Create or recover review request

POST

/v1/review-requests

const url = 'https://example.com/v1/review-requests';
const options = {
  method: 'POST',
  headers: {
    'registry-review-profile': 'example',
    'Idempotency-Key': 'example',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: '{"context":{"mode":"submitted","snapshot":{}},"initiator":{"issuer":"example","subject":"example"},"policy":{"digest":"example","id":"example","version":"example"},"requesterReference":"example","resultConstraints":{},"subject":{"digest":"example","id":"example","source":"example","type":"example","version":"example"}}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://example.com/v1/review-requests \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: example' \
  --header 'registry-review-profile: example' \
  --data '{ "context": { "mode": "submitted", "snapshot": {} }, "initiator": { "issuer": "example", "subject": "example" }, "policy": { "digest": "example", "id": "example", "version": "example" }, "requesterReference": "example", "resultConstraints": {}, "subject": { "digest": "example", "id": "example", "source": "example", "type": "example", "version": "example" } }'

Recovery repeats the exact request and caller-supplied idempotency key. Clients do not retry mutations implicitly.

Authorizations

bearerAuth

Parameters

Header Parameters

traceparent

string

registry-review-profile

required

string

>= 1 characters <= 128 characters /^[A-Za-z0-9._:-]+$/

The caller’s exact governed access profile for this protocol.

Idempotency-Key

required

string

>= 1 characters <= 128 characters /^[!-~]+$/

Retain this exact key and request bytes for explicit recovery.

Request Body^required

application/json

object

context

required

One of:

object
object

object

mode

required

string

Allowed value: submitted

snapshot

required

object

key

additional properties

any

initiator

Any of:

object
null

object

issuer

required

string

subject

required

string

policy

required

Select the trusted provider’s current policy, or require one exact binding. The selector stays in the submission identity; acceptance records the concrete binding.

object

digest

string

>= 71 characters <= 71 characters /^sha256:[0-9a-f]{64}$/

required

string

version

string

requesterReference

required

string

resultConstraints

object

key

additional properties

any

subject

required

object

digest

required

string

>= 71 characters <= 71 characters /^sha256:[0-9a-f]{64}$/

required

string

source

required

string

type

required

string

version

required

string

Responses

200

Success

application/json

object

policy

required

object

digest

required

string

>= 71 characters <= 71 characters /^sha256:[0-9a-f]{64}$/

required

string

version

required

string

requestId

required

string format: uuid

subject

required

object

digest

required

string

>= 71 characters <= 71 characters /^sha256:[0-9a-f]{64}$/

required

string

source

required

string

type

required

string

version

required

string

submissionDigest

required

string

>= 71 characters <= 71 characters /^sha256:[0-9a-f]{64}$/

Example ^generated

{
  "policy": {
    "digest": "example",
    "id": "example",
    "version": "example"
  },
  "requestId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "subject": {
    "digest": "example",
    "id": "example",
    "source": "example",
    "type": "example",
    "version": "example"
  },
  "submissionDigest": "example"
}

Headers

Registry-Review-Producer

string

>= 1 characters <= 128 characters /^[A-Za-z0-9_.:-]+$/

Authenticated trusted producer identity for this acceptance or exact recovery. Optional for compatibility with older providers; never a substitute for the submission digest.

traceparent

string

W3C trace context.

201

Success

application/json

object

policy

required

object

digest

required

string

>= 71 characters <= 71 characters /^sha256:[0-9a-f]{64}$/

required

string

version

required

string

requestId

required

string format: uuid

subject

required

object

digest

required

string

>= 71 characters <= 71 characters /^sha256:[0-9a-f]{64}$/

required

string

source

required

string

type

required

string

version

required

string

submissionDigest

required

string

>= 71 characters <= 71 characters /^sha256:[0-9a-f]{64}$/

Example ^generated

{
  "policy": {
    "digest": "example",
    "id": "example",
    "version": "example"
  },
  "requestId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "subject": {
    "digest": "example",
    "id": "example",
    "source": "example",
    "type": "example",
    "version": "example"
  },
  "submissionDigest": "example"
}

Headers

Registry-Review-Producer

string

>= 1 characters <= 128 characters /^[A-Za-z0-9_.:-]+$/

Authenticated trusted producer identity for this acceptance or exact recovery. Optional for compatibility with older providers; never a substitute for the submission digest.

traceparent

string

W3C trace context.

400

Problem: request.invalid, source-profile.not-applicable, source-profile.required

application/problem+json

One of:

object

code

required

string

detail

required

string

status

required

integer

title

required

string

traceId

required

string

type

required

string

code

required

Allowed value: request.invalid

detail

required

Allowed value: The Casework request is invalid.

status

required

Allowed value: 400

title

required

Allowed value: Invalid request

type

required

Allowed value: https://id.registrystack.org/problems/registry-casework/request/invalid

Example

{
  "code": "request.invalid",
  "detail": "The Casework request is invalid.",
  "status": 400,
  "title": "Invalid request",
  "type": "https://id.registrystack.org/problems/registry-casework/request/invalid"
}

Headers

Registry-Review-Validation-Path

string

<= 256 characters

Bounded value-free JSON path; present together with the validation reason.

Registry-Review-Validation-Reason

string

Allowed values: policy-not-allowed reference-invalid object-required maximum-bytes-exceeded maximum-depth-exceeded schema-mismatch outcome-not-declared reason-required text-invalid result-not-declared result-required field-not-declared constraint-invalid constraint-violated public-reason-required public-reason-not-declared approval-outcome-differs

Closed value-free validation category; present together with the validation path.

traceparent

string

W3C trace context.

401

Problem: authentication.refused

application/problem+json

object

code

required

string

detail

required

string

status

required

integer

title

required

string

traceId

required

string

type

required

string

code

required

Allowed value: authentication.refused

detail

required

Allowed value: The bearer credential is missing, invalid, or expired. Sign in again.

status

required

Allowed value: 401

title

required

Allowed value: Authentication refused

type

required

Allowed value: https://id.registrystack.org/problems/registry-casework/authentication/refused

Example

{
  "code": "authentication.refused",
  "detail": "The bearer credential is missing, invalid, or expired. Sign in again.",
  "status": 401,
  "title": "Authentication refused",
  "type": "https://id.registrystack.org/problems/registry-casework/authentication/refused"
}

Headers

WWW-Authenticate

Allowed value: Bearer

traceparent

string

W3C trace context.

403

Problem: operation.not-authorized, profile.not-authorized, profile.not-human, review.distinct-approver-required, review.initiator-excluded

application/problem+json

One of:

object

code

required

string

detail

required

string

status

required

integer

title

required

string

traceId

required

string

type

required

string

code

required

Allowed value: operation.not-authorized

detail

required

Allowed value: Your current Casework authority does not allow this operation.

status

required

Allowed value: 403

title

required

Allowed value: Operation not authorized

type

required

Allowed value: https://id.registrystack.org/problems/registry-casework/operation/not-authorized

Example

{
  "code": "operation.not-authorized",
  "detail": "Your current Casework authority does not allow this operation.",
  "status": 403,
  "title": "Operation not authorized",
  "type": "https://id.registrystack.org/problems/registry-casework/operation/not-authorized"
}

Headers

traceparent

string

W3C trace context.

404

Problem: request.not-found

application/problem+json

object

code

required

string

detail

required

string

status

required

integer

title

required

string

traceId

required

string

type

required

string

code

required

Allowed value: request.not-found

detail

required

Allowed value: The requested Casework route does not exist.

status

required

Allowed value: 404

title

required

Allowed value: Route not found

type

required

Allowed value: https://id.registrystack.org/problems/registry-casework/request/not-found

Example

{
  "code": "request.not-found",
  "detail": "The requested Casework route does not exist.",
  "status": 404,
  "title": "Route not found",
  "type": "https://id.registrystack.org/problems/registry-casework/request/not-found"
}

Headers

traceparent

string

W3C trace context.

409

Problem: idempotency.key-reused, review.policy-mismatch, review.submission-conflict, review.task-not-held

application/problem+json

One of:

object

code

required

string

detail

required

string

status

required

integer

title

required

string

traceId

required

string

type

required

string

code

required

Allowed value: idempotency.key-reused

detail

required

Allowed value: This idempotency key was used for a different request.

status

required

Allowed value: 409

title

required

Allowed value: Idempotency key reused

type

required

Allowed value: https://id.registrystack.org/problems/registry-casework/idempotency/key-reused

Example

{
  "code": "idempotency.key-reused",
  "detail": "This idempotency key was used for a different request.",
  "status": 409,
  "title": "Idempotency key reused",
  "type": "https://id.registrystack.org/problems/registry-casework/idempotency/key-reused"
}

Headers

traceparent

string

W3C trace context.

410

Problem: idempotency.expired, review.result-expired

application/problem+json

One of:

object
object

object

code

required

string

detail

required

string

status

required

integer

title

required

string

traceId

required

string

type

required

string

code

required

Allowed value: idempotency.expired

detail

required

Allowed value: The stored response for this idempotency key has expired. Reconcile the original operation before choosing a new key.

status

required

Allowed value: 410

title

required

Allowed value: Idempotency window expired

type

required

Allowed value: https://id.registrystack.org/problems/registry-casework/idempotency/expired

Example

{
  "code": "idempotency.expired",
  "detail": "The stored response for this idempotency key has expired. Reconcile the original operation before choosing a new key.",
  "status": 410,
  "title": "Idempotency window expired",
  "type": "https://id.registrystack.org/problems/registry-casework/idempotency/expired"
}

Headers

traceparent

string

W3C trace context.

412

Problem: precondition.failed

application/problem+json

object

code

required

string

detail

required

string

status

required

integer

title

required

string

traceId

required

string

type

required

string

code

required

Allowed value: precondition.failed

detail

required

Allowed value: The item or directory changed since you loaded it. Reload and try again.

status

required

Allowed value: 412

title

required

Allowed value: Precondition failed

type

required

Allowed value: https://id.registrystack.org/problems/registry-casework/precondition/failed

Example

{
  "code": "precondition.failed",
  "detail": "The item or directory changed since you loaded it. Reload and try again.",
  "status": 412,
  "title": "Precondition failed",
  "type": "https://id.registrystack.org/problems/registry-casework/precondition/failed"
}

Headers

traceparent

string

W3C trace context.

413

Problem: request.body-too-large

application/problem+json

object

code

required

string

detail

required

string

status

required

integer

title

required

string

traceId

required

string

type

required

string

code

required

Allowed value: request.body-too-large

detail

required

Allowed value: The request body exceeds the one MiB limit.

status

required

Allowed value: 413

title

required

Allowed value: Request body too large

type

required

Allowed value: https://id.registrystack.org/problems/registry-casework/request/body-too-large

Example

{
  "code": "request.body-too-large",
  "detail": "The request body exceeds the one MiB limit.",
  "status": 413,
  "title": "Request body too large",
  "type": "https://id.registrystack.org/problems/registry-casework/request/body-too-large"
}

Headers

traceparent

string

W3C trace context.

415

Problem: request.unsupported-media-type

application/problem+json

object

code

required

string

detail

required

string

status

required

integer

title

required

string

traceId

required

string

type

required

string

code

required

Allowed value: request.unsupported-media-type

detail

required

Allowed value: Send a JSON request body with Content-Type application/json.

status

required

Allowed value: 415

title

required

Allowed value: Unsupported media type

type

required

Allowed value: https://id.registrystack.org/problems/registry-casework/request/unsupported-media-type

Example

{
  "code": "request.unsupported-media-type",
  "detail": "Send a JSON request body with Content-Type application/json.",
  "status": 415,
  "title": "Unsupported media type",
  "type": "https://id.registrystack.org/problems/registry-casework/request/unsupported-media-type"
}

Headers

traceparent

string

W3C trace context.

422

Problem: absence.cover-cycle, absence.invalid-period, absence.overlap, absence.self-cover, request.unprocessable, review.initiator-required

application/problem+json

One of:

object

code

required

string

detail

required

string

status

required

integer

title

required

string

traceId

required

string

type

required

string

code

required

Allowed value: absence.cover-cycle

detail

required

Allowed value: Choose cover assignments that do not return to an earlier person during a shared period.

status

required

Allowed value: 422

title

required

Allowed value: Absence cover cycle

type

required

Allowed value: https://id.registrystack.org/problems/registry-casework/absence/cover-cycle

Example

{
  "code": "absence.cover-cycle",
  "detail": "Choose cover assignments that do not return to an earlier person during a shared period.",
  "status": 422,
  "title": "Absence cover cycle",
  "type": "https://id.registrystack.org/problems/registry-casework/absence/cover-cycle"
}

Headers

traceparent

string

W3C trace context.

428

Problem: precondition.required

application/problem+json

object

code

required

string

detail

required

string

status

required

integer

title

required

string

traceId

required

string

type

required

string

code

required

Allowed value: precondition.required

detail

required

Allowed value: This mutation requires the revision that you loaded.

status

required

Allowed value: 428

title

required

Allowed value: Precondition required

type

required

Allowed value: https://id.registrystack.org/problems/registry-casework/precondition/required

Example

{
  "code": "precondition.required",
  "detail": "This mutation requires the revision that you loaded.",
  "status": 428,
  "title": "Precondition required",
  "type": "https://id.registrystack.org/problems/registry-casework/precondition/required"
}

Headers

traceparent

string

W3C trace context.

500

Problem: runtime.failure

application/problem+json

object

code

required

string

detail

required

string

status

required

integer

title

required

string

traceId

required

string

type

required

string

code

required

Allowed value: runtime.failure

detail

required

Allowed value: Casework could not complete the request.

status

required

Allowed value: 500

title

required

Allowed value: Casework runtime failure

type

required

Allowed value: https://id.registrystack.org/problems/registry-casework/runtime/failure

Example

{
  "code": "runtime.failure",
  "detail": "Casework could not complete the request.",
  "status": 500,
  "title": "Casework runtime failure",
  "type": "https://id.registrystack.org/problems/registry-casework/runtime/failure"
}

Headers

traceparent

string

W3C trace context.

502

Problem: source.bad-gateway, source.version-mismatch, source.version-unavailable

application/problem+json

One of:

object

code

required

string

detail

required

string

status

required

integer

title

required

string

traceId

required

string

type

required

string

code

required

Allowed value: source.bad-gateway

detail

required

Allowed value: The source returned a response that does not match its registered contract.

status

required

Allowed value: 502

title

required

Allowed value: Invalid source response

type

required

Allowed value: https://id.registrystack.org/problems/registry-casework/source/bad-gateway

Example

{
  "code": "source.bad-gateway",
  "detail": "The source returned a response that does not match its registered contract.",
  "status": 502,
  "title": "Invalid source response",
  "type": "https://id.registrystack.org/problems/registry-casework/source/bad-gateway"
}

Headers

traceparent

string

W3C trace context.

503

Problem: service.unavailable

application/problem+json

object

code

required

string

detail

required

string

status

required

integer

title

required

string

traceId

required

string

type

required

string

code

required

Allowed value: service.unavailable

detail

required

Allowed value: Casework storage is unavailable. Try again after the service recovers.

status

required

Allowed value: 503

title

required

Allowed value: Casework service unavailable

type

required

Allowed value: https://id.registrystack.org/problems/registry-casework/service/unavailable

Example

{
  "code": "service.unavailable",
  "detail": "Casework storage is unavailable. Try again after the service recovers.",
  "status": 503,
  "title": "Casework service unavailable",
  "type": "https://id.registrystack.org/problems/registry-casework/service/unavailable"
}

Headers

Retry-After

integer

traceparent

string

W3C trace context.

Create or recover review request

Authorizations

Parameters

Header Parameters

Request Bodyrequired

Responses

200

Example generated

Headers

201

Example generated

Headers

400

Example

Headers

401

Example

Headers

403

Example

Headers

404

Example

Headers

409

Example

Headers

410

Example

Headers

412

Example

Headers

413

Example

Headers

415

Example

Headers

422

Example

Headers

428

Example

Headers

500

Example

Headers

502

Example

Headers

503

Example

Headers

Request Body^required

Example ^generated

Example ^generated