Accept a suggestion into shadow

POST

/v1/suggestions/{id}/accept

const url = 'http://127.0.0.1:8080/v1/suggestions/example/accept';
const options = {
  method: 'POST',
  headers: {
    'Deedglass-Version': '2026-10-01',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: '{"reason":"Ops approves these every time","replace_shadow":true}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url http://127.0.0.1:8080/v1/suggestions/example/accept \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Deedglass-Version: 2026-10-01' \
  --data '{ "reason": "Ops approves these every time", "replace_shadow": true }'

Creates a policy version from the suggestion (origin suggestion, suggestion_id set; an identical version already stored is reused and note says so) and runs it in shadow next to the enforced version. Nothing is enforced: promote it later with POST /v1/policies/{id}/versions/{v}/activate and mode: enforce. Seals policy.activated (shadow) and suggestion.accepted (deeds, in that order). reason is optional (up to 280 characters). An org runs at most one version in shadow: 409 shadow_slot_taken unless replace_shadow is true; 409 suggestion_stale when the enforced version changed since (the suggestion is superseded); 409 suggestion_decided when it was already decided; 409 conflict for advice. An admin+ Console session or an org admin key; viewers get 403 insufficient_role, agent keys 403 insufficient_scope.

Authorizations

bearerAuth
sessionCookie

Parameters

Path Parameters

required

string

The suggestion id (sug_…).

Header Parameters

Deedglass-Version

string

/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/

The API version (YYYY-MM-DD). Leave it out to use your org’s pinned version (public routes use the latest). An unknown version is 400 api_version_invalid.

Deedglass-CSRF

string

Needed when the request uses a Console session (it changes state); without it the answer is 403 csrf_failed. Not sent with an API key.

Idempotency-Key

string

>= 1 characters <= 255 characters

1 to 255 printable ASCII characters. A retry with the same key and body returns the stored response with Deedglass-Idempotent-Replayed: true for 24 hours.

Request Body

application/json

object

reason

Optional. It goes into both deeds.

string

<= 280 characters

replace_shadow

Replace the version running in shadow now.

boolean

Example

{
  "reason": "Ops approves these every time",
  "replace_shadow": true
}

Responses

200

The suggestion, accepted, with the version it created and the deeds.

application/json

A policy change Insights proposes, with its evidence, diff, replay and risk (S28). Nothing applies until a person accepts it, and accepting only runs it in shadow.

object

object

required

string

Allowed value: suggestion

required

string

/^sug_[0-7][0-9a-hjkmnp-tv-z]{25}$/

status

required

string

Allowed values: open accepting accepted rejected superseded

kind

required

string

Allowed values: loosen tighten budget explicit_rule advisory

generator

required

string

Allowed values: loosen.approval_rate tighten.mismatch tighten.verify_level budget.near_limit explicit_rule.default_hit advisory.deny_heavy

title

required

string

rationale

required

string

phrasing

required

object

source

required

string

Allowed values: template claude

model

string

reason

Why the template wording stands (validation:…

string

input_tokens

integer

output_tokens

integer

cost_usd_micros

integer

duration_ms

integer

string format: date-time

template_title

When worded by Claude

string

policy

required

object

required

string

name

required

string

base_version

required

The enforced version the suggestion was written for.

integer

base_version_id

required

string

base_version_hash

required

string

target_rule_id

required

string | null

evidence

required

The numbers that triggered it: window, approvals, median_wait_seconds, approvers, agents, tool, pattern, sample_actions (loosen); mismatches (tighten); days and limits (budget); and so on per generator.

object

evidence_digest

required

string

diff

required

The change as unified hunks with 3 lines of context; null for advice.

object

hunks

Array<object>

object

old_start

integer

old_lines

integer

new_start

integer

new_lines

integer

lines

Array<object>

object

string

Allowed values: + -

text

string

text

string

added

integer

removed

integer

warnings

required

The candidate’s compile warnings (severity warning).

Array<object>

object

replay

required

The change replayed against the same 14 days, compared with the enforced version.

object

The replay (rpl_…

string

window

object

summary

object

transitions

Array<object>

object

result_digest

string

risk_note

required

string

impact

required

Actions whose decision the replay changes.

integer

stale_reason

required

string | null

Allowed values: base_changed

created_at

required

string format: date-time

decided_by

required

object

type

string

Allowed values: user api_key

string

decided_at

required

string | null format: date-time

decision_reason

required

string | null

resulting_version

required

object

string

version

integer

version_hash

string

decision_deed

required

string | null

deeds

Accept and reject answers only: the deeds sealed, in order.

Array<string>

replaced_shadow_version

Accept only

integer

note

Accept only

string

Example

{
  "object": "suggestion",
  "status": "open",
  "kind": "loosen",
  "generator": "loosen.approval_rate",
  "phrasing": {
    "source": "template"
  },
  "diff": {
    "hunks": [
      {
        "lines": [
          {
            "op": " "
          }
        ]
      }
    ]
  },
  "stale_reason": "base_changed",
  "decided_by": {
    "type": "user"
  }
}

Headers

Deedglass-Request-Id

string

/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

Deedglass-Version

string

The API version this response follows.

Deedglass-Idempotent-Replayed

string

Allowed values: true

Present, and true, when the response is a stored one replayed for an Idempotency-Key.

409

shadow_slot_taken, suggestion_stale, suggestion_decided, or conflict for advice.

application/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error policy_error rate_limit_error api_error

code

required

string

Allowed values: invalid_api_key api_key_revoked api_key_expired agent_suspended agent_stopped org_stopped insufficient_scope policy_denied approval_required approval_expired budget_exceeded intent_required intent_invalid intent_replay tool_unknown connector_unavailable upstream_error timeout rate_limited idempotency_conflict validation_failed not_found conflict internal_error authentication_required method_not_allowed request_too_large unsupported_media_type invalid_json api_version_invalid idempotency_key_invalid idempotency_key_in_use service_unavailable session_expired csrf_failed insufficient_role login_link_invalid login_code_invalid last_owner policy_unavailable policy_invalid credentials_missing destination_blocked vault_unavailable upstream_auth_failed upstream_not_found upstream_rate_limited response_too_large statement_refused row_limit_exceeded database_role_unsafe database_not_ready witness_not_configured approval_decided already_countersigned approver_not_eligible self_approval approval_needs_person context_changed approval_unsatisfiable approval_link_invalid approval_link_review_only approver_unmapped stripe_live_key_refused stripe_livemode_detected upstream_approval_pending schedule_needs_approval action_executing from_denied undo_unavailable undo_plan_stale already_undone undo_conflict replay_too_large replay_window_invalid suggestion_stale shadow_slot_taken suggestion_decided observe_not_enabled pro_required

message

required

One or more calm sentences with the next step.

string

param

required

The request field, query parameter or header the error is about.

string | null

request_id

required

string

/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

doc_url

required

string format: uri

diagnostics

On policy_invalid only. Each problem with its line, code and hint.

Array<object>

One finding about a policy file, with its position and the next step. Codes are stable and listed in docs/POLICY_ERRORS.md. In the policy_invalid error envelope each diagnostic also carries object: policy_diagnostic. The full PolicyDiagnostic schema is in openapi.yaml.

object

action

One agent action. Its sections mirror the deed’s. status is the one field an agent needs; state is the exact lifecycle state (docs/GATE.md). The Gate’s own responses (POST /v1/actions and its result report) add execution.result and witness.reasons; lists leave both out. The full Action schema is in openapi.yaml.

object

checks

On undo_unavailable only. Every check of the undo, each with its fix. Additive (S23).

Array<object>

One of the twelve safety checks (S23 §3.3). Available means no check failed. The full UndoCheck schema is in openapi.yaml.

object

Example

{
  "error": {
    "type": "invalid_request_error",
    "code": "shadow_slot_taken",
    "message": "acme-sim v2 is already running in shadow. Promote or clear it first, or accept with replace_shadow: true to replace it.",
    "param": "replace_shadow",
    "request_id": "req_01m435q4ne4yj7meyd2bdz8kdm",
    "doc_url": "https://docs.deedglass.com/errors/shadow_slot_taken"
  }
}

Headers

Deedglass-Request-Id

string

/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

default

An error. Every error has this envelope; doc_url explains the code.

application/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error policy_error rate_limit_error api_error

code

required

string

message

required

One or more calm sentences with the next step.

string

param

required

The request field, query parameter or header the error is about.

string | null

request_id

required

string

/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

doc_url

required

string format: uri

diagnostics

On policy_invalid only. Each problem with its line, code and hint.

Array<object>

object

action

object

checks

On undo_unavailable only. Every check of the undo, each with its fix. Additive (S23).

Array<object>

One of the twelve safety checks (S23 §3.3). Available means no check failed. The full UndoCheck schema is in openapi.yaml.

object

Example

{
  "error": {
    "type": "invalid_request_error",
    "code": "not_found",
    "message": "There's no endpoint at GET /v1/helth. Did you mean /v1/health?",
    "param": null,
    "request_id": "req_01j9zr3m5k8q2w7x4t6v0b1c9d",
    "doc_url": "https://docs.deedglass.com/errors/not_found"
  }
}

Headers

Deedglass-Request-Id

string

/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

Deedglass-Version

string

The API version this response follows.