SPsphereon-opensource
RouteExposures

Execute an externally initiated route exposure read

Changed on

Executes an explicitly registered external-read route exposure. The caller supplies the authenticated Party context, governed canonical fields already eligible for projection, governance metadata and optional cursor state. VDX evaluates policy server-side before any grant or throttle consumption. The response is an approved governed view with manifest, policy lineage, selected fields, and cursor state. This endpoint does not expose internal connector records, Party tables, vault rows, or semantic stores directly.

post/route/exposures/{exposureDescriptorId}/read

Request

Path parameters

exposureDescriptorIdstring required

Stable identifier of an externally callable route exposure descriptor.

Example:proof-vault-read-exposure

Stable identifier of a route exposure descriptor.

Request body

authMethodstring required

Auth or trust method accepted by the exposure descriptor.

canonicalFieldsobject required

Canonical field values eligible for projection through the governed exposure.

Example request

{
  "authMethod": "bearer",
  "callerParty": {
    "partyId": "party-consumer"
  },
  "canonicalFields": {
    "proof.status": "valid"
  },
  "governance": {
    "classification": "confidential",
    "legalBasis": "dpv:Contract",
    "purpose": "dpv:Audit",
    "auditCategory": "EXTERNAL_EXCHANGE"
  },
  "cursor": {
    "value": "page-1"
  }
}

Response

Governed external-read view.

statestring required
runIdstring uuid

Stable identifier for a connector route or operation run.

exposureDescriptorIdstring required

Stable identifier of an externally callable route exposure descriptor.

logicalConnectionBindingIdstring required

Stable identifier of a tenant, OU, brand, legal-entity, or channel usage binding for a physical connector instance.

policyDecisionIdstring required
selectedFieldPathsstring[] required
sourceSurfacestring

Example response

{
  "state": "APPROVED_VIEW",
  "runId": "9a785884-63ea-4b07-9976-264a1fc595f1",
  "exposureDescriptorId": "proof-vault-read-exposure",
  "logicalConnectionBindingId": "brand-a-proof-vault",
  "policyDecisionId": "policy-external-read",
  "selectedFieldPaths": [
    "proof.status"
  ],
  "manifest": {
    "manifestId": "manifest-external-read",
    "destinationIdentity": "party-consumer",
    "selectedFields": [
      {
        "fieldPath": "proof.status",
        "integrityHash": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
      }
    ],
    "mappingVersion": "external-read:proof-vault-read",
    "mappingProvenance": "route-exposure-subset",
    "policyDecisionId": "policy-external-read",
    "retentionProfileId": "retention-proof",
    "manifestHash": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
  },
  "cursor": {
    "value": "page-1",
    "metadata": {
      "owner_team": "people-ops",
      "domain": "employee-licensing"
    }
  },
  "sourceSurface": "route-exposure"
}

Changes

  • 60cb8c70871bRevision changes
    • breaking

      added the pattern ^sha256:[0-9a-f]{64}$ to the request property //

    • breaking

      added the pattern ^sha256:[0-9a-f]{64}$ to the request property //

    • breaking

      added the pattern ^sha256:[0-9a-f]{64}$ to the request property //

    • breaking

      added the pattern ^sha256:[0-9a-f]{64}$ to the request property //

    • warning

      removed the request property

    • info

      the / response's property pattern ^sha256:[0-9a-f]{64}$ was added for the status

    • info

      the /// response's property pattern ^sha256:[0-9a-f]{64}$ was added for the status