PRprimitive
Roles and members

Decide a suspension

Keep, narrow or revoke one suspended or flagged item. Keeping it, and revoking an API key, needs the decider to cover it (revoking an uncovered key is refused with grant_forbidden, target_not_covered). Keeping an API key rotated (rotate: true, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with grant_forbidden (keys_manage_required or actor_access_changed) and nothing is rotated. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose suspensions.decide (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.

post/access-suspensions/{id}/decision

Request

  • Base URL
    https://api.primitive.dev/v1
  • URL
    https://api.primitive.dev/v1/access-suspensions/{id}/decision
  • Auth
    HTTP bearer

Path parameters

idstring uuid required

The id of the group, role, member, grant or suspension the path names.

Headers

Idempotency-Keystring

Optional client-supplied idempotency key. Retrying a request with the same key returns the original result instead of performing the action a second time; if omitted the server derives one from the canonical payload hash. Safe to retry network failures without duplicating side effects.

Request body

decision'keep' | 'narrow' | 'revoke' required
confirmboolean
rotateboolean

Response

Decide a suspension

successtrue required

Changes

No operation changes recorded.