Reject a business signal source change

POST

business-signal-sources

changes

{id}

reject

cURL

# Sign the step up authorization on your own machine first:
#   npx tsx scripts/sign-policy-change-step-up.ts --private-key-file step-up.private.pem \
#     --key-id checker-step-up-1 --pending-policy-change-id 5ba7d3a6-d56d-4e90-b588-402d44aeee0c --action reject > step-up.json
curl -X POST https://parmana-api-real.vercel.app/business-signal-sources/changes/5ba7d3a6-d56d-4e90-b588-402d44aeee0c/reject \
  -H "Authorization: Bearer $PARMANA_API_KEY" \
  -H "Content-Type: application/json" \
  --data "{\"rejectionReason\": \"Register the ERP with its signing key.\", \"stepUpAuthorization\": $(cat step-up.json)}"

import { ParmanaClient, signPolicyChangeStepUp } from "@parmana/sdk";
import { readFileSync } from "node:fs";

const client = new ParmanaClient({
  endpoint: "https://parmana-api-real.vercel.app",
  apiKey: process.env.PARMANA_API_KEY!,
});

const stepUp = signPolicyChangeStepUp({
  pendingPolicyChangeId: "5ba7d3a6-d56d-4e90-b588-402d44aeee0c",
  action: "reject",
  privateKeyPem: readFileSync("step-up.private.pem", "utf8"),
  keyId: "checker-step-up-1",
});

const change = await client.rejectBusinessSignalSourceChange(
  "5ba7d3a6-d56d-4e90-b588-402d44aeee0c",
  "Register the ERP with its signing key.",
  stepUp,
);

console.log(change.status);

import os
from pathlib import Path

from parmana import ParmanaClient
from parmana.crypto import sign_policy_change_step_up

client = ParmanaClient(
    endpoint="https://parmana-api-real.vercel.app",
    api_key=os.environ["PARMANA_API_KEY"],
)

step_up = sign_policy_change_step_up(
    pending_policy_change_id="5ba7d3a6-d56d-4e90-b588-402d44aeee0c",
    action="reject",
    private_key_pem=Path("step-up.private.pem").read_text(),
    key_id="checker-step-up-1",
)

change = client.reject_business_signal_source_change(
    "5ba7d3a6-d56d-4e90-b588-402d44aeee0c",
    "Register the ERP with its signing key.",
    step_up,
)

print(change.status)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    rejectionReason: 'Does not meet the bar for this fixture',
    stepUpAuthorization: {
      payload: {
        version: 1,
        nonce: '4807fe45-0379-415b-9455-b8cb84eb5554',
        pendingPolicyChangeId: '5617ba3c-fb07-437d-9131-232b84bbb863',
        action: 'reject',
        authorizedAt: '2026-09-15T03:48:16.755Z',
        expiresAt: '2026-09-15T03:50:16.755Z'
      },
      signature: 'Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==',
      keyId: 'human-checker-step-up-key',
      algorithm: 'ed25519'
    }
  })
};

fetch('https://parmana-sandbox.vercel.app/business-signal-sources/changes/{id}/reject', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://parmana-sandbox.vercel.app/business-signal-sources/changes/{id}/reject",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'rejectionReason' => 'Does not meet the bar for this fixture',
    'stepUpAuthorization' => [
        'payload' => [
                'version' => 1,
                'nonce' => '4807fe45-0379-415b-9455-b8cb84eb5554',
                'pendingPolicyChangeId' => '5617ba3c-fb07-437d-9131-232b84bbb863',
                'action' => 'reject',
                'authorizedAt' => '2026-09-15T03:48:16.755Z',
                'expiresAt' => '2026-09-15T03:50:16.755Z'
        ],
        'signature' => 'Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==',
        'keyId' => 'human-checker-step-up-key',
        'algorithm' => 'ed25519'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://parmana-sandbox.vercel.app/business-signal-sources/changes/{id}/reject"

	payload := strings.NewReader("{\n  \"rejectionReason\": \"Does not meet the bar for this fixture\",\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"4807fe45-0379-415b-9455-b8cb84eb5554\",\n      \"pendingPolicyChangeId\": \"5617ba3c-fb07-437d-9131-232b84bbb863\",\n      \"action\": \"reject\",\n      \"authorizedAt\": \"2026-09-15T03:48:16.755Z\",\n      \"expiresAt\": \"2026-09-15T03:50:16.755Z\"\n    },\n    \"signature\": \"Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://parmana-sandbox.vercel.app/business-signal-sources/changes/{id}/reject")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"rejectionReason\": \"Does not meet the bar for this fixture\",\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"4807fe45-0379-415b-9455-b8cb84eb5554\",\n      \"pendingPolicyChangeId\": \"5617ba3c-fb07-437d-9131-232b84bbb863\",\n      \"action\": \"reject\",\n      \"authorizedAt\": \"2026-09-15T03:48:16.755Z\",\n      \"expiresAt\": \"2026-09-15T03:50:16.755Z\"\n    },\n    \"signature\": \"Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://parmana-sandbox.vercel.app/business-signal-sources/changes/{id}/reject")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"rejectionReason\": \"Does not meet the bar for this fixture\",\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"4807fe45-0379-415b-9455-b8cb84eb5554\",\n      \"pendingPolicyChangeId\": \"5617ba3c-fb07-437d-9131-232b84bbb863\",\n      \"action\": \"reject\",\n      \"authorizedAt\": \"2026-09-15T03:48:16.755Z\",\n      \"expiresAt\": \"2026-09-15T03:50:16.755Z\"\n    },\n    \"signature\": \"Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "changeId": "48579135-1b91-4ac1-ade4-245e7ca304a3",
  "action": "revoke",
  "name": "erp",
  "reason": "The ERP moves to a new host.",
  "proposedBy": "source-maker",
  "proposedAt": "2026-10-11T02:58:24.789Z",
  "status": "REJECTED",
  "resolvedBy": "source-checker",
  "resolvedAt": "2026-10-11T02:58:24.792Z",
  "rejectionReason": "Keep the current host until the new one is live."
}

{
  "error": "rejectionReason is required, at most 2000 characters."
}

{
  "error": "authentication required"
}

{
  "error": "This action requires a caller credential provisioned as a verified human (credentialHolderType: USER).",
  "code": "NON_HUMAN_CALLER_DENIED"
}

{
  "error": "Business signal source change '00000000-0000-0000-0000-000000000000' not found.",
  "code": "BUSINESS_SIGNAL_SOURCE_CHANGE_NOT_FOUND"
}

{
  "error": "Business signal source change '48579135-1b91-4ac1-ade4-245e7ca304a3' is already REJECTED.",
  "code": "CONFLICT"
}

Authorizations

Authorization

string

header

default:2VfYWCzt_cBAPK-8uufX6ordfY2JuQhFPsohuEumKME

required

Caller API key issued by scripts/generate-api-key.ts. Sent as Authorization: Bearer . Verified against a stored SHA-256 hash in constant time by packages/api/src/auth/StaticKeyAuthenticator.ts. Required on every route not listed as exempt in this document's top-level description. See /api-reference/authentication.

Path Parameters

string

required

The changeId from the proposal.

Body

application/json

Request body for POST /policies/pending-changes/{id}/reject.

rejectionReason

string

required

Free-text reason. Required, non-empty.

stepUpAuthorization

Policy Change Step-Up Authorization · object

required

Signed envelope proving a checker's explicit, fresh intent to approve or reject one specific Pending Policy Change (Policy Governance, Layer 4). Produced by PolicyChangeStepUpAuthorizationSigner (@parmana/crypto) using the checker's own step-up private key, never the bearer API key. Verified server-side against: the checker's registered stepUpPublicKey, payload.pendingPolicyChangeId matching the URL's {id}, payload.action matching the endpoint (approve vs reject), payload.expiresAt not yet passed, and payload.nonce not previously seen (single-use, replay-rejected on a second attempt with the same envelope).

Show child attributes

Example:

{
  "payload": {
    "version": 1,
    "nonce": "343ee454-92c6-4ef9-9cfe-e98329e51f53",
    "pendingPolicyChangeId": "6f4e4020-adf5-4449-938d-27aab58f66b7",
    "action": "approve",
    "authorizedAt": "2026-09-15T03:47:51.939Z",
    "expiresAt": "2026-09-15T03:49:51.939Z"
  },
  "signature": "keOXnzUk8KcGrQTkpXC4Ki8ps3GTvMANwqq96b+toxba07gjkcmpyL/vaPZ7+pPZ1HAOJOOy3rj5XfhcwOTnAw==",
  "keyId": "human-checker-step-up-key",
  "algorithm": "ed25519"
}

Response

Rejected. No registration changed.

Response of POST /business-signal-sources/changes (201) and of approve and reject (200). A bare Business Signal Source Change, no wrapper.

changeId

string

required

Unique id of the change, a UUID. The step up authorization for approve or reject names it in payload.pendingPolicyChangeId. An approved register change's id is also the registrationId.

action

enum<string>

required

Available options:

register,

revoke

name

string

required

The name a policy's signalSources uses in source.

Pattern: ^[a-z0-9][a-z0-9-]{0,62}$

reason

string

required

Why, from the proposer.

Maximum string length: 2000

proposedBy

string

required

The proposer's caller id. Always a human credential.

proposedAt

string<date-time>

required

status

enum<string>

required

PENDING_APPROVAL until a second person approves or rejects it; then APPROVED or REJECTED, once.

Available options:

PENDING_APPROVAL,

APPROVED,

REJECTED

endpointUrl

string

register only. The endpoint as the server stored it, normalized by URL parsing: https, a host name with a domain, no IP literal, no localhost, no user name, password or fragment, resolving only to public addresses.

timeoutMs

integer

Required range: 1000 <= x <= 30000

publicKeyPem

string

keyId

string

Pattern: ^[A-Za-z0-9._-]{1,128}$

resolvedBy

string

Who approved or rejected it. Never the proposer.

resolvedAt

string<date-time>

rejectionReason

string

Present when REJECTED.

cURL

# Sign the step up authorization on your own machine first:
#   npx tsx scripts/sign-policy-change-step-up.ts --private-key-file step-up.private.pem \
#     --key-id checker-step-up-1 --pending-policy-change-id 5ba7d3a6-d56d-4e90-b588-402d44aeee0c --action reject > step-up.json
curl -X POST https://parmana-api-real.vercel.app/business-signal-sources/changes/5ba7d3a6-d56d-4e90-b588-402d44aeee0c/reject \
  -H "Authorization: Bearer $PARMANA_API_KEY" \
  -H "Content-Type: application/json" \
  --data "{\"rejectionReason\": \"Register the ERP with its signing key.\", \"stepUpAuthorization\": $(cat step-up.json)}"

import { ParmanaClient, signPolicyChangeStepUp } from "@parmana/sdk";
import { readFileSync } from "node:fs";

const client = new ParmanaClient({
  endpoint: "https://parmana-api-real.vercel.app",
  apiKey: process.env.PARMANA_API_KEY!,
});

const stepUp = signPolicyChangeStepUp({
  pendingPolicyChangeId: "5ba7d3a6-d56d-4e90-b588-402d44aeee0c",
  action: "reject",
  privateKeyPem: readFileSync("step-up.private.pem", "utf8"),
  keyId: "checker-step-up-1",
});

const change = await client.rejectBusinessSignalSourceChange(
  "5ba7d3a6-d56d-4e90-b588-402d44aeee0c",
  "Register the ERP with its signing key.",
  stepUp,
);

console.log(change.status);

import os
from pathlib import Path

from parmana import ParmanaClient
from parmana.crypto import sign_policy_change_step_up

client = ParmanaClient(
    endpoint="https://parmana-api-real.vercel.app",
    api_key=os.environ["PARMANA_API_KEY"],
)

step_up = sign_policy_change_step_up(
    pending_policy_change_id="5ba7d3a6-d56d-4e90-b588-402d44aeee0c",
    action="reject",
    private_key_pem=Path("step-up.private.pem").read_text(),
    key_id="checker-step-up-1",
)

change = client.reject_business_signal_source_change(
    "5ba7d3a6-d56d-4e90-b588-402d44aeee0c",
    "Register the ERP with its signing key.",
    step_up,
)

print(change.status)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    rejectionReason: 'Does not meet the bar for this fixture',
    stepUpAuthorization: {
      payload: {
        version: 1,
        nonce: '4807fe45-0379-415b-9455-b8cb84eb5554',
        pendingPolicyChangeId: '5617ba3c-fb07-437d-9131-232b84bbb863',
        action: 'reject',
        authorizedAt: '2026-09-15T03:48:16.755Z',
        expiresAt: '2026-09-15T03:50:16.755Z'
      },
      signature: 'Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==',
      keyId: 'human-checker-step-up-key',
      algorithm: 'ed25519'
    }
  })
};

fetch('https://parmana-sandbox.vercel.app/business-signal-sources/changes/{id}/reject', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://parmana-sandbox.vercel.app/business-signal-sources/changes/{id}/reject",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'rejectionReason' => 'Does not meet the bar for this fixture',
    'stepUpAuthorization' => [
        'payload' => [
                'version' => 1,
                'nonce' => '4807fe45-0379-415b-9455-b8cb84eb5554',
                'pendingPolicyChangeId' => '5617ba3c-fb07-437d-9131-232b84bbb863',
                'action' => 'reject',
                'authorizedAt' => '2026-09-15T03:48:16.755Z',
                'expiresAt' => '2026-09-15T03:50:16.755Z'
        ],
        'signature' => 'Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==',
        'keyId' => 'human-checker-step-up-key',
        'algorithm' => 'ed25519'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://parmana-sandbox.vercel.app/business-signal-sources/changes/{id}/reject"

	payload := strings.NewReader("{\n  \"rejectionReason\": \"Does not meet the bar for this fixture\",\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"4807fe45-0379-415b-9455-b8cb84eb5554\",\n      \"pendingPolicyChangeId\": \"5617ba3c-fb07-437d-9131-232b84bbb863\",\n      \"action\": \"reject\",\n      \"authorizedAt\": \"2026-09-15T03:48:16.755Z\",\n      \"expiresAt\": \"2026-09-15T03:50:16.755Z\"\n    },\n    \"signature\": \"Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://parmana-sandbox.vercel.app/business-signal-sources/changes/{id}/reject")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"rejectionReason\": \"Does not meet the bar for this fixture\",\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"4807fe45-0379-415b-9455-b8cb84eb5554\",\n      \"pendingPolicyChangeId\": \"5617ba3c-fb07-437d-9131-232b84bbb863\",\n      \"action\": \"reject\",\n      \"authorizedAt\": \"2026-09-15T03:48:16.755Z\",\n      \"expiresAt\": \"2026-09-15T03:50:16.755Z\"\n    },\n    \"signature\": \"Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://parmana-sandbox.vercel.app/business-signal-sources/changes/{id}/reject")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"rejectionReason\": \"Does not meet the bar for this fixture\",\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"4807fe45-0379-415b-9455-b8cb84eb5554\",\n      \"pendingPolicyChangeId\": \"5617ba3c-fb07-437d-9131-232b84bbb863\",\n      \"action\": \"reject\",\n      \"authorizedAt\": \"2026-09-15T03:48:16.755Z\",\n      \"expiresAt\": \"2026-09-15T03:50:16.755Z\"\n    },\n    \"signature\": \"Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "changeId": "48579135-1b91-4ac1-ade4-245e7ca304a3",
  "action": "revoke",
  "name": "erp",
  "reason": "The ERP moves to a new host.",
  "proposedBy": "source-maker",
  "proposedAt": "2026-10-11T02:58:24.789Z",
  "status": "REJECTED",
  "resolvedBy": "source-checker",
  "resolvedAt": "2026-10-11T02:58:24.792Z",
  "rejectionReason": "Keep the current host until the new one is live."
}

{
  "error": "rejectionReason is required, at most 2000 characters."
}

{
  "error": "authentication required"
}

{
  "error": "This action requires a caller credential provisioned as a verified human (credentialHolderType: USER).",
  "code": "NON_HUMAN_CALLER_DENIED"
}

{
  "error": "Business signal source change '00000000-0000-0000-0000-000000000000' not found.",
  "code": "BUSINESS_SIGNAL_SOURCE_CHANGE_NOT_FOUND"
}

{
  "error": "Business signal source change '48579135-1b91-4ac1-ade4-245e7ca304a3' is already REJECTED.",
  "code": "CONFLICT"
}

REST API guide

Execution

Transactions

Verification

Receipts

Trust Records

Replay

Policies

Policy Governance

Approvers

External Connectors

Business Signal Sources

Authority Grants

Sandbox

Refusal Records

Execution Intents

Audit

System

Handbook

Reject a business signal source change

Authorizations

Path Parameters

Body

Response