Request spending authority
Returns ALLOW, ASK, or BLOCK for one proposed spending action.
Authorization
shieldApiKey In: header
Header Parameters
Registered integration identity. The server resolves trusted display metadata.
3 <= length <= 120Value in
- "sandbox"
- "production"
8 <= length <= 180Request Body
application/json
Major currency units, for example 89.00 USD.
0 < valueISO 4217 currency code.
^[A-Z]{3}$Clear user-facing reason for spending.
3 <= length <= 2401 <= length <= 1601 <= length <= 80Stable identity for the agent acting inside the registered application.
1 <= length <= 120"PURCHASE"Value in
- "PURCHASE"
- "SUBSCRIPTION"
- "RENEWAL"
- "TRANSFER"
- "REFUND"
- "OTHER"
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/shield/authorize" \ -H "X-Shield-App-Id: string" \ -H "X-Shield-Environment: sandbox" \ -H "Content-Type: application/json" \ -d '{ "amount": 89, "currency": "USD", "purpose": "Book hotel", "merchant": "Hilton", "category": "travel", "agentId": "travel-agent", "transactionType": "PURCHASE" }'{ "verdict": "ALLOW", "allowed": true, "approvalRequired": true, "approvalStatus": "NOT_REQUIRED", "reason": "string", "reasonCode": "string", "requestId": "string", "decisionId": "string", "dossierId": "string", "environment": "sandbox", "advanced": { "policyVersion": "string", "reasonCodes": [ "string" ], "evidenceHash": "string", "signatures": {}, "evaluationMetadata": {} }}Resolve registered Business Central payment evidence context GET
A current ordinary organization key with decision:read and decision:write resolves only its synchronized Accounts workspace and exact active verified company connection with a current revision-bound native read grant. No query parameters or body are accepted. Missing configuration is unavailable; client-supplied organization or provider tenant claims grant no authority. The response contains non-secret registration metadata with basis=persisted_connection_and_native_grant, provider_read_authority=not_checked and execution_available=false, or true only for a connection whose payments Core decides with a single-use permit (the permit path); a permit claimed for one exact payment line, never this flag, lets a payment post. It does not read Microsoft payment facts, refresh Accounts provider authority, open provider credential custody or authorize posting. Existing native provider reads and configuration retain their separate fresh Accounts source and permission checks. Commerce binds subsequent queued assertions to all returned workspace/company/revision fields. Both scopes authorize payment evidence use, not a financial action.
Read the current state of a decision GET
Next Page

