Get a Refusal Record by transaction ID

GET

refusal

{businessTransactionId}

cURL

# TXN_ID: the businessTransactionId of the transaction. In the sandbox, use one from a playground run;
# sandbox data is deleted hourly, so an older id returns 404.
TXN_ID="${TXN_ID:?set TXN_ID to a businessTransactionId}"
curl https://parmana-api-real.vercel.app/refusal/$TXN_ID \
  -H "Authorization: Bearer $PARMANA_API_KEY"

import { ParmanaClient } from "@parmana/sdk";

const client = new ParmanaClient({
  endpoint: "https://parmana-api-real.vercel.app",
  apiKey: process.env.PARMANA_API_KEY!,
});

const record = await client.refusalRecord(
  "5f0c2a7e-3d7b-4d0e-9a55-2f6d8b1c4e90",
);

console.log(record);

import os

from parmana import ParmanaClient

client = ParmanaClient(
    endpoint="https://parmana-api-real.vercel.app",
    api_key=os.environ["PARMANA_API_KEY"],
)

record = client.refusal_record("5f0c2a7e-3d7b-4d0e-9a55-2f6d8b1c4e90")

print(record)

const options = {method: 'GET', headers: {Authorization: '<api-key>'}};

fetch('https://parmana-api-real.vercel.app/refusal/{businessTransactionId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://parmana-api-real.vercel.app/refusal/{businessTransactionId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://parmana-api-real.vercel.app/refusal/{businessTransactionId}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://parmana-api-real.vercel.app/refusal/{businessTransactionId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "refusalRecordId": "a46475ef-53ae-4cb9-b407-1a64b6af03fe",
  "businessTransactionId": "511e9aaf-bffe-4834-a454-6cc2894e7ab4",
  "decision": {
    "decisionId": "8df80cd5-d88f-416e-9b87-ac346bd144a1",
    "intentId": "88d49afb-ac0b-4cb0-8420-cd2100bf1cb0",
    "policy": {
      "name": "vendor-payment",
      "version": "2.1.0",
      "schemaVersion": "1.0.0"
    },
    "signals": {
      "vendorVerified": true,
      "invoiceVerified": true,
      "paymentApproved": true,
      "sufficientFunds": false,
      "paymentAmount": 1000,
      "riskScore": 10,
      "vendorId": "vendor://payments",
      "humanApproved": true,
      "approvalArtifact": {
        "payload": {
          "version": 1,
          "approvalId": "ab8f7d00-194d-428b-a40f-4f63517de2ff",
          "issuer": {
            "approverId": "test-approver",
            "keyId": "test-approver-key-1"
          },
          "issuedAt": "2026-10-01T10:14:05.085Z",
          "expiresAt": "2026-10-01T10:29:05.085Z",
          "capability": "test:fixture-execute",
          "resourceId": "vendor://payments",
          "scope": {
            "field": "value",
            "comparator": "lte",
            "value": 1000
          },
          "nonce": "a5b7a9f3-a679-4052-9aa4-391e0e6b298c"
        },
        "signature": {
          "algorithm": "ed25519",
          "keyId": "test-approver-key-1",
          "value": "fBA9eUxZwTD/cbjVjpYLmmDFQkpOd54nLgLiBGWhGVLHQ/xsWL/pDJUfhrmvd3YRoJSibwn7+LaHAHLPsgJ1BA==",
          "signedAt": "2026-10-01T10:14:05.085Z"
        }
      }
    },
    "outcome": "REJECTED",
    "reason": "Vendor payment rejected because sufficient funds are not available.",
    "matchedRuleId": "reject-insufficient-funds",
    "evaluatedRules": 6,
    "matchedPath": [
      "approve-payment",
      "reject-high-risk-payment",
      "reject-unverified-vendor",
      "reject-unverified-invoice",
      "reject-payment-not-approved",
      "reject-insufficient-funds"
    ],
    "evaluatedAt": "2026-10-01T10:14:05.097Z"
  },
  "evaluatedIntent": {
    "target": "vendor://payments",
    "parameters": {
      "paymentId": "payment-001",
      "amount": 1000
    }
  },
  "submittedBy": "operator-maker",
  "createdAt": "2026-10-01T10:14:05.098Z",
  "refusalRecordHash": "e4988c237239299438ed9fb99aa86a9fada04facd0128eb73dcdb21bfa683386",
  "signature": {
    "algorithm": "ed25519",
    "keyId": "default",
    "value": "LE2h4I+CkhAaivg6n0GZ3FbUN5tAtKR6R2HcvweB4nb3JHhkyO6mFTbNgsoHi+EyfXcoX7L7GAXVeMYNoXP5DQ==",
    "signedAt": "2026-10-01T10:14:05.099Z"
  }
}

{
  "error": "authentication required"
}

{
  "error": "Refusal Record not found."
}

Authorizations

Authorization

string

header

required

Caller API key issued by scripts/generate-api-key.ts. Sent as Authorization: Bearer . Verified against a stored SHA-256 hash in constant time by packages/api/src/auth/StaticKeyAuthenticator.ts. Required on every route not listed as exempt in this document's top-level description. See /api-reference/authentication.

Path Parameters

businessTransactionId

string

required

The id of the refused transaction. In the sandbox, the value shown is a seeded transaction kept for these docs. To try your own, run the playground and use the businessTransactionId it prints.

Response

The Refusal Record.

Response returned by GET /refusal/{businessTransactionId}. A bare Refusal Record, no wrapper.

refusalRecordId

string

required

Unique Refusal Record identifier.

businessTransactionId

string

required

Business Transaction this refusal is about.

decision

Decision · object

required

Immutable result of evaluating an Intent against a Policy. Decision does not create authority, grant authorization, or modify Intent; it only records the outcome of deterministic Policy evaluation.

Show child attributes

Example:

{
  "decisionId": "9d69dc0b-333a-4be3-b09f-358fece806f3",
  "intentId": "ae5865f6-181b-409a-90ec-1b4b8b8414ba",
  "policy": {
    "name": "vendor-payment",
    "version": "2.0.0",
    "schemaVersion": "1.0.0"
  },
  "signals": {
    "vendorVerified": true,
    "invoiceVerified": true,
    "paymentApproved": true,
    "sufficientFunds": true,
    "paymentAmount": 4500,
    "riskScore": 10
  },
  "outcome": "APPROVED",
  "reason": "Vendor payment authorized. Vendor verification, invoice verification, payment approval, funding, and risk assessment requirements were satisfied.",
  "matchedRuleId": "approve-payment",
  "evaluatedRules": 1,
  "matchedPath": ["approve-payment"],
  "evaluatedAt": "2026-07-07T16:38:59.326Z"
}

evaluatedIntent

object

required

The Intent snapshot the signals were evaluated against: target and parameters only, present for every refusal, not only binding violations.

Show child attributes

refusalRecordHash

string

required

Canonical hash of this Refusal Record, same convention as ExecutionTrustRecord.trustRecordHash.

signature

object

required

Cryptographic signature over the canonical Refusal Record, signed with the same key as ExecutionTrustRecord, one root of trust for both approvals and refusals.

Show child attributes

createdAt

string<date-time>

required

UTC timestamp when this Refusal Record was created.

bindingViolations

object[]

Present only when the rejection came from SignalIntentBinder. Absent (not an empty array) for an ordinary PolicyEngine.evaluate REJECT that never reached binding-violation logic at all.

Show child attributes

submittedBy

string

Authenticated caller who submitted the rejected request. Absent when caller authentication is disabled.

policyContentHash

string

SHA-256 hash of the policy content that decided the refusal, the same value an Execution Trust Record carries in transaction.policy.contentHash. Inside the signed record. Absent on Refusal Records written before 2026-10-06.

Pattern: ^[0-9a-f]{64}$

cURL

# TXN_ID: the businessTransactionId of the transaction. In the sandbox, use one from a playground run;
# sandbox data is deleted hourly, so an older id returns 404.
TXN_ID="${TXN_ID:?set TXN_ID to a businessTransactionId}"
curl https://parmana-api-real.vercel.app/refusal/$TXN_ID \
  -H "Authorization: Bearer $PARMANA_API_KEY"

import { ParmanaClient } from "@parmana/sdk";

const client = new ParmanaClient({
  endpoint: "https://parmana-api-real.vercel.app",
  apiKey: process.env.PARMANA_API_KEY!,
});

const record = await client.refusalRecord(
  "5f0c2a7e-3d7b-4d0e-9a55-2f6d8b1c4e90",
);

console.log(record);

import os

from parmana import ParmanaClient

client = ParmanaClient(
    endpoint="https://parmana-api-real.vercel.app",
    api_key=os.environ["PARMANA_API_KEY"],
)

record = client.refusal_record("5f0c2a7e-3d7b-4d0e-9a55-2f6d8b1c4e90")

print(record)

const options = {method: 'GET', headers: {Authorization: '<api-key>'}};

fetch('https://parmana-api-real.vercel.app/refusal/{businessTransactionId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://parmana-api-real.vercel.app/refusal/{businessTransactionId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://parmana-api-real.vercel.app/refusal/{businessTransactionId}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://parmana-api-real.vercel.app/refusal/{businessTransactionId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "refusalRecordId": "a46475ef-53ae-4cb9-b407-1a64b6af03fe",
  "businessTransactionId": "511e9aaf-bffe-4834-a454-6cc2894e7ab4",
  "decision": {
    "decisionId": "8df80cd5-d88f-416e-9b87-ac346bd144a1",
    "intentId": "88d49afb-ac0b-4cb0-8420-cd2100bf1cb0",
    "policy": {
      "name": "vendor-payment",
      "version": "2.1.0",
      "schemaVersion": "1.0.0"
    },
    "signals": {
      "vendorVerified": true,
      "invoiceVerified": true,
      "paymentApproved": true,
      "sufficientFunds": false,
      "paymentAmount": 1000,
      "riskScore": 10,
      "vendorId": "vendor://payments",
      "humanApproved": true,
      "approvalArtifact": {
        "payload": {
          "version": 1,
          "approvalId": "ab8f7d00-194d-428b-a40f-4f63517de2ff",
          "issuer": {
            "approverId": "test-approver",
            "keyId": "test-approver-key-1"
          },
          "issuedAt": "2026-10-01T10:14:05.085Z",
          "expiresAt": "2026-10-01T10:29:05.085Z",
          "capability": "test:fixture-execute",
          "resourceId": "vendor://payments",
          "scope": {
            "field": "value",
            "comparator": "lte",
            "value": 1000
          },
          "nonce": "a5b7a9f3-a679-4052-9aa4-391e0e6b298c"
        },
        "signature": {
          "algorithm": "ed25519",
          "keyId": "test-approver-key-1",
          "value": "fBA9eUxZwTD/cbjVjpYLmmDFQkpOd54nLgLiBGWhGVLHQ/xsWL/pDJUfhrmvd3YRoJSibwn7+LaHAHLPsgJ1BA==",
          "signedAt": "2026-10-01T10:14:05.085Z"
        }
      }
    },
    "outcome": "REJECTED",
    "reason": "Vendor payment rejected because sufficient funds are not available.",
    "matchedRuleId": "reject-insufficient-funds",
    "evaluatedRules": 6,
    "matchedPath": [
      "approve-payment",
      "reject-high-risk-payment",
      "reject-unverified-vendor",
      "reject-unverified-invoice",
      "reject-payment-not-approved",
      "reject-insufficient-funds"
    ],
    "evaluatedAt": "2026-10-01T10:14:05.097Z"
  },
  "evaluatedIntent": {
    "target": "vendor://payments",
    "parameters": {
      "paymentId": "payment-001",
      "amount": 1000
    }
  },
  "submittedBy": "operator-maker",
  "createdAt": "2026-10-01T10:14:05.098Z",
  "refusalRecordHash": "e4988c237239299438ed9fb99aa86a9fada04facd0128eb73dcdb21bfa683386",
  "signature": {
    "algorithm": "ed25519",
    "keyId": "default",
    "value": "LE2h4I+CkhAaivg6n0GZ3FbUN5tAtKR6R2HcvweB4nb3JHhkyO6mFTbNgsoHi+EyfXcoX7L7GAXVeMYNoXP5DQ==",
    "signedAt": "2026-10-01T10:14:05.099Z"
  }
}

{
  "error": "authentication required"
}

{
  "error": "Refusal Record not found."
}

REST API guide

Execution

Transactions

Verification

Receipts

Trust Records

Replay

Policies

Policy Governance

Approvers

External Connectors

Business Signal Sources

Authority Grants

Sandbox

Kill Switch

Refusal Records

Execution Intents

Audit

System

Handbook

Get a Refusal Record by transaction ID

Authorizations

Path Parameters

Response