Reject a pending policy change (checker)

POST

policies

pending-changes

{id}

reject

cURL

# Sign the step up authorization on your own machine first:
#   npx tsx scripts/sign-policy-change-step-up.ts --private-key-file step-up.private.pem \
#     --key-id checker-step-up-1 --pending-policy-change-id ba7c5827-5844-4069-94fc-9b438ef08f78 --action reject > step-up.json
curl -X POST https://parmana-api-real.vercel.app/policies/pending-changes/ba7c5827-5844-4069-94fc-9b438ef08f78/reject \
  -H "Authorization: Bearer $PARMANA_API_KEY" \
  -H "Content-Type: application/json" \
  --data "{\"rejectionReason\": \"The maximum stays at 100000 this quarter.\", \"stepUpAuthorization\": $(cat step-up.json)}"

import { ParmanaClient, signPolicyChangeStepUp } from "@parmana/sdk";
import { readFileSync } from "node:fs";

const client = new ParmanaClient({
  endpoint: "https://parmana-api-real.vercel.app",
  apiKey: process.env.PARMANA_API_KEY!,
});

const stepUp = signPolicyChangeStepUp({
  pendingPolicyChangeId: "ba7c5827-5844-4069-94fc-9b438ef08f78",
  action: "reject",
  privateKeyPem: readFileSync("step-up.private.pem", "utf8"),
  keyId: "checker-step-up-1",
});

const change = await client.rejectPolicyChange(
  "ba7c5827-5844-4069-94fc-9b438ef08f78",
  "The maximum stays at 100000 this quarter.",
  stepUp,
);

console.log(change.status);

import os
from pathlib import Path

from parmana import ParmanaClient
from parmana.crypto import sign_policy_change_step_up

client = ParmanaClient(
    endpoint="https://parmana-api-real.vercel.app",
    api_key=os.environ["PARMANA_API_KEY"],
)

step_up = sign_policy_change_step_up(
    pending_policy_change_id="ba7c5827-5844-4069-94fc-9b438ef08f78",
    action="reject",
    private_key_pem=Path("step-up.private.pem").read_text(),
    key_id="checker-step-up-1",
)

change = client.reject_policy_change(
    "ba7c5827-5844-4069-94fc-9b438ef08f78",
    "The maximum stays at 100000 this quarter.",
    step_up,
)

print(change.status)

const options = {
  method: 'POST',
  headers: {Authorization: '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    rejectionReason: 'Does not meet the bar for this fixture',
    stepUpAuthorization: {
      payload: {
        version: 1,
        nonce: '4807fe45-0379-415b-9455-b8cb84eb5554',
        pendingPolicyChangeId: '5617ba3c-fb07-437d-9131-232b84bbb863',
        action: 'reject',
        authorizedAt: '2026-09-15T03:48:16.755Z',
        expiresAt: '2026-09-15T03:50:16.755Z'
      },
      signature: 'Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==',
      keyId: 'human-checker-step-up-key',
      algorithm: 'ed25519'
    }
  })
};

fetch('https://parmana-api-real.vercel.app/policies/pending-changes/{id}/reject', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://parmana-api-real.vercel.app/policies/pending-changes/{id}/reject",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'rejectionReason' => 'Does not meet the bar for this fixture',
    'stepUpAuthorization' => [
        'payload' => [
                'version' => 1,
                'nonce' => '4807fe45-0379-415b-9455-b8cb84eb5554',
                'pendingPolicyChangeId' => '5617ba3c-fb07-437d-9131-232b84bbb863',
                'action' => 'reject',
                'authorizedAt' => '2026-09-15T03:48:16.755Z',
                'expiresAt' => '2026-09-15T03:50:16.755Z'
        ],
        'signature' => 'Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==',
        'keyId' => 'human-checker-step-up-key',
        'algorithm' => 'ed25519'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://parmana-api-real.vercel.app/policies/pending-changes/{id}/reject"

	payload := strings.NewReader("{\n  \"rejectionReason\": \"Does not meet the bar for this fixture\",\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"4807fe45-0379-415b-9455-b8cb84eb5554\",\n      \"pendingPolicyChangeId\": \"5617ba3c-fb07-437d-9131-232b84bbb863\",\n      \"action\": \"reject\",\n      \"authorizedAt\": \"2026-09-15T03:48:16.755Z\",\n      \"expiresAt\": \"2026-09-15T03:50:16.755Z\"\n    },\n    \"signature\": \"Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://parmana-api-real.vercel.app/policies/pending-changes/{id}/reject")
  .header("Authorization", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"rejectionReason\": \"Does not meet the bar for this fixture\",\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"4807fe45-0379-415b-9455-b8cb84eb5554\",\n      \"pendingPolicyChangeId\": \"5617ba3c-fb07-437d-9131-232b84bbb863\",\n      \"action\": \"reject\",\n      \"authorizedAt\": \"2026-09-15T03:48:16.755Z\",\n      \"expiresAt\": \"2026-09-15T03:50:16.755Z\"\n    },\n    \"signature\": \"Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://parmana-api-real.vercel.app/policies/pending-changes/{id}/reject")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"rejectionReason\": \"Does not meet the bar for this fixture\",\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"4807fe45-0379-415b-9455-b8cb84eb5554\",\n      \"pendingPolicyChangeId\": \"5617ba3c-fb07-437d-9131-232b84bbb863\",\n      \"action\": \"reject\",\n      \"authorizedAt\": \"2026-09-15T03:48:16.755Z\",\n      \"expiresAt\": \"2026-09-15T03:50:16.755Z\"\n    },\n    \"signature\": \"Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "pendingPolicyChangeId": "5617ba3c-fb07-437d-9131-232b84bbb863",
  "policyName": "openapi-capture-demo-reject",
  "policyVersion": "1.0.0",
  "proposedContent": {
    "policyId": "openapi-capture-demo-reject",
    "policyVersion": "1.0.0",
    "schemaVersion": "1.0.0",
    "rules": [
      {
        "id": "always-approve",
        "condition": {
          "always": true
        },
        "outcome": {
          "action": "approve",
          "reason": "OpenAPI spec capture fixture"
        }
      }
    ]
  },
  "proposedBy": "human-maker",
  "proposedAt": "2026-09-15T03:48:09.512Z",
  "status": "REJECTED",
  "reason": "Capture a real rejected Pending Policy Change for the OpenAPI spec",
  "resolvedBy": "human-checker",
  "resolvedAt": "2026-09-15T03:48:21.422Z",
  "rejectionReason": "Does not meet the bar for this fixture"
}

{
  "error": "rejectionReason is required."
}

{
  "error": "authentication required"
}

{
  "error": "Pending Policy Change '011c1620-89d9-4bf5-a0b0-356edd566d3f' was proposed by this same caller — the proposer (maker) may not also approve or reject it (checker).",
  "code": "SAME_ACTOR_CANNOT_APPROVE_OWN_CHANGE"
}

{
  "error": "Pending Policy Change '7d5f8a52-0000-4000-8000-000000000000' not found.",
  "code": "PENDING_POLICY_CHANGE_NOT_FOUND"
}

Authorizations

Authorization

string

header

required

A human key (credentialHolderType: USER) issued by the operator. Sent as Authorization: Bearer . The public sandbox and its demo key are refused on these routes, so no key is prefilled here.

Path Parameters

string

required

The pendingPolicyChangeId from the proposal.

Body

application/json

Request body for POST /policies/pending-changes/{id}/reject.

rejectionReason

string

required

Free-text reason. Required, non-empty.

stepUpAuthorization

Policy Change Step-Up Authorization · object

required

Signed envelope proving a checker's explicit, fresh intent to approve or reject one specific Pending Policy Change (Policy Governance, Layer 4). Produced by PolicyChangeStepUpAuthorizationSigner (@parmana/crypto) using the checker's own step-up private key, never the bearer API key. Verified server-side against: the checker's registered stepUpPublicKey, payload.pendingPolicyChangeId matching the URL's {id}, payload.action matching the endpoint (approve vs reject), payload.expiresAt not yet passed, and payload.nonce not previously seen (single-use, replay-rejected on a second attempt with the same envelope).

Show child attributes

Example:

{
  "payload": {
    "version": 1,
    "nonce": "343ee454-92c6-4ef9-9cfe-e98329e51f53",
    "pendingPolicyChangeId": "6f4e4020-adf5-4449-938d-27aab58f66b7",
    "action": "approve",
    "authorizedAt": "2026-09-15T03:47:51.939Z",
    "expiresAt": "2026-09-15T03:49:51.939Z"
  },
  "signature": "keOXnzUk8KcGrQTkpXC4Ki8ps3GTvMANwqq96b+toxba07gjkcmpyL/vaPZ7+pPZ1HAOJOOy3rj5XfhcwOTnAw==",
  "keyId": "human-checker-step-up-key",
  "algorithm": "ed25519"
}

Response

Rejected. The policy in effect did not change.

Response returned by POST /policies/{name}/{version}/pending-changes (201), POST /policies/pending-changes/{id}/approve (200), and POST /policies/pending-changes/{id}/reject (200). A bare Pending Policy Change, no wrapper.

pendingPolicyChangeId

string

required

Unique Pending Policy Change identifier.

policyName

string

required

The policy this proposal targets, same identifier as Policy.policyId.

policyVersion

string

required

The existing version this proposal is a change against ("the version being replaced"). Not necessarily equal to proposedContent's own declared version: an in-place patch and a version bump are both legitimate.

proposedContent

object

required

The full proposed policy.json content, in its entirety, not a diff or patch.

proposedBy

string

required

Identity of the proposer (maker). Always a human-authenticated (credentialHolderType USER) caller.

proposedAt

string<date-time>

required

status

enum<string>

required

Available options:

PENDING_APPROVAL,

APPROVED,

REJECTED

reason

string

required

Free-text justification from the proposer, required at creation.

resolvedBy

string

Identity of the resolver (checker). Absent while PENDING_APPROVAL. Never equal to proposedBy.

resolvedAt

string<date-time>

Absent while PENDING_APPROVAL.

rejectionReason

string

Present only when status is REJECTED.

coverageWarnings

string[]

Present only when non-empty: uncovered-fact warnings from PolicyValidator.findUncoveredFacts against proposedContent.

ruleConflicts

string[]

Present only when non-empty: advisory rule-conflict warnings from PolicyValidator.findRuleConflicts against proposedContent, never blocking.

cURL

# Sign the step up authorization on your own machine first:
#   npx tsx scripts/sign-policy-change-step-up.ts --private-key-file step-up.private.pem \
#     --key-id checker-step-up-1 --pending-policy-change-id ba7c5827-5844-4069-94fc-9b438ef08f78 --action reject > step-up.json
curl -X POST https://parmana-api-real.vercel.app/policies/pending-changes/ba7c5827-5844-4069-94fc-9b438ef08f78/reject \
  -H "Authorization: Bearer $PARMANA_API_KEY" \
  -H "Content-Type: application/json" \
  --data "{\"rejectionReason\": \"The maximum stays at 100000 this quarter.\", \"stepUpAuthorization\": $(cat step-up.json)}"

import { ParmanaClient, signPolicyChangeStepUp } from "@parmana/sdk";
import { readFileSync } from "node:fs";

const client = new ParmanaClient({
  endpoint: "https://parmana-api-real.vercel.app",
  apiKey: process.env.PARMANA_API_KEY!,
});

const stepUp = signPolicyChangeStepUp({
  pendingPolicyChangeId: "ba7c5827-5844-4069-94fc-9b438ef08f78",
  action: "reject",
  privateKeyPem: readFileSync("step-up.private.pem", "utf8"),
  keyId: "checker-step-up-1",
});

const change = await client.rejectPolicyChange(
  "ba7c5827-5844-4069-94fc-9b438ef08f78",
  "The maximum stays at 100000 this quarter.",
  stepUp,
);

console.log(change.status);

import os
from pathlib import Path

from parmana import ParmanaClient
from parmana.crypto import sign_policy_change_step_up

client = ParmanaClient(
    endpoint="https://parmana-api-real.vercel.app",
    api_key=os.environ["PARMANA_API_KEY"],
)

step_up = sign_policy_change_step_up(
    pending_policy_change_id="ba7c5827-5844-4069-94fc-9b438ef08f78",
    action="reject",
    private_key_pem=Path("step-up.private.pem").read_text(),
    key_id="checker-step-up-1",
)

change = client.reject_policy_change(
    "ba7c5827-5844-4069-94fc-9b438ef08f78",
    "The maximum stays at 100000 this quarter.",
    step_up,
)

print(change.status)

const options = {
  method: 'POST',
  headers: {Authorization: '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    rejectionReason: 'Does not meet the bar for this fixture',
    stepUpAuthorization: {
      payload: {
        version: 1,
        nonce: '4807fe45-0379-415b-9455-b8cb84eb5554',
        pendingPolicyChangeId: '5617ba3c-fb07-437d-9131-232b84bbb863',
        action: 'reject',
        authorizedAt: '2026-09-15T03:48:16.755Z',
        expiresAt: '2026-09-15T03:50:16.755Z'
      },
      signature: 'Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==',
      keyId: 'human-checker-step-up-key',
      algorithm: 'ed25519'
    }
  })
};

fetch('https://parmana-api-real.vercel.app/policies/pending-changes/{id}/reject', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://parmana-api-real.vercel.app/policies/pending-changes/{id}/reject",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'rejectionReason' => 'Does not meet the bar for this fixture',
    'stepUpAuthorization' => [
        'payload' => [
                'version' => 1,
                'nonce' => '4807fe45-0379-415b-9455-b8cb84eb5554',
                'pendingPolicyChangeId' => '5617ba3c-fb07-437d-9131-232b84bbb863',
                'action' => 'reject',
                'authorizedAt' => '2026-09-15T03:48:16.755Z',
                'expiresAt' => '2026-09-15T03:50:16.755Z'
        ],
        'signature' => 'Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==',
        'keyId' => 'human-checker-step-up-key',
        'algorithm' => 'ed25519'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://parmana-api-real.vercel.app/policies/pending-changes/{id}/reject"

	payload := strings.NewReader("{\n  \"rejectionReason\": \"Does not meet the bar for this fixture\",\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"4807fe45-0379-415b-9455-b8cb84eb5554\",\n      \"pendingPolicyChangeId\": \"5617ba3c-fb07-437d-9131-232b84bbb863\",\n      \"action\": \"reject\",\n      \"authorizedAt\": \"2026-09-15T03:48:16.755Z\",\n      \"expiresAt\": \"2026-09-15T03:50:16.755Z\"\n    },\n    \"signature\": \"Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://parmana-api-real.vercel.app/policies/pending-changes/{id}/reject")
  .header("Authorization", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"rejectionReason\": \"Does not meet the bar for this fixture\",\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"4807fe45-0379-415b-9455-b8cb84eb5554\",\n      \"pendingPolicyChangeId\": \"5617ba3c-fb07-437d-9131-232b84bbb863\",\n      \"action\": \"reject\",\n      \"authorizedAt\": \"2026-09-15T03:48:16.755Z\",\n      \"expiresAt\": \"2026-09-15T03:50:16.755Z\"\n    },\n    \"signature\": \"Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://parmana-api-real.vercel.app/policies/pending-changes/{id}/reject")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"rejectionReason\": \"Does not meet the bar for this fixture\",\n  \"stepUpAuthorization\": {\n    \"payload\": {\n      \"version\": 1,\n      \"nonce\": \"4807fe45-0379-415b-9455-b8cb84eb5554\",\n      \"pendingPolicyChangeId\": \"5617ba3c-fb07-437d-9131-232b84bbb863\",\n      \"action\": \"reject\",\n      \"authorizedAt\": \"2026-09-15T03:48:16.755Z\",\n      \"expiresAt\": \"2026-09-15T03:50:16.755Z\"\n    },\n    \"signature\": \"Wu5/oibGCjvkTklGQPiDMDemqxCVbSyuoVT7WHW63rGq8Av5KFTW6vMkUCP03pANv8bDu60bZVuVcTDVmLXpDA==\",\n    \"keyId\": \"human-checker-step-up-key\",\n    \"algorithm\": \"ed25519\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "pendingPolicyChangeId": "5617ba3c-fb07-437d-9131-232b84bbb863",
  "policyName": "openapi-capture-demo-reject",
  "policyVersion": "1.0.0",
  "proposedContent": {
    "policyId": "openapi-capture-demo-reject",
    "policyVersion": "1.0.0",
    "schemaVersion": "1.0.0",
    "rules": [
      {
        "id": "always-approve",
        "condition": {
          "always": true
        },
        "outcome": {
          "action": "approve",
          "reason": "OpenAPI spec capture fixture"
        }
      }
    ]
  },
  "proposedBy": "human-maker",
  "proposedAt": "2026-09-15T03:48:09.512Z",
  "status": "REJECTED",
  "reason": "Capture a real rejected Pending Policy Change for the OpenAPI spec",
  "resolvedBy": "human-checker",
  "resolvedAt": "2026-09-15T03:48:21.422Z",
  "rejectionReason": "Does not meet the bar for this fixture"
}

{
  "error": "rejectionReason is required."
}

{
  "error": "authentication required"
}

{
  "error": "Pending Policy Change '011c1620-89d9-4bf5-a0b0-356edd566d3f' was proposed by this same caller — the proposer (maker) may not also approve or reject it (checker).",
  "code": "SAME_ACTOR_CANNOT_APPROVE_OWN_CHANGE"
}

{
  "error": "Pending Policy Change '7d5f8a52-0000-4000-8000-000000000000' not found.",
  "code": "PENDING_POLICY_CHANGE_NOT_FOUND"
}

REST API guide

Execution

Transactions

Verification

Receipts

Trust Records

Replay

Policies

Policy Governance

Approvers

External Connectors

Business Signal Sources

Authority Grants

Sandbox

Kill Switch

Refusal Records

Execution Intents

Audit

System

Handbook

Reject a pending policy change (checker)

Authorizations

Path Parameters

Body

Response