Project Transfers

Accept a pending project transfer (the recipient, whatever its address)

The ONE completion route. The row's recipient kind picks the credential: a wallet-addressed transfer is accepted by the to_wallet's SIWX signature; an email-addressed transfer is accepted by a sign-in session (or SIWX principal) whose verified email matches, into an org it owns (org_id) or, with org_id omitted, a newly created wallet-less org. Both paths run the same atomic transaction: ownership flip + grant/CI revoke + notification enqueue (one per recipient) + secrets-rotation advisory stamp + audit row, all in one COMMIT, and both return the project's anon_key + service_key. Routes scope by transfer_id (NOT project_id) — stale-offer safe. If the preview carries retain_member, accept_retained_member: true keeps the sender on as a developer of the receiving org; default false severs access. Pre-condition codes: CONTACT_EMAIL_NOT_VERIFIED (412), RECIPIENT_ORGANIZATION_NOT_ACTIVE (409), PROJECT_NOT_TRANSFERABLE (409), PROJECT_OWNER_CHANGED (409), TRANSFER_EXPIRED (410). Uses clock_timestamp() for the expiry check (NOT NOW() — would be stale under lock waits).

post/agent/v1/transfers/{transfer_id}/accept

Request

  • Base URL: https://api.run402.com
  • URL: https://api.run402.com/agent/v1/transfers/{transfer_id}/accept
  • Auth: one of:
    • API key in header SIGN-IN-WITH-X
    • HTTP bearer

Path parameters

transfer_idstring uuid required

Headers

SIGN-IN-WITH-Xstring required

SIWX auth header — base64-encoded JSON payload containing a signed CAIP-122 (EIP-4361) message. See https://docs.x402.org/extensions/sign-in-with-x.

Request body

org_idstring uuid

Email-addressed transfers only. An org the recipient owns to receive the project; omit to create a new wallet-less org.

accept_retained_memberboolean

Email-addressed transfers only. Opt-in. When the preview carries retain_member, true keeps the sender on as a developer of the receiving org; default false severs access.

Response

Accept succeeded (ownership flipped). A wallet-addressed row returns AcceptTransferResponse; an email-addressed row returns {status: 'accepted', project_id, to_org_id, created_new_org, retained_member_principal_id, credentials_revoked, credentials_issued}. Both carry anon_key + service_key.

project_idstring
from_walletstring
to_walletstring
new_org_idstring uuid nullable
completed_atstring date-time
secrets_rotation_advisedtrue
secret_names_inheritedstring[]

Names of every secret currently on the project. Names ONLY — values transferred with the project but are not returned here. The persistent secrets_rotation_advised_at advisory on the project prompts B to re-write each one.

secrets_count_inheritedinteger
github_repo_notestring
ci_bindings_suspendedinteger

Count of the prior owner's CI/OIDC (ci_oidc) bindings revoked by this accept. When > 0, push-to-deploy is suspended until the new owner re-links CI.

ci_bindings_notestring

Present only when ci_bindings_suspended > 0: explains that CI/OIDC bindings were revoked and how to re-link (run402 ci link github / POST /ci/v1/bindings).

Changes

No recorded changes to this operation across all 1 revision of this API.