An applicant asked only for read access but can use every scope allowed by the policy. Trace how a request captures its scopes and how authorization consumes them. Preserve least privilege without rejecting valid applications.
API Contract DebuggingTemporary access desk
Work through a real codebase.
Choose an environment, investigate the existing implementation and use the tests to check your change. Sign in to open a workspace; execution and Ono usage follow your plan’s allowances.
pending takes actor and lists only pending requests owned by that policy owner, within the tenant, sorted by request ID.
create takes id, owner, scopes, ttl and optional quorum (1–5). revise requires the owner and expectedRevision. Policy TTL must be positive.
open takes id, policy, applicant, scopes and now. It freezes the policy revision and duration. Requested scopes must be a nonempty subset of the policy; later policy edits do not change open requests.
decide takes actor and approve/deny verdict. Applicants cannot review themselves. Each reviewer has one current decision; repeating a decision does not create another vote.
activate requires the captured policy owner, enough distinct approvals, no denial and now at or after openedAt. Expiry equals activation time plus captured TTL. Only pending requests activate.
check allows only an active grant, its applicant, a requested scope and now strictly before expiry. list includes only the caller’s active, unexpired grants in their tenant, ordered by expiry then ID.
cancel is applicant-only and pending-only. revoke is policy-owner-only and active-only. Neither cancelled nor revoked requests can be activated again.
Each command includes op and tenant. IDs are scoped to a tenant. A request is limited to 200 commands. Commands run in order; one failed command does not stop the rest. The live workspace API persists state across requests; /run creates a disposable test workspace.
Mutations and audit entries commit together. failAudit simulates an unavailable audit writer and must roll back the command. Read operations never write an audit entry.
The optional request field makes mutation retries idempotent within a tenant. The same request and payload return the saved result. Reusing it with changed fields returns request-conflict. failAudit is excluded from payload comparison.
The response is {results:[...]}. Each result is {ok:true,value:...} or {ok:false,error:...}. The history command returns tenant-scoped audit entries with the successful mutation revision.
pending takes actor and lists only pending requests owned by that policy owner, within the tenant, sorted by request ID.
create takes id, owner, scopes, ttl and optional quorum (1–5). revise requires the owner and expectedRevision. Policy TTL must be positive.
open takes id, policy, applicant, scopes and now. It freezes the policy revision and duration. Requested scopes must be a nonempty subset of the policy; later policy edits do not change open requests.
decide takes actor and approve/deny verdict. Applicants cannot review themselves. Each reviewer has one current decision; repeating a decision does not create another vote.
activate requires the captured policy owner, enough distinct approvals, no denial and now at or after openedAt. Expiry equals activation time plus captured TTL. Only pending requests activate.
check allows only an active grant, its applicant, a requested scope and now strictly before expiry. list includes only the caller’s active, unexpired grants in their tenant, ordered by expiry then ID.
cancel is applicant-only and pending-only. revoke is policy-owner-only and active-only. Neither cancelled nor revoked requests can be activated again.
Each command includes op and tenant. IDs are scoped to a tenant. A request is limited to 200 commands. Commands run in order; one failed command does not stop the rest. The live workspace API persists state across requests; /run creates a disposable test workspace.
Mutations and audit entries commit together. failAudit simulates an unavailable audit writer and must roll back the command. Read operations never write an audit entry.
The optional request field makes mutation retries idempotent within a tenant. The same request and payload return the saved result. Reusing it with changed fields returns request-conflict. failAudit is excluded from payload comparison.
The response is {results:[...]}. Each result is {ok:true,value:...} or {ok:false,error:...}. The history command returns tenant-scoped audit entries with the successful mutation revision.
pending takes actor and lists only pending requests owned by that policy owner, within the tenant, sorted by request ID.
create takes id, owner, scopes, ttl and optional quorum (1–5). revise requires the owner and expectedRevision. Policy TTL must be positive.
open takes id, policy, applicant, scopes and now. It freezes the policy revision and duration. Requested scopes must be a nonempty subset of the policy; later policy edits do not change open requests.
decide takes actor and approve/deny verdict. Applicants cannot review themselves. Each reviewer has one current decision; repeating a decision does not create another vote.
activate requires the captured policy owner, enough distinct approvals, no denial and now at or after openedAt. Expiry equals activation time plus captured TTL. Only pending requests activate.
check allows only an active grant, its applicant, a requested scope and now strictly before expiry. list includes only the caller’s active, unexpired grants in their tenant, ordered by expiry then ID.
cancel is applicant-only and pending-only. revoke is policy-owner-only and active-only. Neither cancelled nor revoked requests can be activated again.
Each command includes op and tenant. IDs are scoped to a tenant. A request is limited to 200 commands. Commands run in order; one failed command does not stop the rest. The live workspace API persists state across requests; /run creates a disposable test workspace.
Mutations and audit entries commit together. failAudit simulates an unavailable audit writer and must roll back the command. Read operations never write an audit entry.
The optional request field makes mutation retries idempotent within a tenant. The same request and payload return the saved result. Reusing it with changed fields returns request-conflict. failAudit is excluded from payload comparison.
The response is {results:[...]}. Each result is {ok:true,value:...} or {ok:false,error:...}. The history command returns tenant-scoped audit entries with the successful mutation revision.