Skip to main content
GET
Get a Refusal Record by transaction ID

Authorizations

Authorization
string
header
required

Caller API key issued by scripts/generate-api-key.ts. Sent as Authorization: Bearer . Verified against a stored SHA-256 hash in constant time by packages/api/src/auth/StaticKeyAuthenticator.ts. Required on every route not listed as exempt in this document's top-level description. See /api-reference/authentication.

Path Parameters

businessTransactionId
string
required

Response

Refusal Record found.

Durable, signed, independently verifiable evidence that a policy decision rejected a transaction (RFC-0021). Scope is deliberately narrow: covers PolicyEngine.evaluate REJECTs and SignalIntentBinder binding-violation REJECTs only, not caller-authentication failures or webhook signature failures, which are a separate, unsigned audit-sink capability. At most one Refusal Record exists per businessTransactionId.

refusalRecordId
string
required

Unique Refusal Record identifier.

businessTransactionId
string
required

Business Transaction this refusal is about.

decision
Decision · object
required

Immutable result of evaluating an Intent against a Policy. Decision does not create authority, grant authorization, or modify Intent; it only records the outcome of deterministic Policy evaluation.

Example:
evaluatedIntent
object
required

The Intent snapshot the signals were evaluated against: target and parameters only, present for every refusal, not only binding violations.

refusalRecordHash
string
required

Canonical hash of this Refusal Record, same convention as ExecutionTrustRecord.trustRecordHash.

signature
object
required

Cryptographic signature over the canonical Refusal Record, signed with the same key as ExecutionTrustRecord, one root of trust for both approvals and refusals.

createdAt
string<date-time>
required

UTC timestamp when this Refusal Record was created.

bindingViolations
object[]

Present only when the rejection came from SignalIntentBinder. Absent (not an empty array) for an ordinary PolicyEngine.evaluate REJECT that never reached binding-violation logic at all.

submittedBy
string

Authenticated caller who submitted the rejected request. Absent when caller authentication is disabled.