Agent-readable docs index: /llms.txt. Full docs in one file: /llms-full.txt. Download /docs.zip to grep all markdown files locally.

Execute a permitted operation

/api/v1/operationPOST
Requires both the scoped service credential and an exact unexpired step permit. The adapter claims an issued permit and consumes it atomically with the protected local effect. Unknown operations revoke authority. Example IDs are placeholders, not executable permits.
Examples are synthetic and illustrate response shape; IDs, signatures, and credentials are not usable authority.
Authorization
serviceBearer *Bearer <token>
Scoped restricted-service session minted by trusted runtime. Cannot be used on owner routes.
Request Bodyapplication/jsonrequired
action *object
Show properties
kind *"navigate" | "observe" | "click" | "fill" | "select" | "service"
operationId *string
Min length: 1Max length: 100
targetRef?string
Max length: 200
url?string
Max length: 500
value?string
Max length: 1000
args?object
Default: {}
Response
200 · Successful response. A paused run is an application outcome, not an HTTP error.
id *string
runId *string
permitId *string
action *object
Show properties
kind *"navigate" | "observe" | "click" | "fill" | "select" | "service"
operationId *string
Min length: 1Max length: 100
targetRef?string
Max length: 200
url?string
Max length: 500
value?string
Max length: 1000
args?object
Default: {}
operationId *string
protectedOperationId *stringnull
result *object
discrepancies *string[]
observation *object
Show properties
id *string
origin *string
documentEpoch *number
stateRevision *number
runId *string
stage *string
data *object
targets *object[]
Show item properties
id *string
label *string
operationId *string
kind *"navigate" | "observe" | "click" | "fill" | "select" | "service"
targetRef *string
args *object
disclosedFields *string[]
postconditions *string[]
protected *boolean
value?string
url?string
actionCatalog *object[]
Show item properties
id *string
label *string
operationId *string
kind *"navigate" | "observe" | "click" | "fill" | "select" | "service"
targetRef *string
args *object
disclosedFields *string[]
postconditions *string[]
protected *boolean
value?string
url?string
createdAt *string
createdAt *string
400 · Request validation failed.
error *string
reasonCode?string
403 · Action differs from the exact permitted action.
error *string
reasonCode?string
500 · The local service could not complete this request.
error *string
reasonCode?string
Request example
curl -X POST "https://bank.example.com/api/v1/operation" \
  -H "x-step-permit: 66666666-6666-4666-8666-666666666666" \
  -H "x-idempotency-key: docs-transfer-1" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
  "action": {
    "kind": "service",
    "operationId": "bank.beneficiary",
    "args": {}
  }
}'
Response example
{
  "id": "99999999-9999-4999-8999-999999999999",
  "runId": "11111111-1111-4111-8111-111111111111",
  "permitId": "66666666-6666-4666-8666-666666666666",
  "action": {
    "kind": "service",
    "operationId": "bank.beneficiary",
    "args": {}
  },
  "operationId": "bank.beneficiary",
  "protectedOperationId": "bank.beneficiary",
  "result": {
    "beneficiary": "beneficiary-cedar",
    "beneficiaryName": "Cedar Studio"
  },
  "createdAt": "2026-10-26T12:00:00.000Z",
  "discrepancies": [],
  "observation": {
    "id": "44444444-4444-4444-8444-444444444444",
    "origin": "http://127.0.0.1:4302",
    "documentEpoch": 1,
    "stateRevision": 1,
    "runId": "11111111-1111-4111-8111-111111111111",
    "stage": "inspected",
    "data": {},
    "targets": [
      {
        "id": "bank.beneficiary",
        "label": "Verify beneficiary",
        "operationId": "bank.beneficiary",
        "kind": "click",
        "targetRef": "frozen-bank:observation:bank.beneficiary",
        "args": {},
        "disclosedFields": [
          "terms"
        ],
        "postconditions": [
          "Necessary task information disclosed"
        ],
        "protected": true
      }
    ],
    "actionCatalog": [
      {
        "id": "bank.beneficiary",
        "label": "Verify beneficiary",
        "operationId": "bank.beneficiary",
        "kind": "click",
        "targetRef": "frozen-bank:observation:bank.beneficiary",
        "args": {},
        "disclosedFields": [
          "terms"
        ],
        "postconditions": [
          "Necessary task information disclosed"
        ],
        "protected": true
      }
    ],
    "createdAt": "2026-10-26T12:00:00.000Z"
  }
}