Independently decide a hold release or disposition, rechecking current retention and holds atomically

POST/customers/{id}/record-controls/{action}/decisions

Fresh customers:records:approve staff authority, no API key and actor different from maker required. Hold release/disposition/retention event are serialized with capture, other controls and schedule changes. Disposition rechecks every current hold, captured retention and current policy; permanent or unknown-trigger retention blocks it. Only the encrypted live archive payload is deleted atomically with immutable approval evidence. Customer-master, financial histories, external documents and backup/WAL/object-lock copies are outside this deletion boundary. A disposed record cannot be recreated by idempotent replay or key rotation.

Path parameters

idstringRequired

actionstringRequired

Headers

Idempotency-KeystringRequired

Send on every write that creates or changes money or state; a replay with the same key returns the original result with 200.

Body parameters

decisionstringRequired

Approve/reject

evidence_refstringRequired

evidence_sha256stringRequired

reasonstringRequired

Returns

200 OK

customer_idstringRequired

Example cust_2tVh8nqLxq4GbDe0K1F6S9zRcWm

decided_atstring · date-time or nullOptional

decided_bystringOptional

idstringRequired

proposed_atstring · date-timeRequired

proposed_bystringRequired

requestobjectRequired

8 child attributes

event_atstring · date-time or nullOptional

Independently evidenced trigger, e.g. relationship closure

evidence_refstringRequired

evidence_sha256stringRequired

hold_idstringOptional

Release_hold only

Example hold_2tVh8nqLxq4GbDe0K1F6S9zRcWm

kindstringRequired

Hold, release_hold, dispose, retention_event

matter_refstringRequired

reasonstringRequired

record_idstringOptional

Empty hold covers all current/future customer records

statusstringRequired

Errors

Every error is a problem document with a stable code. See Errors.

400401403404409412413422424429500503