IssueAuthorityRequest

POST /v1/artifacts/authorities. The run's own workspace, the attempt this token is for, the grant set as the person left it in the modal (D28), and the working scope whose .artifacts/<RunId>/ the tools accept paths from.

Type object

Shape

Field	Type	Description
runrequired	RunId
workspacerequired	WorkspaceId
generationrequired	AttemptGeneration	Which attempt of a run is current - the fence §7.5 and §7.6 rely on. A monotonic counter per run, starting at [`AttemptGeneration::FIRST`]. An event, an MCP call or a session lookup carrying an older generation may not touch status, control or authority; see [`crate::AttemptGeneration::admits`]. It is a counter rather than an id so "older" is a comparison, not a lookup.
grants	array of WorkspaceId	Default `[]`
run_workspacerequired	RunWorkspace	The run's working scope on this device. A path is content (standing requirement 7): it is stored so the gateway can resolve `Register` paths against it, and it is redacted from every `Debug` rendering.

Example

{
  "run": "00000000-0000-4000-8000-000000000000",
  "workspace": "00000000-0000-4000-8000-000000000000",
  "generation": 0,
  "grants": [],
  "run_workspace": "string"
}

The contract has no example values, so example bodies are generated from each schema: every field is shown with a placeholder of its type.

Used by

POST/v1/artifacts/authorities
Issue a run's authority and its first endpoint token

Generated from contract version 1. Last updated November 12, 2026.