Dispatch a native manager authority request

POST

/manager-service-authority

curl --request POST \
  --url https://auth.example.invalid/manager-service-authority \
  --header 'Content-Type: application/json' \
  --data '{ "idpToken": "example", "request": { "v": 1, "kind": "example", "actor": "example" } }'

• Replace with the configured HTTPS public authority URL; TLS terminates at the operator proxy.

Fresh JSON idpToken derives the owner; request.actor is checked against its current interactive ledger grant. Native request kinds and phase-specific results are not a stable cloud API. Manager lifecycle prepare/activate/renew/retire, enrollment, retirement preparation, retained validation, goal-index scan, admin authorization and run operations dispatch to their native contracts. Stock runtime-create/runtime-status and delegated intent kinds require host interception; the HTTP wrapper currently reports those refusals as 403 (not 501). Missing IdP proof is 400; a native conflict, such as a name another lifecycle holds or a stale serve epoch, is 409; failed proof, native parser/authority/unsupported failures are 403. A 403 or 409 refusal is 429 instead when the peer is throttled. Origin is refused. Credential verification and native dispatch failures share the public peer refusal budget.

Request Body^required

UTF-8 JSON; maximum 65536 bytes. An Authorization header does not replace the JSON proof.

Media typeapplication/json

object

idpToken

required

string

>= 1 characters

request

required

Transport envelope only. Nested native fields and operation-specific constraints are defined by RemoteManagerAuthorityRequest and dispatchManagerAuthorityRequest request union in the linked source; this schema is not a complete native command contract.

object

v

Allowed value: 1

kind

string

>= 1 characters

actor

required

string

Responses

200

Successful response.

Media typeapplication/json

Native dispatch result union. The optional documented fields describe RemoteManagerAuthorityMaterial, including prepare credentials; other dispatched result arms use their own native contracts. This schema validates the object transport envelope, not every phase-specific result.

object

v

required

Allowed value: 1

kind

required

string

operation

string

space

string

>= 1 characters

owner

string

>= 1 characters

actor

string

>= 1 characters

instanceId

string

>= 1 characters

lifecycleUid

string

>= 1 characters

requestId

required

string

>= 1 characters

issuedAt

integer

expiresAt

integer

credentials

object

supervisor

object

jwt

required

string

>= 1 characters

exp

required

integer

executor

object

jwt

required

string

>= 1 characters

exp

required

integer

serve

object

jwt

required

string

>= 1 characters

exp

required

integer

goalWriter

object

jwt

required

string

>= 1 characters

exp

required

integer

sessionLedger

object

jwt

required

string

>= 1 characters

exp

required

integer

runDriver

object

jwt

required

string

>= 1 characters

exp

required

integer

runMediator

object

jwt

required

string

>= 1 characters

exp

required

integer

sessionServing

object

jwt

required

string

>= 1 characters

exp

required

integer

retirementRequester

object

jwt

required

string

>= 1 characters

exp

required

integer

transferReader

object

jwt

required

string

>= 1 characters

exp

required

integer

Example

{
  "v": 1
}

400

JSON error. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413. An unexpected failure is 400 unless a route handles it separately.

Media typeapplication/json

object

error

required

string

code

string

outcome

string

Allowed values: not-executed executed unknown

Example

{
  "outcome": "not-executed"
}

403

JSON error. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413. An unexpected failure is 400 unless a route handles it separately.

Media typeapplication/json

object

error

required

string

code

string

outcome

string

Allowed values: not-executed executed unknown

Example

{
  "outcome": "not-executed"
}

405

JSON error. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413. An unexpected failure is 400 unless a route handles it separately.

Media typeapplication/json

object

error

required

string

code

string

outcome

string

Allowed values: not-executed executed unknown

Example

{
  "outcome": "not-executed"
}

409

JSON error. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413. An unexpected failure is 400 unless a route handles it separately.

Media typeapplication/json

object

error

required

string

code

string

outcome

string

Allowed values: not-executed executed unknown

Example

{
  "outcome": "not-executed"
}

413

JSON error. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413. An unexpected failure is 400 unless a route handles it separately.

Media typeapplication/json

object

error

required

string

code

string

outcome

string

Allowed values: not-executed executed unknown

Example

{
  "outcome": "not-executed"
}

415

JSON error. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413. An unexpected failure is 400 unless a route handles it separately.

Media typeapplication/json

object

error

required

string

code

string

outcome

string

Allowed values: not-executed executed unknown

Example

{
  "outcome": "not-executed"
}

429

JSON error. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413. An unexpected failure is 400 unless a route handles it separately.

Media typeapplication/json

object

error

required

string

code

string

outcome

string

Allowed values: not-executed executed unknown

Example

{
  "outcome": "not-executed"
}

503

Public admission cap (64 in flight), 10 second request deadline, or a route-specific unavailable read/effect. A service authority 503 may follow a binding; retain the request identity.

Media typeapplication/json

object

error

required

string

code

string

outcome

string

Allowed values: not-executed executed unknown

Example

{
  "outcome": "not-executed"
}