Skip to content
deedglassdocs

Get one deed's exact bytes

GET
/v1/deeds/{id}
curl --request GET \
  --url http://127.0.0.1:8080/v1/deeds/example \
  --header 'Authorization: Bearer <token>' \
  --header 'Deedglass-Version: 2026-10-01'

The stored canonical JSON of the deed envelope, byte for byte, so its hash and seal check offline. Deeds never change: the response is cacheable forever and its ETag is the body_hash. With Accept: application/cose the deed comes as a COSE_Sign1 signed statement (RFC 9052; not an RFC 9942 transparency-service object). Requires deeds:read.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string

The deed id (deed_…).

Header Parameters

Section titled “Header Parameters”
Deedglass-Version
string
/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/

The API version (YYYY-MM-DD). Leave it out to use your org’s pinned version (public routes use the latest). An unknown version is 400 api_version_invalid.

If-None-Match
string

The ETag of a copy you hold.

Responses

Section titled “Responses”

200

Section titled “200”

The deed.

A sealed deed (docs/DEED_SPEC.md). The stored and exported form is the RFC 8785 canonical JSON of this object. seal is Ed25519 over the bytes “deedglass/deed/v1\n” + body_hash.

object
object
required
string
Allowed value: deed
id
required

Equal to body.deed_id (not signed; verifiers check it).

string
/^deed_[0-7][0-9a-hjkmnp-tv-z]{25}$/
body
required

Deed v1. Every key is always present; which sections are null depends on kind (docs/DEED_SPEC.md §5). Digests only, never payloads.

object
v
required
integer
Allowed value: 1
kind
required
string
Allowed values: action admin amendment
deed_id
required
string
/^deed_[0-7][0-9a-hjkmnp-tv-z]{25}$/
org
required
string
/^org_[0-7][0-9a-hjkmnp-tv-z]{25}$/
seq
required
integer
>= 1 <= 9007199254740991
prev_hash
required

“sha256:” + lowercase hex of SHA-256.

string
/^sha256:[0-9a-f]{64}$/
issued_at
required

RFC 3339, UTC, exactly three fractional digits.

string
/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}[.][0-9]{3}Z$/
agent
required
object
id
required
string
name
required
string
<= 64 characters
on_behalf_of
required
string | null
<= 256 characters
session
required
string | null
<= 256 characters
action
required
object
id
required
string
tool
required
string
connector
required
string | null
mode
required
string
Allowed values: gateway proxy
request_digest
required

“sha256:” + lowercase hex of SHA-256.

string
/^sha256:[0-9a-f]{64}$/
intent_hash
required
string | null
intent_signed
required
boolean
policy
required
object
id
required
string | null
version_id
required
string | null
version_hash
required
string | null
mode
required
string
Allowed values: enforce shadow
decision
required
string
Allowed values: allow deny require_approval
rule_id
required
string | null
approval
required
object
id
required
string
outcome
required
string
Allowed values: approved denied expired cancelled
decided_by
required
Array<string>
decided_at
required
string | null
deed
required
string | null
execution
required
object
status
required
string
Allowed values: succeeded failed unknown
started_at
required

RFC 3339, UTC, exactly three fractional digits.

string
/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}[.][0-9]{3}Z$/
finished_at
required

RFC 3339, UTC, exactly three fractional digits.

string
/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}[.][0-9]{3}Z$/
latency_ms
required
integer
result_digest
required
string | null
error_code
required
string | null
witness
required
object
level
required
string
Allowed values: L0 L1 L2
verdict
required
string
Allowed values: VERIFIED MISMATCH UNVERIFIABLE
method
required
string
detail_digest
required
string | null
cost
required
object
amount
required
integer
currency
required
string
/^[a-z]{3}$/
admin
required
object
event
required
string
action
required
string
actor
required
object
type
required
string
id
required
string
target
required
object
type
required
string
id
required
string
reason
required
string | null
<= 280 characters
data_digest
required
string | null
amends
required
string | null
seal_key_id
required
string
body_hash
required

“sha256:” + lowercase hex of SHA-256.

string
/^sha256:[0-9a-f]{64}$/
seal
required
string
/^ed25519:[A-Za-z0-9_-]{86}$/
seal_key_id
required
string
/^sk_[0-7][0-9a-hjkmnp-tv-z]{25}$/
Example
{
  "object": "deed",
  "body": {
    "v": 1,
    "kind": "action",
    "action": {
      "mode": "gateway"
    },
    "policy": {
      "mode": "enforce",
      "decision": "allow"
    },
    "approval": {
      "outcome": "approved"
    },
    "execution": {
      "status": "succeeded"
    },
    "witness": {
      "level": "L0",
      "verdict": "VERIFIED"
    }
  }
}

Headers

Section titled “Headers”
Deedglass-Request-Id
string
/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

ETag
string

"sha256:<hex>": the deed’s body_hash.

Cache-Control
string
Allowed value: private, max-age=31536000, immutable

304

Section titled “304”

The copy named in If-None-Match is current.

default

Section titled “default”

An error. Every error has this envelope; doc_url explains the code.

Media typeapplication/json
object
error
required
object
type
required
string
Allowed values: invalid_request_error authentication_error permission_error policy_error rate_limit_error api_error
code
required
string
Allowed values: invalid_api_key api_key_revoked api_key_expired agent_suspended agent_stopped org_stopped insufficient_scope policy_denied approval_required approval_expired budget_exceeded intent_required intent_invalid intent_replay tool_unknown connector_unavailable upstream_error timeout rate_limited idempotency_conflict validation_failed not_found conflict internal_error authentication_required method_not_allowed request_too_large unsupported_media_type invalid_json api_version_invalid idempotency_key_invalid idempotency_key_in_use service_unavailable session_expired csrf_failed insufficient_role login_link_invalid login_code_invalid last_owner policy_unavailable policy_invalid credentials_missing destination_blocked vault_unavailable upstream_auth_failed upstream_not_found upstream_rate_limited response_too_large statement_refused row_limit_exceeded database_role_unsafe database_not_ready witness_not_configured approval_decided already_countersigned approver_not_eligible self_approval approval_needs_person context_changed approval_unsatisfiable approval_link_invalid approval_link_review_only approver_unmapped stripe_live_key_refused stripe_livemode_detected upstream_approval_pending schedule_needs_approval action_executing from_denied undo_unavailable undo_plan_stale already_undone undo_conflict replay_too_large replay_window_invalid suggestion_stale shadow_slot_taken suggestion_decided observe_not_enabled pro_required
message
required

One or more calm sentences with the next step.

string
param
required

The request field, query parameter or header the error is about.

string | null
request_id
required
string
/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/
doc_url
required
string format: uri
diagnostics

On policy_invalid only. Each problem with its line, code and hint.

Array<object>

One finding about a policy file, with its position and the next step. Codes are stable and listed in docs/POLICY_ERRORS.md. In the policy_invalid error envelope each diagnostic also carries object: policy_diagnostic. The full PolicyDiagnostic schema is in openapi.yaml.

object
action

One agent action. Its sections mirror the deed’s. status is the one field an agent needs; state is the exact lifecycle state (docs/GATE.md). The Gate’s own responses (POST /v1/actions and its result report) add execution.result and witness.reasons; lists leave both out. The full Action schema is in openapi.yaml.

object
checks

On undo_unavailable only. Every check of the undo, each with its fix. Additive (S23).

Array<object>

One of the twelve safety checks (S23 §3.3). Available means no check failed. The full UndoCheck schema is in openapi.yaml.

object
Example
{
  "error": {
    "type": "invalid_request_error",
    "code": "not_found",
    "message": "There's no endpoint at GET /v1/helth. Did you mean /v1/health?",
    "param": null,
    "request_id": "req_01j9zr3m5k8q2w7x4t6v0b1c9d",
    "doc_url": "https://docs.deedglass.com/errors/not_found"
  }
}

Headers

Section titled “Headers”
Deedglass-Request-Id
string
/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

Deedglass-Version
string

The API version this response follows.