Reject an external connector change

POST

external-connectors

changes

{id}

reject

Reject an external connector change

curl --request POST \
  --url https://parmana-api-real.vercel.app/external-connectors/changes/{id}/reject \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "rejectionReason": "Does not meet the bar for this fixture",
  "stepUpAuthorization": {
    "payload": {
      "version": 1,
      "nonce": "4807fe45-0379-415b-9455-b8cb84eb5554",
      "pendingPolicyChangeId": "5617ba3c-fb07-437d-9131-232b84bbb863",
      "action": "reject",
      "authorizedAt": "2026-09-15T03:48:16.755Z",
      "expiresAt": "2026-09-15T03:50:16.755Z"
    },
    "signature": "Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==",
    "keyId": "human-checker-step-up-key",
    "algorithm": "ed25519"
  }
}
'

import requests

url = "https://parmana-api-real.vercel.app/external-connectors/changes/{id}/reject"

payload = {
    "rejectionReason": "Does not meet the bar for this fixture",
    "stepUpAuthorization": {
        "payload": {
            "version": 1,
            "nonce": "4807fe45-0379-415b-9455-b8cb84eb5554",
            "pendingPolicyChangeId": "5617ba3c-fb07-437d-9131-232b84bbb863",
            "action": "reject",
            "authorizedAt": "2026-09-15T03:48:16.755Z",
            "expiresAt": "2026-09-15T03:50:16.755Z"
        },
        "signature": "Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==",
        "keyId": "human-checker-step-up-key",
        "algorithm": "ed25519"
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    rejectionReason: 'Does not meet the bar for this fixture',
    stepUpAuthorization: {
      payload: {
        version: 1,
        nonce: '4807fe45-0379-415b-9455-b8cb84eb5554',
        pendingPolicyChangeId: '5617ba3c-fb07-437d-9131-232b84bbb863',
        action: 'reject',
        authorizedAt: '2026-09-15T03:48:16.755Z',
        expiresAt: '2026-09-15T03:50:16.755Z'
      },
      signature: 'Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==',
      keyId: 'human-checker-step-up-key',
      algorithm: 'ed25519'
    }
  })
};

fetch('https://parmana-api-real.vercel.app/external-connectors/changes/{id}/reject', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://parmana-api-real.vercel.app/external-connectors/changes/{id}/reject",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'rejectionReason' => 'Does not meet the bar for this fixture',
    'stepUpAuthorization' => [
        'payload' => [
                'version' => 1,
                'nonce' => '4807fe45-0379-415b-9455-b8cb84eb5554',
                'pendingPolicyChangeId' => '5617ba3c-fb07-437d-9131-232b84bbb863',
                'action' => 'reject',
                'authorizedAt' => '2026-09-15T03:48:16.755Z',
                'expiresAt' => '2026-09-15T03:50:16.755Z'
        ],
        'signature' => 'Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==',
        'keyId' => 'human-checker-step-up-key',
        'algorithm' => 'ed25519'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://parmana-api-real.vercel.app/external-connectors/changes/{id}/reject"

	payload := strings.NewReader("{\n  \"rejectionReason\": \"Does not meet the bar for this fixture\",\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"4807fe45-0379-415b-9455-b8cb84eb5554\",\n      \"pendingPolicyChangeId\": \"5617ba3c-fb07-437d-9131-232b84bbb863\",\n      \"action\": \"reject\",\n      \"authorizedAt\": \"2026-09-15T03:48:16.755Z\",\n      \"expiresAt\": \"2026-09-15T03:50:16.755Z\"\n    },\n    \"signature\": \"Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://parmana-api-real.vercel.app/external-connectors/changes/{id}/reject")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"rejectionReason\": \"Does not meet the bar for this fixture\",\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"4807fe45-0379-415b-9455-b8cb84eb5554\",\n      \"pendingPolicyChangeId\": \"5617ba3c-fb07-437d-9131-232b84bbb863\",\n      \"action\": \"reject\",\n      \"authorizedAt\": \"2026-09-15T03:48:16.755Z\",\n      \"expiresAt\": \"2026-09-15T03:50:16.755Z\"\n    },\n    \"signature\": \"Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://parmana-api-real.vercel.app/external-connectors/changes/{id}/reject")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"rejectionReason\": \"Does not meet the bar for this fixture\",\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"4807fe45-0379-415b-9455-b8cb84eb5554\",\n      \"pendingPolicyChangeId\": \"5617ba3c-fb07-437d-9131-232b84bbb863\",\n      \"action\": \"reject\",\n      \"authorizedAt\": \"2026-09-15T03:48:16.755Z\",\n      \"expiresAt\": \"2026-09-15T03:50:16.755Z\"\n    },\n    \"signature\": \"Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "changeId": "5bdbfd6a-babf-4977-b090-d561ddcee0d7",
  "action": "revoke",
  "capability": "erp:create-invoice",
  "reason": "The ERP endpoint moves to a new host.",
  "proposedBy": "human-maker",
  "proposedAt": "2026-09-30T17:25:46.418Z",
  "status": "REJECTED",
  "resolvedBy": "human-checker",
  "resolvedAt": "2026-09-30T17:25:46.439Z",
  "rejectionReason": "Keep the current endpoint until the new host is live."
}

Authorizations

Authorization

string

header

required

Caller API key issued by scripts/generate-api-key.ts. Sent as Authorization: Bearer . Verified against a stored SHA-256 hash in constant time by packages/api/src/auth/StaticKeyAuthenticator.ts. Required on every route not listed as exempt in this document's top-level description. See /api-reference/authentication.

Path Parameters

string

required

The changeId.

Body

application/json

Request body for POST /policies/pending-changes/{id}/reject.

rejectionReason

string

required

Free-text reason. Required, non-empty.

stepUpAuthorization

Policy Change Step-Up Authorization · object

required

Signed envelope proving a checker's explicit, fresh intent to approve or reject one specific Pending Policy Change (Policy Governance, Layer 4). Produced by PolicyChangeStepUpAuthorizationSigner (@parmana/crypto) using the checker's own step-up private key, never the bearer API key. Verified server-side against: the checker's registered stepUpPublicKey, payload.pendingPolicyChangeId matching the URL's {id}, payload.action matching the endpoint (approve vs reject), payload.expiresAt not yet passed, and payload.nonce not previously seen (single-use, replay-rejected on a second attempt with the same envelope).

Show child attributes

Example:

{
  "payload": {
    "version": 1,
    "nonce": "343ee454-92c6-4ef9-9cfe-e98329e51f53",
    "pendingPolicyChangeId": "6f4e4020-adf5-4449-938d-27aab58f66b7",
    "action": "approve",
    "authorizedAt": "2026-09-15T03:47:51.939Z",
    "expiresAt": "2026-09-15T03:49:51.939Z"
  },
  "signature": "keOXnzUk8KcGrQTkpXC4Ki8ps3GTvMANwqq96b+toxba07gjkcmpyL/vaPZ7+pPZ1HAOJOOy3rj5XfhcwOTnAw==",
  "keyId": "human-checker-step-up-key",
  "algorithm": "ed25519"
}

Response

Rejected.

A proposal to register an external connector, or to revoke the active one for a capability, and its resolution (ADR-0013). One person proposes it; a different person approves or rejects it with a step up authorization. Only an approved change affects which external connectors are registered.

changeId

string

required

Unique id of the change, a UUID. The step up authorization for approve or reject names it in payload.pendingPolicyChangeId. An approved register change's id is also the registrationId.

action

enum<string>

required

Available options:

register,

revoke

capability

string

required

namespace:verb. Never in a built in connector's namespace (paytm, hubspot, github, slack, test).

Maximum string length: 128

Pattern: ^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*:[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$

reason

string

required

Why, from the proposer.

Maximum string length: 2000

proposedBy

string

required

The proposer's caller id. Always a human credential.

proposedAt

string<date-time>

required

status

enum<string>

required

PENDING_APPROVAL until a second person approves or rejects it; then APPROVED or REJECTED, once.

Available options:

PENDING_APPROVAL,

APPROVED,

REJECTED

endpointUrl

string

register only. The endpoint as the server stored it, normalized by URL parsing: https, a host name with a domain, no IP literal, no localhost, no user name, password or fragment, resolving only to public addresses. It is the audience of every release to this endpoint.

policy

string

register only. The name of the policy that governs the capability. The version in effect is decided by policy governance.

Pattern: ^[a-z0-9][a-z0-9-]{0,127}$

allowedParameters

string[]

Maximum array length: 64

Pattern: ^[A-Za-z_][A-Za-z0-9_]{0,63}$

timeoutMs

integer

Required range: 1000 <= x <= 30000

resolvedBy

string

Who approved or rejected it. Never the proposer.

resolvedAt

string<date-time>

rejectionReason

string

Present when REJECTED.

Reject an external connector change

curl --request POST \
  --url https://parmana-api-real.vercel.app/external-connectors/changes/{id}/reject \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "rejectionReason": "Does not meet the bar for this fixture",
  "stepUpAuthorization": {
    "payload": {
      "version": 1,
      "nonce": "4807fe45-0379-415b-9455-b8cb84eb5554",
      "pendingPolicyChangeId": "5617ba3c-fb07-437d-9131-232b84bbb863",
      "action": "reject",
      "authorizedAt": "2026-09-15T03:48:16.755Z",
      "expiresAt": "2026-09-15T03:50:16.755Z"
    },
    "signature": "Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==",
    "keyId": "human-checker-step-up-key",
    "algorithm": "ed25519"
  }
}
'

import requests

url = "https://parmana-api-real.vercel.app/external-connectors/changes/{id}/reject"

payload = {
    "rejectionReason": "Does not meet the bar for this fixture",
    "stepUpAuthorization": {
        "payload": {
            "version": 1,
            "nonce": "4807fe45-0379-415b-9455-b8cb84eb5554",
            "pendingPolicyChangeId": "5617ba3c-fb07-437d-9131-232b84bbb863",
            "action": "reject",
            "authorizedAt": "2026-09-15T03:48:16.755Z",
            "expiresAt": "2026-09-15T03:50:16.755Z"
        },
        "signature": "Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==",
        "keyId": "human-checker-step-up-key",
        "algorithm": "ed25519"
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    rejectionReason: 'Does not meet the bar for this fixture',
    stepUpAuthorization: {
      payload: {
        version: 1,
        nonce: '4807fe45-0379-415b-9455-b8cb84eb5554',
        pendingPolicyChangeId: '5617ba3c-fb07-437d-9131-232b84bbb863',
        action: 'reject',
        authorizedAt: '2026-09-15T03:48:16.755Z',
        expiresAt: '2026-09-15T03:50:16.755Z'
      },
      signature: 'Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==',
      keyId: 'human-checker-step-up-key',
      algorithm: 'ed25519'
    }
  })
};

fetch('https://parmana-api-real.vercel.app/external-connectors/changes/{id}/reject', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://parmana-api-real.vercel.app/external-connectors/changes/{id}/reject",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'rejectionReason' => 'Does not meet the bar for this fixture',
    'stepUpAuthorization' => [
        'payload' => [
                'version' => 1,
                'nonce' => '4807fe45-0379-415b-9455-b8cb84eb5554',
                'pendingPolicyChangeId' => '5617ba3c-fb07-437d-9131-232b84bbb863',
                'action' => 'reject',
                'authorizedAt' => '2026-09-15T03:48:16.755Z',
                'expiresAt' => '2026-09-15T03:50:16.755Z'
        ],
        'signature' => 'Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==',
        'keyId' => 'human-checker-step-up-key',
        'algorithm' => 'ed25519'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://parmana-api-real.vercel.app/external-connectors/changes/{id}/reject"

	payload := strings.NewReader("{\n  \"rejectionReason\": \"Does not meet the bar for this fixture\",\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"4807fe45-0379-415b-9455-b8cb84eb5554\",\n      \"pendingPolicyChangeId\": \"5617ba3c-fb07-437d-9131-232b84bbb863\",\n      \"action\": \"reject\",\n      \"authorizedAt\": \"2026-09-15T03:48:16.755Z\",\n      \"expiresAt\": \"2026-09-15T03:50:16.755Z\"\n    },\n    \"signature\": \"Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://parmana-api-real.vercel.app/external-connectors/changes/{id}/reject")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"rejectionReason\": \"Does not meet the bar for this fixture\",\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"4807fe45-0379-415b-9455-b8cb84eb5554\",\n      \"pendingPolicyChangeId\": \"5617ba3c-fb07-437d-9131-232b84bbb863\",\n      \"action\": \"reject\",\n      \"authorizedAt\": \"2026-09-15T03:48:16.755Z\",\n      \"expiresAt\": \"2026-09-15T03:50:16.755Z\"\n    },\n    \"signature\": \"Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://parmana-api-real.vercel.app/external-connectors/changes/{id}/reject")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"rejectionReason\": \"Does not meet the bar for this fixture\",\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"4807fe45-0379-415b-9455-b8cb84eb5554\",\n      \"pendingPolicyChangeId\": \"5617ba3c-fb07-437d-9131-232b84bbb863\",\n      \"action\": \"reject\",\n      \"authorizedAt\": \"2026-09-15T03:48:16.755Z\",\n      \"expiresAt\": \"2026-09-15T03:50:16.755Z\"\n    },\n    \"signature\": \"Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "changeId": "5bdbfd6a-babf-4977-b090-d561ddcee0d7",
  "action": "revoke",
  "capability": "erp:create-invoice",
  "reason": "The ERP endpoint moves to a new host.",
  "proposedBy": "human-maker",
  "proposedAt": "2026-09-30T17:25:46.418Z",
  "status": "REJECTED",
  "resolvedBy": "human-checker",
  "resolvedAt": "2026-09-30T17:25:46.439Z",
  "rejectionReason": "Keep the current endpoint until the new host is live."
}

REST API guide

Execution

Transactions

Verification

Receipts

Trust Records

Replay

Policies

Policy Governance

Approvers

External Connectors

Refusal Records

Execution Intents

Audit

System

Handbook

Reject an external connector change

Authorizations

Path Parameters

Body

Response