---
title: "Find real-world actions that bypassed the gate"
method: POST
path: "/v1/reconcile"
tags: ["Receipts"]
---

# Find real-world actions that bypassed the gate

`POST /v1/reconcile`

## Request

- Base URL: `https://ratchetgate.com`
- URL: `https://ratchetgate.com/v1/reconcile`
- Auth: HTTP bearer

Post the idempotency keys (or vendor references you recorded in `result`) for actions your vendor says happened. Returns which ones Ratchet authorised and which it has never seen. The unmatched ones are paths in your system that did not ask before acting.

## Request body

- object
  - `effect_type` string, required
  - `keys` string[], required: The keys your vendor recorded. Which key space they are in depends on `key_space`.
  - `key_space` 'idempotency' | 'vendor': Which keys you are posting. `idempotency` (the default) means your own keys. `vendor` means the rtk_ keys Ratchet derived and you sent onward — what a vendor like Stripe actually recorded. Posting vendor keys as `idempotency` reports everything as ungated, because they are different key spaces.
  - `window_days` integer: Only meaningful with key_space=vendor: how far back to draw candidate effects from when deriving keys to match against.
  - `vendor` string: Only meaningful with key_space=vendor. The vendor profile whose key length was applied when the key was issued; keys are truncated per vendor, so the wrong profile will not match.

## Response `200`

Default Response

- object

## Other responses

- `400`: Invalid request.
- `401`: Missing or invalid API key.
- `402`: Insufficient prepaid credit.
- `403`: Scope, policy, or budget refusal.
- `404`: Not found.
- `409`: Conflicting state or idempotency-key reuse.
- `413`: Payload too large.
- `429`: Rate limit exceeded.

---

[API](https://skmtc.dev/ratchetgate/apis/ratchet-api.md) · [All operations](https://skmtc.dev/ratchetgate/apis/ratchet-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ratchetgate/apis/ratchet-api/revisions/5712f33c692f?raw)