `il_*` machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying `coord:write` is still refused where the role does not permit it.

A credential with no scope record resolves to `LEGACY_DEFAULT`, which does NOT include `coord:write` — mint a key with it explicitly (`POST /v2/workspaces/{id}/keys`).

## Path parameters

- `id` string, required

## Request body

- object
  - `left` union, required
    - object
      - `space` 'subject' | 'entity' | 'inquiry' | 'assertion' | 'memory' | 'source', required
      - `id` string, required
    - object
      - `space` 'foreign', required
      - `id` object, required
        - `partner` string, required
        - `key` string, required
  - `right` union, required
    - object
      - `space` 'subject' | 'entity' | 'inquiry' | 'assertion' | 'memory' | 'source', required
      - `id` string, required
    - object
      - `space` 'foreign', required
      - `id` object, required
        - `partner` string, required
        - `key` string, required
  - `relation` 'corresponds' | 'relates' | 'translates' | 'conflicts', required
  - `band` 'proposed' | 'corroborated' | 'attested'
  - `note` string
  - `link` string, uuid

## Response `201`

The link id, and what the log actually recorded

- object
  - `link` string, required
  - `left` union, required
    - object
      - `space` 'subject' | 'entity' | 'inquiry' | 'assertion' | 'memory' | 'source', required
      - `id` string, required
    - object
      - `space` 'foreign', required
      - `id` object, required
        - `partner` string, required
        - `key` string, required
  - `right` union, required
    - object
      - `space` 'subject' | 'entity' | 'inquiry' | 'assertion' | 'memory' | 'source', required
      - `id` string, required
    - object
      - `space` 'foreign', required
      - `id` object, required
        - `partner` string, required
        - `key` string, required
  - `relation` string, required
  - `band` string, required
  - `note` string, required
  - `record` string, required
  - `authority` string, required
  - `appended` boolean, required

## Other responses

- `401`: Missing/invalid credential, or `credential_expired` — the credential is outside its `[not_before, expires_at)` window and must be replaced
- `403`: `insufficient_scope` — the credential's own scope set, or the caller's role on this workspace, does not cover the scope this route requires (the missing scope is named in the message). Or `forbidden` — the credential is not scoped to this workspace, or holds no grant on it
- `501`: The correspondence verbs are not compiled into this deployment (`kernel-verbs` is off upstream)

---

[API](https://skmtc.dev/infolang/apis/infolang-api.md) · [All operations](https://skmtc.dev/infolang/apis/infolang-api/llms.txt) · [OpenAPI document](https://skmtc.dev/infolang/apis/infolang-api/revisions/d04bf6de72c8?raw)