Read your test acceptance

Parameters

idpath · required · string

Confirmation ID returned when requesting the acceptance.

Example request

curl --request GET 'https://commitscale.com/api/v1/tests/acceptances/019a1f40-7c00-7000-8000-000000000004' \
  --header "Authorization: Bearer $CSCALE_TOKEN"

Example values illustrate the format. Use your own credentials and identifiers.

Responses

200 The same envelope on every read after confirmation.

application/json

{
  "confirmation": {
    "action": "create_check_key",
    "confirmed_at": "2026-10-26T10:00:00Z",
    "created_at": "2026-10-26T10:00:00Z",
    "expires_at": "2026-10-26T10:00:00Z",
    "id": "019a1f40-7c00-7000-8000-000000000004",
    "person": "user:alex",
    "title": "Create a check key",
    "url": "https://commitscale.com/confirm/019a1f40-7c00-7000-8000-000000000004"
  },
  "envelope": {
    "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEifQ==",
    "payloadType": "application/vnd.in-toto+json",
    "signatures": [
      {
        "keyid": "acceptance-2026-10",
        "sig": "AQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5Ojs8PT4/QA=="
      }
    ]
  }
}

confirmationrequired · object

The pending or completed passkey confirmation for these exact statement bytes.

Fields of confirmation

actionrequired · string

The protected action being confirmed.

agentoptional · string

The agent requesting this action, when applicable.

confirmed_atrequired · string or null (date-time)

When the person confirmed, in UTC; null while awaiting confirmation.

consentoptional · object

The question and choice the person is being asked to confirm.

Fields of consent

The agent reports these words. They are masked before being stored.

answerrequired · string

The answer the person is choosing.

questionrequired · string

The exact question presented to the person.

created_atrequired · string (date-time)

When it was asked. Read leniently, so a client still reads a server from before it.

declined_atoptional · string (date-time)

When its owner declined it. Declining ends it, so it expired then too.

detailsoptional · array of object

Separately labelled fields to read before confirming with a passkey.

Fields of details

Separately labelled fields to read before confirming with a passkey.

Each item has this shape.

labelrequired · string

Label of a fact shown during confirmation.

valuerequired · string

Value shown for that fact.

expires_atrequired · string (date-time)

When this credential or request expires, in UTC.

idrequired · string

Opaque confirmation identifier. Use its URL for the person's review.

itemoptional · string

Public name of the item the confirmation concerns.

personrequired · string

Handle of the person who must confirm.

reasonoptional · string

The reason for the proposed action.

repositoryoptional · string

The repository this action concerns, when applicable.

titlerequired · string

Short title for the person's confirmation page.

urlrequired · string

Absolute URL to open for the next step.

enveloperequired · null or object

The signed envelope after the owner's passkey confirms these exact bytes; null while pending.

Fields of envelope

One of these shapes

May be null.

A DSSE envelope, as the DSSE specification defines it.

payloadrequired · string

The statement's JSON, in standard base64.

payloadTyperequired · string

DSSE payload type: application/vnd.in-toto+json.

signaturesrequired · array of object

DSSE signatures over the pre-authentication encoding of this payload.

Fields of signatures

DSSE signatures over the pre-authentication encoding of this payload.

Each item has this shape.

keyidrequired · string

Identifier of the verification key. Pin it with the server and person you trust.

sigrequired · string

An Ed25519 signature over the envelope's PAE encoding, in base64.

RateLimit and RateLimit-Policy describe the request rate. Follow Retry-After when a response asks you to wait.

Problem responses

Errors use application/problem+json. Act on the stable code, and follow next when present. See the problem format.

check_key_scope403

A check-only key may call the test check, read its own usage and acceptance rule, contact support, and withdraw data sharing.

Use a person's sign-in for account management. More agent power needs the owner's passkey; this key cannot widen itself.

feature_off403

The namespace plan does not include this feature.

Retrying on the same plan will not help. GET /api/v1/namespaces/{namespace}/plan, and the namespace's Plan page in Settings, show what its plan includes.

unauthenticated401

The request carried no credentials.

Use this operation's sign-in method. Bearer credentials use Authorization: Bearer <token>; browser credentials use the session cookie.

invalid_token401

The token is unknown, expired, or revoked, its agent was revoked, or an OAuth token was used outside its MCP resource.

Stop using it. Sign in again, or ask the owner to create a replacement agent key.

forbidden403

The caller may not do this: only people may, only owners may, or the agent was not given this repository or write access.

Stop. Retrying will not help. Ask the owner for the access, or leave the step to a person.

not_found404

It does not exist, or the caller cannot read it: a repository the caller cannot read is reported as not found.

Check the name or ID, and that the token has the repository.

invalid_request400

The request is malformed or breaks a rule, such as a title that is too long, or a body that is not the expected JSON.

Fix the request as detail says. The same request fails the same way.

quota_exceeded429

With 429, the caller used its requests for the minute. With 422, a count limit was reached.

With 429, wait Retry-After seconds and retry. With 422, remove one first.

internal500

The server failed, and logged why.

Retry after Retry-After seconds. A write is safe to retry with the same idempotency key.