List review policies
const url = 'https://example.com/v1/review-policies';const options = { method: 'GET', headers: {'registry-casework-profile': 'example', Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://example.com/v1/review-policies \ --header 'Authorization: Bearer <token>' \ --header 'registry-casework-profile: example'Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Header Parameters
Section titled “Header Parameters”The caller’s exact governed access profile for this protocol.
Responses
Section titled “Responses”Success
object
object
object
object
The producer-issued contract id, kept exactly as written: nonblank, no control characters, and at most 256 UTF-8 bytes. The byte ceiling is enforced by the Casework reader.
A SHA-256 digest: sha256: followed by 64 lowercase hex digits.
Complete behavioral inputs retained beside an admitted request. Live Directory membership and absence facts remain current authority, not policy inputs.
object
object
A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.
object
A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.
object
The instant a subject clock counts from: anchor: {type: request-accepted}.
object
A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.
object
A number of working days: after: {workingDays: N}, and the lead time
inside before.
object
The instant a stage clock counts from: anchor: {type: stage-entered}.
object
A lead time before a stage clock is due: {before: {workingDays: N}}.
object
A number of working days: after: {workingDays: N}, and the lead time
inside before.
object
A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.
A named reminder, written reminders: {ID: {before: {workingDays: N}}}.
object
A number of working days: after: {workingDays: N}, and the lead time
inside before.
object
A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.
object
object
object
Human-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.
A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.
object
A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.
object
object
object
A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.
Human-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.
object
The agent a template names, as casework.yaml writes it: the issuer is
the URL of the token issuer that authenticates the agent (CFG-VAL-7).
object
An absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.
Immediate authorizations last at most fifteen minutes. Deferred is an explicit governed window of at most seven days; assertion TTL stays sixty seconds.
object
object
object
object
Exact Scheduling commitment authority copied into a task grant.
This duplicates the public wire shape deliberately: Casework is an authority for governed templates, not a dependency on Scheduling’s runtime or model crate.
object
A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.
Human-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.
Policies whose currently held ReviewTasks may issue this grant.
Exact token identity keys mapped to governed source logical fields. Values are extracted from the approving caller’s disclosed source read.
object
object
A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.
Human-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.
object
A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.
The requester profile a person named as this producer’s initiator authenticates with to read the requester-visible history of their own requests. Absent, no initiator reads anything.
An absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.
How long Casework keeps what a producer needs to recover a submission.
object
Days a submission receipt stays readable for recovery, at most 365.
An absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.
object
A SHA-256 digest: sha256: followed by 64 lowercase hex digits.
A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.
object
A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.
Human-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.
Whether a decision with this outcome gives text for release to the subject’s owner. There is no default: the policy author decides what an applicant is told.
object
object
Human-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.
A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.
object
object
object
A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.
Example
[ { "context": { "mode": "submitted" }, "dependencies": { "accessProfiles": [ { "role": "staff" } ], "calendars": [ { "workingWeekdays": [ "monday" ] } ], "clocks": [ { "anchor": { "type": "request-accepted" }, "type": "subject" } ], "contextProvider": { "capabilities": [ "human-display" ], "serviceProfiles": {} }, "inbox": { "defaultPageSize": 25, "maximumCandidateScan": 100, "maximumConcurrentSourceReads": 4, "maximumSourceReads": 25, "pageDeadlineMilliseconds": 2000 }, "taskTemplates": [ { "authorizationMode": "immediate", "bounds": { "type": "evidence" } } ] }, "outcomes": [ { "publicReason": "required", "settlement": "approved" } ], "purpose": "approval", "stages": [ { "excludeInitiator": false, "excludePreviousStageReviewers": false, "negativeDecisions": "settle" } ] }]Headers
Section titled “Headers”W3C trace context.
Problem: cursor.invalid, request.invalid, request.limit-out-of-range, source-profile.not-applicable, source-profile.required
object
object
object
object
object
Example
{ "code": "cursor.invalid", "detail": "The cursor is invalid for this request.", "status": 400, "title": "Cursor invalid", "type": "https://id.registrystack.org/problems/registry-casework/cursor/invalid"}Headers
Section titled “Headers”W3C trace context.
Problem: authentication.refused
object
Example
{ "code": "authentication.refused", "detail": "The bearer credential is missing, invalid, or expired. Sign in again.", "status": 401, "title": "Authentication refused", "type": "https://id.registrystack.org/problems/registry-casework/authentication/refused"}Headers
Section titled “Headers”W3C trace context.
Problem: operation.not-authorized, profile.not-authorized, profile.not-human
object
object
object
Example
{ "code": "operation.not-authorized", "detail": "Your current Casework authority does not allow this operation.", "status": 403, "title": "Operation not authorized", "type": "https://id.registrystack.org/problems/registry-casework/operation/not-authorized"}Headers
Section titled “Headers”W3C trace context.
Problem: request.not-found
object
Example
{ "code": "request.not-found", "detail": "The requested Casework route does not exist.", "status": 404, "title": "Route not found", "type": "https://id.registrystack.org/problems/registry-casework/request/not-found"}Headers
Section titled “Headers”W3C trace context.
Problem: cursor.expired, review.result-expired
object
object
Example
{ "code": "cursor.expired", "detail": "This cursor has expired. Start again without a cursor and deduplicate entries by eventId.", "status": 410, "title": "Cursor expired", "type": "https://id.registrystack.org/problems/registry-casework/cursor/expired"}Headers
Section titled “Headers”W3C trace context.
Problem: request.body-too-large
object
Example
{ "code": "request.body-too-large", "detail": "The request body exceeds the one MiB limit.", "status": 413, "title": "Request body too large", "type": "https://id.registrystack.org/problems/registry-casework/request/body-too-large"}Headers
Section titled “Headers”W3C trace context.
Problem: request.unsupported-media-type
object
Example
{ "code": "request.unsupported-media-type", "detail": "Send a JSON request body with Content-Type application/json.", "status": 415, "title": "Unsupported media type", "type": "https://id.registrystack.org/problems/registry-casework/request/unsupported-media-type"}Headers
Section titled “Headers”W3C trace context.
Problem: request.unprocessable
object
Example
{ "code": "request.unprocessable", "detail": "The request body does not match the Casework contract.", "status": 422, "title": "Request could not be processed", "type": "https://id.registrystack.org/problems/registry-casework/request/unprocessable"}Headers
Section titled “Headers”W3C trace context.
Problem: runtime.failure
object
Example
{ "code": "runtime.failure", "detail": "Casework could not complete the request.", "status": 500, "title": "Casework runtime failure", "type": "https://id.registrystack.org/problems/registry-casework/runtime/failure"}Headers
Section titled “Headers”W3C trace context.
Problem: source.bad-gateway, source.version-mismatch, source.version-unavailable
object
object
object
Example
{ "code": "source.bad-gateway", "detail": "The source returned a response that does not match its registered contract.", "status": 502, "title": "Invalid source response", "type": "https://id.registrystack.org/problems/registry-casework/source/bad-gateway"}Headers
Section titled “Headers”W3C trace context.
Problem: service.unavailable
object
Example
{ "code": "service.unavailable", "detail": "Casework storage is unavailable. Try again after the service recovers.", "status": 503, "title": "Casework service unavailable", "type": "https://id.registrystack.org/problems/registry-casework/service/unavailable"}Headers
Section titled “Headers”W3C trace context.