Execution evidence

Record one provider attempt and reconcile its outcome without trusting the caller

Requires the live PROCESSOR credential bound to the exact permit audience. The caller reports the stable ProviderSubmission, permit claim, provider payment reference, observation time and one bounded provider observation. That report is persisted only as CALLER_ASSERTED evidence. MandateShield then reads the bound Stripe PaymentIntent through the account's encrypted restricted-key connection or verifies the exact x402 transaction and canonical finalized chain evidence without trusting that report. Stripe verification reconstructs the permit-bound URL-encoded request-body digest and checks amount, received amount, currency, PaymentMethod, capture and confirmation modes, card method, provider request ID and canonical payee metadata; substitutions conflict and remain nonterminal. Only a matching PROVIDER_API_VERIFIED or CHAIN_FINALIZED terminal result permits autonomous COMMIT or RELEASE. Pending, unavailable, contradictory or unknown results return HTTP 202, remain fail-closed and are retried by the durable reconciliation worker. A caller observation, provider webhook or HTTP 200 alone never establishes terminal settlement. This caller-independent check is not an external audit or independent-organization certification.

post/api/v2/provider-submissions

Request

  • Base URL: https://mandateshield.com
  • URL: https://mandateshield.com/api/v2/provider-submissions
  • Auth: HTTP bearer

Request body

provider_submission_idstring required
permit_idstring required
claim_idstring required
payment_referencestring required
outcome'COMMITTED' | 'FAILED' | 'PENDING' | 'UNKNOWN' required

Caller observation only. It never permits a terminal transition until configured evidence is checked without trusting that observation.

occurred_atstring date-time required

Caller observation time. The hosted endpoint accepts only its bounded freshness window.

provider_observationobject

Optional bounded non-secret provider projection. Payment credentials, provider secrets and private keys are forbidden.

Response

Terminal provider evidence checked without trusting the caller was recorded and is eligible for autonomous authorization finalization

provider_submission_idstring required
permit_idstring required
state'PREPARED' | 'SUBMITTING' | 'ACKNOWLEDGED' | 'UNKNOWN' | 'SETTLED' | 'FAILED_CONFIRMED' | 'CONFLICT' | 'PENDING' required
payment_referencestring required
caller_evidence_recordedunknown required
independent_verificationboolean required

Legacy field name. True means MandateShield checked configured evidence without trusting the caller report; it does not mean verification by an independent organization, audit, certification, or provider adoption.

evidence_class'CALLER_ASSERTED' | 'FACILITATOR_SIGNED' | 'PROVIDER_API_VERIFIED' | 'CHAIN_FINALIZED' | 'UNRESOLVED' | 'LEDGER_DERIVED' required

PROVIDER_API_VERIFIED and CHAIN_FINALIZED are the current hosted terminal evidence classes checked without trusting the caller report. FACILITATOR_SIGNED is a retained evidence class for separately configured integrations and does not imply current provider/facilitator adoption. No class claims verification by an independent organization, audit or certification. LEDGER_DERIVED is used by execution receipts, not ProviderEvidence rows.

evidence_idstring required
outcome'COMMITTED' | 'FAILED_CONFIRMED' | 'UNKNOWN' required
terminal_transition_permittedboolean required
reconciliation_requiredboolean required
idempotent_replayboolean required
authorization_finalizedboolean required
final_authorization_state'COMMITTED' | 'RELEASED' | 'null' nullable required

Changes

No recorded changes to this operation across all 1 revision of this API.