capture
Privacy-safe capture identities, admission decisions, and revocation.
| Method | Path | Operation ID |
|---|---|---|
| POST | /v1/capture-admission-challenges |
createCaptureAdmissionChallenge |
| GET | /v1/capture-admissions |
listCaptureAdmissions |
| POST | /v1/capture-admissions |
createCaptureAdmission |
| GET | /v1/capture-admissions/{capture_admission_id} |
getCaptureAdmission |
| GET | /v1/capture-identities |
listCaptureIdentities |
| POST | /v1/capture-identities |
createCaptureIdentity |
| GET | /v1/capture-identities/{capture_identity_id} |
getCaptureIdentity |
| POST | /v1/capture-identities/{capture_identity_id}/revoke |
revokeCaptureIdentity |
| POST | /v1/capture-identity-enrollments |
createCaptureIdentityEnrollment |
POST /v1/capture-admission-challenges
Section titled “POST /v1/capture-admission-challenges”Operation ID: createCaptureAdmissionChallenge
Create one purpose-bound capture-admission challenge.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
Idempotency-Key |
header | string | yes | Visible-ASCII tenant-and-operation idempotency key. Pattern: ^[!-~]+$. Max length 200. |
Request body
Section titled “Request body”application/json: CaptureAdmissionChallengeRequest (required)
| Field | Type | Required | Description |
|---|---|---|---|
capture_identity_id |
string | yes | Pattern: ^cid_[a-z2-7]{16}$. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 201 | Successful Response | application/json CaptureAdmissionChallengeResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json CaptureManagementErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
201 response fields
Section titled “201 response fields”| Field | Type | Required | Description |
|---|---|---|---|
capture_identity_id |
string | yes | Pattern: ^cid_[a-z2-7]{16}$. |
challenge_id |
string | yes | Pattern: ^cch_[a-z2-7]{16}$. |
challenge_secret |
string | yes | Pattern: ^[A-Za-z0-9_-]{43}$. Max length 43. |
expires_at |
string | yes |
GET /v1/capture-admissions
Section titled “GET /v1/capture-admissions”Operation ID: listCaptureAdmissions
List bounded privacy-safe capture admissions.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
decision |
query | CaptureAdmissionDecision or null | no | |
capture_identity_id |
query | string or null | no | |
decided_from |
query | string or null | no | |
decided_through |
query | string or null | no | |
cursor |
query | string or null | no | |
limit |
query | integer or null | no |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json CaptureAdmissionListResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json CaptureManagementErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
items |
array of CaptureAdmissionSummary | yes | |
next_cursor |
string or null | yes |
POST /v1/capture-admissions
Section titled “POST /v1/capture-admissions”Operation ID: createCaptureAdmission
Create or exactly replay one terminal capture admission.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Request body
Section titled “Request body”application/json: CaptureAdmissionSubmissionRequest (required)
| Field | Type | Required | Description |
|---|---|---|---|
attestation_kind |
AttestationKind | yes | Closed vocabulary shared with the immutable governance policy body. One of: app_attest, play_integrity, hardware_key_attestation. |
capture_identity_id |
string | yes | Pattern: ^cid_[a-z2-7]{16}$. |
challenge_id |
string | yes | Pattern: ^cch_[a-z2-7]{16}$. |
challenge_secret |
string | yes | Pattern: ^[A-Za-z0-9_-]{43}$. Max length 43. |
installation_id_sha256 |
string | yes | Pattern: ^[0-9a-f]{64}$. |
sensor_evidence |
object or null | no | |
sensor_schema_version |
string or null | no | |
statement |
string | yes | Max length 349528. |
upload_object_id |
string | yes | Pattern: ^aob_[a-z2-7]{16}$. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | OK | application/json CaptureAdmissionSubmissionResponse |
| 201 | Successful Response | application/json CaptureAdmissionSubmissionResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json CaptureManagementErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
capture_admission_id |
string | yes | Pattern: ^cad_[a-z2-7]{16}$. |
decision |
CaptureAdmissionDecision | yes | One of: pass, reject. |
failed_gates |
array of PublicCaptureAdmissionReason | yes | |
job_id |
string or null | yes | |
reason |
PublicCaptureAdmissionReason | yes | One of: passed, capture_identity_revoked, capture_identity_conflict, evidence_unavailable, evidence_invalid, app_identity_mismatch, app_downgrade, os_downgrade, security_level, boot_state, counter_replay, clock_rollback, reinstall_restore, request_mismatch, media_substitution, governance_rejected, asset_closed, commercial_rejected, capture_work_conflict, capture_work_unavailable. |
GET /v1/capture-admissions/{capture_admission_id}
Section titled “GET /v1/capture-admissions/{capture_admission_id}”Operation ID: getCaptureAdmission
Read one privacy-safe capture admission detail.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
capture_admission_id |
path | string | yes | Pattern: ^cad_[a-z2-7]{16}$. |
If-None-Match |
header | string or null | no |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json CaptureAdmissionDetail |
| 304 | Not modified | none |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json CaptureManagementErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
admission_policy_version |
string | yes | Max length 128. |
asset_id |
string or null | yes | |
capture_admission_id |
string | yes | Pattern: ^cad_[a-z2-7]{16}$. |
capture_identity_id |
string | yes | Pattern: ^cid_[a-z2-7]{16}$. |
capture_policy_id |
string | yes | Pattern: ^cpv_[a-z2-7]{16}$. |
capture_policy_version |
string | yes | Max length 128. |
decided_at |
string | yes | |
decision |
CaptureAdmissionDecision | yes | One of: pass, reject. |
evidence_schema_version |
string | yes | Max length 128. |
failed_gates |
array of PublicCaptureAdmissionReason | yes | |
governance_policy_version |
string | yes | Max length 128. |
identity_version_id |
string | yes | Pattern: ^div_[a-z2-7]{16}$. |
job_id |
string or null | yes | |
provider_class |
CaptureProviderClass | yes | One of: apple_app_attest, google_play_integrity, android_key_attestation, other. |
reason |
PublicCaptureAdmissionReason | yes | One of: passed, capture_identity_revoked, capture_identity_conflict, evidence_unavailable, evidence_invalid, app_identity_mismatch, app_downgrade, os_downgrade, security_level, boot_state, counter_replay, clock_rollback, reinstall_restore, request_mismatch, media_substitution, governance_rejected, asset_closed, commercial_rejected, capture_work_conflict, capture_work_unavailable. |
revocation_snapshot_version |
string | yes | Max length 128. |
trust_snapshot_version |
string | yes | Max length 128. |
upload_object_id |
string | yes | Pattern: ^aob_[a-z2-7]{16}$. |
verifier_version |
string | yes | Max length 128. |
GET /v1/capture-identities
Section titled “GET /v1/capture-identities”Operation ID: listCaptureIdentities
List bounded privacy-safe capture identities.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
state |
query | CaptureIdentityFilterState or null | no | |
platform |
query | CaptureIdentityPlatform or null | no | |
provider_class |
query | CaptureProviderClass or null | no | |
cursor |
query | string or null | no | |
limit |
query | integer or null | no |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json CaptureIdentityListResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json CaptureManagementErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
items |
array of CaptureIdentitySummary | yes | |
next_cursor |
string or null | yes |
POST /v1/capture-identities
Section titled “POST /v1/capture-identities”Operation ID: createCaptureIdentity
Complete one capture-identity enrollment or replay its exact target.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Request body
Section titled “Request body”application/json: CaptureIdentityCreationRequest (required)
| Field | Type | Required | Description |
|---|---|---|---|
attestation_kind |
AttestationKind | yes | Closed vocabulary shared with the immutable governance policy body. One of: app_attest, play_integrity, hardware_key_attestation. |
capture_identity_enrollment_id |
string | yes | Pattern: ^cie_[a-z2-7]{16}$. |
challenge_secret |
string | yes | Pattern: ^[A-Za-z0-9_-]{43}$. Max length 43. |
statement |
string | yes | Max length 349528. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | OK | application/json CaptureIdentityEnrollmentResult |
| 201 | Successful Response | application/json CaptureIdentityEnrollmentResult |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json CaptureManagementErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
capture_identity_id |
string | yes | Pattern: ^cid_[a-z2-7]{16}$. |
enrolled_at |
string | yes | |
identity_version |
integer | yes | |
identity_version_id |
string | yes | Pattern: ^div_[a-z2-7]{16}$. |
GET /v1/capture-identities/{capture_identity_id}
Section titled “GET /v1/capture-identities/{capture_identity_id}”Operation ID: getCaptureIdentity
Read one privacy-safe capture identity detail.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
capture_identity_id |
path | string | yes | Pattern: ^cid_[a-z2-7]{16}$. |
If-None-Match |
header | string or null | no |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json CaptureIdentityDetail |
| 304 | Not modified | none |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json CaptureManagementErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
capture_identity_id |
string | yes | Pattern: ^cid_[a-z2-7]{16}$. |
capture_policy_id |
string | yes | Pattern: ^cpv_[a-z2-7]{16}$. |
capture_policy_version |
string | yes | Max length 128. |
enrolled_at |
string | yes | |
evidence_schema_version |
string | yes | Max length 128. |
identity_version |
integer | yes | |
identity_version_id |
string | yes | Pattern: ^div_[a-z2-7]{16}$. |
last_capture_at |
string or null | yes | |
last_verified_at |
string or null | yes | |
platform |
CaptureIdentityPlatform | yes | One of: ios, android. |
provider_class |
CaptureProviderClass | yes | One of: apple_app_attest, google_play_integrity, android_key_attestation, other. |
revocation_snapshot_version |
string | yes | Max length 128. |
revoked_at |
string or null | yes | |
state |
CaptureIdentityState | yes | One of: active, revoked. |
trust_snapshot_version |
string | yes | Max length 128. |
verifier_version |
string | yes | Max length 128. |
POST /v1/capture-identities/{capture_identity_id}/revoke
Section titled “POST /v1/capture-identities/{capture_identity_id}/revoke”Operation ID: revokeCaptureIdentity
Terminally revoke one owned capture identity.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
capture_identity_id |
path | string | yes | Pattern: ^cid_[a-z2-7]{16}$. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json CaptureIdentityRevocationResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json CaptureManagementErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
capture_identity_id |
string | yes | Pattern: ^cid_[a-z2-7]{16}$. |
revocation_id |
string | yes | Pattern: ^crv_[a-z2-7]{16}$. |
revoked_at |
string | yes | |
schema_version |
const “op.capture-identity-revocation.v1” | no | Default "op.capture-identity-revocation.v1". |
state |
const “revoked” | no | Default "revoked". |
POST /v1/capture-identity-enrollments
Section titled “POST /v1/capture-identity-enrollments”Operation ID: createCaptureIdentityEnrollment
Create one purpose-bound capture-identity enrollment challenge.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
Idempotency-Key |
header | string | yes | Visible-ASCII tenant-and-operation idempotency key. Pattern: ^[!-~]+$. Max length 200. |
Request body
Section titled “Request body”application/json: CaptureIdentityEnrollmentRequest (required)
| Field | Type | Required | Description |
|---|---|---|---|
platform |
CaptureIdentityPlatform | yes | One of: ios, android. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 201 | Successful Response | application/json CaptureIdentityEnrollmentResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json CaptureManagementErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
| 422 | A verified email is unavailable for account provisioning. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. | application/json HttpErrorResponse or CaptureManagementErrorResponse |
201 response fields
Section titled “201 response fields”| Field | Type | Required | Description |
|---|---|---|---|
capture_identity_enrollment_id |
string | yes | Pattern: ^cie_[a-z2-7]{16}$. |
challenge_secret |
string | yes | Pattern: ^[A-Za-z0-9_-]{43}$. Max length 43. |
expires_at |
string | yes |