Cotal
DocsAPI Reference

Retire an interactive lifecycle

POST
/interactive-lifecycle/retire

Retire one exact interactive actor lifecycle before rotating or deleting its grant. Unknown actors return 404 and a mismatched current lifecycle returns 409. Refusals before the retirement barrier begins carry outcome not-executed. A later failure without an outcome must be treated as unknown.

Authorization

HostCapability
headerAuthorizationBearer <token>

Exact exchange capability from the owner-private auth-service discovery record. This is not an IdP JWT or actor bearer.

Request Body

application/json
  1. body
owner*string
Match^u_[a-z2-7]{26}$
actor*string
Match^[A-Za-z0-9_]+$
Length1 <= length
lifecycleUid*string
Match^[a-z0-9]{26,32}$

Response Body

The host decision completed.

application/json
  1. response
retired*boolean
lifecycleUid*string
Match^[a-z0-9]{26,32}$
notStarted?boolean
alreadyRetired?boolean
Example Request
curl -X POST 'http://127.0.0.1:12345/interactive-lifecycle/retire' \  -H 'Content-Type: application/json' \  -d '{  "owner": "string",  "actor": "string",  "lifecycleUid": "string"}'
Example Response
{  "retired": true,  "lifecycleUid": "string",  "notStarted": true,  "alreadyRetired": true}

See the HTTP interface overview for authentication and access requirements.

Complete HTTP contract

Endpoint

POST /interactive-lifecycle/retire

Retire one exact interactive actor lifecycle before rotating or deleting its grant. Unknown actors return 404 and a mismatched current lifecycle returns 409. Refusals before the retirement barrier begins carry outcome not-executed. A later failure without an outcome must be treated as unknown.

Parameters

No operation parameters.

Request body

The request uses the schema below.

Required: yes.

Content type: application/json.

{
  "$ref": "#/components/schemas/LifecycleTarget"
}

Responses

HTTP 200

The host decision completed.

Content type: application/json.

{
  "$ref": "#/components/schemas/Retirement"
}

HTTP 400

Malformed JSON or invalid request fields.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 401

Missing or invalid loopback capability.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 403

An Origin header or failed authority/proof check is refused.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 404

The actor is not granted.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 405

Only POST is accepted.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 409

The requested lifecycle is not current.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 413

Request exceeds the 65536-byte body limit.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 415

Content-Type must be application/json.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 429

Invalid-capability attempts exceeded the rolling-minute limit.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP default

A native refusal uses its HTTP status and may include code and outcome. Unexpected failures use the handler error classification.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

Authentication and access: Host-only HTTP operations of the stock auth service. These six routes exist only on the loopback listener and return 404 on the public listener. The owner-private auth-service discovery record supplies its port and exchange capability. Every operation requires the exact Authorization bearer capability, application/json and no Origin header. Requests match the exact target, so query strings and trailing slashes return 404. Bodies default to 65536 bytes. More than 30 invalid capability attempts in a rolling minute receive 429.

The loopback listener also serves /health, /jwks, /exchange, /manager-service-authority, /manager-instances, /service-endpoint-authority, /service-endpoint-host and /chat-session/open, /chat-session/bearer, /chat-session/retire. Their public request and response shapes are in the Auth HTTP API. Proof operations additionally require the loopback capability. The loopback /health handler also accepts other methods. Elevated exchange views and operator host operations are loopback-only. Mesh discovery is public-listener-only. This implementation reference does not establish a stable cloud API.

OpenAPI specification contains the referenced response schemas. Complete Markdown reference.