Get a Refusal Record by transaction ID
Looks up a Refusal Record by businessTransactionId from Parmana’s own storage. Unlike POST /refusal/verify, this route stays behind caller authentication and ownership scoping identically to GET /verify, GET /verification/, and GET /trust-records/: the underlying transaction content (signals, intent parameters) may be sensitive, so lookup is scoped even though independent signature verification (the other route) is not.
Authorizations
Caller API key issued by scripts/generate-api-key.ts. Sent as Authorization: Bearer . Verified against a stored SHA-256 hash in constant time by packages/api/src/auth/StaticKeyAuthenticator.ts. Required on every route not listed as exempt in this document's top-level description. See /api-reference/authentication.
Path Parameters
Response
Refusal Record found.
Durable, signed, independently verifiable evidence that a policy decision rejected a transaction (RFC-0021). Scope is deliberately narrow: covers PolicyEngine.evaluate REJECTs and SignalIntentBinder binding-violation REJECTs only, not caller-authentication failures or webhook signature failures, which are a separate, unsigned audit-sink capability. At most one Refusal Record exists per businessTransactionId.
Unique Refusal Record identifier.
Business Transaction this refusal is about.
Immutable result of evaluating an Intent against a Policy. Decision does not create authority, grant authorization, or modify Intent; it only records the outcome of deterministic Policy evaluation.
The Intent snapshot the signals were evaluated against: target and parameters only, present for every refusal, not only binding violations.
Canonical hash of this Refusal Record, same convention as ExecutionTrustRecord.trustRecordHash.
Cryptographic signature over the canonical Refusal Record, signed with the same key as ExecutionTrustRecord, one root of trust for both approvals and refusals.
UTC timestamp when this Refusal Record was created.
Present only when the rejection came from SignalIntentBinder. Absent (not an empty array) for an ordinary PolicyEngine.evaluate REJECT that never reached binding-violation logic at all.
Authenticated caller who submitted the rejected request. Absent when caller authentication is disabled.