Application endpoints, not a public integration SDK
These endpoints support the hosted application’s session-authenticated browser workflow. They are implementation contracts, not a versioned public API or a promise of API-key authentication. Use the app for normal review. Do not send provider credentials or a caller-selected tenant in a decision body.
POST /api/reconciliation/decision
Owners/editors may decide. The workspace is derived from the authenticated session and role is rechecked under the writer lock. The reason must contain 1–1000 non-whitespace characters. Observation IDs are sorted and the previous review revision is required.
{
"left_id": "observation-a",
"right_id": "observation-b",
"expected_fingerprint": "<fingerprint from current authorized queue>",
"expected_revision": 0,
"decision": "separate",
"reason": "These are different environments and have separate accountable teams."
}Allowed decisions are link, separate and defer. Link additionally requires observation_id, destination registry_id, and expected_target containing the reviewed registry_id, name, purpose, business_owner, lifecycle and review. Destination must be the other pair member’s existing business record.
POST /api/reconciliation/undo
{
"left_id": "observation-a",
"right_id": "observation-b",
"expected_revision": 1,
"reason": "Review confirmed the source identity belongs to the previous business agent."
}Reverse requires a current link decision and exact binding revision produced by it. It preserves current business decisions on both records and appends a correction event.
Response handling
| Result | Client action |
|---|---|
| 200 | Use the returned authorized inventory snapshot; inspect the current decision and binding. |
| 400 | Correct invalid fields or the missing reason; do not silently change the chosen action. |
| 401 / 403 | Authenticate or resolve workspace permissions/same-origin requirements. |
| 404 | The source identity or business record is unavailable in this workspace. |
| 409 | Reload evidence and require a new explicit review. Do not retry blindly. |
Rules and compatibility
The queue exposes rule_version. Release 708b5af adds link_blockers for display and includes rule version in fingerprints and decision audit events. A client must not calculate its own replacement fingerprint or treat a disabled button as the authorization boundary; command validation is always server-side.