---
title: "Resume a flow blocked on a human step"
method: POST
path: "/v1/actions/resume"
tags: ["Agent"]
---

# Resume a flow blocked on a human step

`POST /v1/actions/resume`

## Request

- Base URL: `https://api.spacefast.com`
- URL: `https://api.spacefast.com/v1/actions/resume`
- Auth: none declared

Polls a flow that returned a `requiresAction` envelope, using its continuation token. Returns `pending` (keep polling), `completed` (the one-time result is redeemed), or `denied`/`expired`. This is one generalized path for every `requiresAction` flow.

## Request body

- object
  - `continuationToken` string, required: Continuation token from a `requiresAction` envelope. Body-only, never a URL.

## Response `200`

Response for status 200

- object
  - `$schema` string, uri: Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.
  - `data` union, required: Consistent resume result across flows. Keep polling on `pending`. Read the one-time payload on `completed`. Stop on `denied` or `expired`.
    - object
      - `status` 'pending', required
      - `requiresAction` object, required: The human step is still incomplete. Wait `pollAfterSeconds` and resume again with the same token.
        - `actionType` 'device_authorization' | 'confirmation' | 'elevation', required: Stable identifier for the out-of-band step that blocks the flow.
        - `instruction` string, required: The step a person must complete out of band.
        - `url` string, uri, nullable: Where to send the human to complete the step, when a destination exists.
        - `pollUrl` string, uri: Where to POST the continuationToken to poll this flow: `/v1/actions/resume`.
        - `continuationToken` string, required: Short-lived, principal-scoped capability for this flow. Present it to POST /v1/actions/resume to poll and complete. Single-use on completion. A secret: never log it.
        - `pollAfterSeconds` integer, required: Minimum seconds to wait before calling resume again.
        - `expiresAt` string, date-time, required: Deadline for the human step. Resume after this returns terminal `expired`; the token survives a short grace so resume can say so, but the flow can no longer be redeemed.
    - object
      - `status` 'completed', required
      - `actionType` 'device_authorization' | 'confirmation' | 'elevation', required: Stable identifier for the out-of-band step that blocks the flow.
      - `result` object, required: The flow returns this result one time. Device authorization returns an API key. Confirmation returns an action receipt. Elevation returns a lease receipt.
    - object
      - `status` 'denied', required
      - `actionType` 'device_authorization' | 'confirmation' | 'elevation', required: Stable identifier for the out-of-band step that blocks the flow.
      - `message` string, required
    - object
      - `status` 'expired', required
      - `actionType` 'device_authorization' | 'confirmation' | 'elevation', required: Stable identifier for the out-of-band step that blocks the flow.
      - `message` string, required

## Other responses

- `default`: Problem details (RFC 9457). Any 4xx/5xx response is one `application/problem+json` document.

---

[API](https://skmtc.dev/spacefast/apis/spacefast-api.md) · [All operations](https://skmtc.dev/spacefast/apis/spacefast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spacefast/apis/spacefast-api/revisions/bd165bc7c983?raw)