Execute an externally initiated route exposure read

Executes an explicitly registered external-read route exposure. The caller supplies the authenticated Party context, governed canonical fields already eligible for projection, governance metadata and optional cursor state. VDX evaluates policy server-side before any grant or throttle consumption. The response is an approved governed view with manifest, policy lineage, selected fields, and cursor state. This endpoint does not expose internal connector records, Party tables, vault rows, or semantic stores directly.

post/route/exposures/{exposureDescriptorId}/read

Path parameters

exposureDescriptorIdstring required

Stable identifier of an externally callable route exposure descriptor.

Example:proof-vault-read-exposure

Stable identifier of a route exposure descriptor.

Request body

authMethodstring required

Auth or trust method accepted by the exposure descriptor.

canonicalFieldsobject required

Canonical field values eligible for projection through the governed exposure.

Example request

{
  "authMethod": "bearer",
  "callerParty": {
    "partyId": "party-consumer"
  },
  "canonicalFields": {
    "proof.status": "valid"
  },
  "governance": {
    "classification": "confidential",
    "legalBasis": "dpv:Contract",
    "purpose": "dpv:Audit",
    "auditCategory": "EXTERNAL_EXCHANGE"
  },
  "cursor": {
    "value": "page-1"
  }
}

Response

Governed external-read view.

statestring required

runIdstring uuid

Stable identifier for a connector route or operation run.

exposureDescriptorIdstring required

Stable identifier of an externally callable route exposure descriptor.

logicalConnectionBindingIdstring required

Stable identifier of a tenant, OU, brand, legal-entity, or channel usage binding for a physical connector instance.

policyDecisionIdstring required

selectedFieldPathsstring[] required

sourceSurfacestring

Example response

{
  "state": "APPROVED_VIEW",
  "runId": "9a785884-63ea-4b07-9976-264a1fc595f1",
  "exposureDescriptorId": "proof-vault-read-exposure",
  "logicalConnectionBindingId": "brand-a-proof-vault",
  "policyDecisionId": "policy-external-read",
  "selectedFieldPaths": [
    "proof.status"
  ],
  "manifest": {
    "manifestId": "manifest-external-read",
    "destinationIdentity": "party-consumer",
    "selectedFields": [
      {
        "fieldPath": "proof.status",
        "integrityHash": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
      }
    ],
    "mappingVersion": "external-read:proof-vault-read",
    "mappingProvenance": "route-exposure-subset",
    "policyDecisionId": "policy-external-read",
    "retentionProfileId": "retention-proof",
    "manifestHash": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
  },
  "cursor": {
    "value": "page-1",
    "metadata": {
      "owner_team": "people-ops",
      "domain": "employee-licensing"
    }
  },
  "sourceSurface": "route-exposure"
}

Changes

Changed in 1 of the 2 revisions of this API.412

Jul 17, 202660cb8c70871b412See the full diff
- ▲
  added the pattern ^sha256:[0-9a-f]{64}$ to the request property governance/integrity/canonicalPayloadHash
  request-property-pattern-added
- ▲
  added the pattern ^sha256:[0-9a-f]{64}$ to the request property governance/integrity/originalPayloadHash
  request-property-pattern-added
- ▲
  added the pattern ^sha256:[0-9a-f]{64}$ to the request property governance/integrity/outputManifestHash
  request-property-pattern-added
- ▲
  added the pattern ^sha256:[0-9a-f]{64}$ to the request property governance/integrity/transformationHash
  request-property-pattern-added
- ●
  removed the request property policyDecision
  request-property-removed
- ○
  the manifest/manifestHash response's property pattern ^sha256:[0-9a-f]{64}$ was added for the status 200
  response-property-pattern-added
- ○
  the manifest/selectedFields/items/integrityHash response's property pattern ^sha256:[0-9a-f]{64}$ was added for the status 200
  response-property-pattern-added

Full history