Get scoped capabilities

/api/v1/capabilitiesGET

The session token selects a run. The caller cannot pass a different run ID or mint its own authority.

Examples are synthetic and illustrate response shape; IDs, signatures, and credentials are not usable authority.

Authorization

serviceBearer *Bearer <token>

Scoped restricted-service session minted by trusted runtime. Cannot be used on owner routes.

Response

200 · Successful response. A paused run is an application outcome, not an HTTP error.

service *"merchant" | "bank" | "broker"

version *string

actionCatalog *object[]

Show item properties

id *string

label *string

operationId *string

targetRef *string

args *object

disclosedFields *string[]

postconditions *string[]

protected *boolean

value?string

url?string

400 · Request validation failed.

error *string

reasonCode?string

403 · Exact service origin required.

error *string

reasonCode?string

500 · The local service could not complete this request.

error *string

reasonCode?string

Request example

curl -X GET "https://bank.example.com/api/v1/capabilities" \
  -H "Authorization: Bearer <token>"

Response example

{
  "service": "bank",
  "version": "1.0.0",
  "actionCatalog": [
    {
      "id": "bank.beneficiary",
      "label": "Verify beneficiary",
      "operationId": "bank.beneficiary",
      "kind": "click",
      "targetRef": "frozen-bank:observation:bank.beneficiary",
      "args": {},
      "disclosedFields": [
        "terms"
      ],
      "postconditions": [
        "Necessary task information disclosed"
      ],
      "protected": true
    }
  ]
}