Resume a blocked flow

Polls a flow that answered with a requiresAction envelope, using the continuation token from it. Returns pending with a fresh envelope to keep polling, completed carrying the one-time result, or denied or expired. One path serves every requiresAction flow, device authorization and agent approvals alike.

POST /v1/actions/resume

Request body

required application/json

• continuationToken string required
  The continuationToken from a requiresAction envelope. Send it in the body; it is a secret and must never ride a URL.

min length 1 · max length 4096

Responses

200 Response for status 200

• $schema string
  Canonical JSON Schema URL for this response body. The server also sends it in the Link: rel="describedby" response header.

• data object required
  One resume result for every flow. Keep polling on pending. Read result on completed, which is the only time a minted secret is returned. Stop on denied and expired.

Show properties

One of:

• status string required
• requiresAction object required
  The step is still open. Wait pollAfterSeconds, then resume again with the token carried here.

Show properties

• actionType string required
  Which step is blocking: device_authorization waits for a browser sign-in, confirmation waits for a person to approve one action, elevation waits for a person to grant temporary access. - Allowed: device_authorization, confirmation, elevation - instruction string required
  One sentence an agent can show a person, naming what they have to do. - url string | any
  Page to send the person to. Absent on a device_authorization poll, where the agent already holds the verification URL from the response that started the flow. - pollUrl string
  Endpoint that takes continuationToken and drives this flow: POST /v1/actions/resume. - continuationToken string required
  Signed capability naming this one flow and the principal that started it. It is the only credential POST /v1/actions/resume needs for a device sign-in; a confirmation or elevation also has to be resumed with the same agent credential that requested it. Treat it as a secret and never log it.
  min length 1 - pollAfterSeconds integer required
  How long to wait before calling resume again, in seconds.
  max 9007199254740991 - expiresAt string required
  ISO 8601 deadline for the human step. Resuming after it answers expired. The token itself outlives the deadline by a short grace so resume can report that rather than rejecting the token.
  matches ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|1\d|3[01])|(?:0[469]|11)-(?:0[1-9]|1\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:.\d+)?)?(?:Z))$

Example Call

cURL

curl -X POST "https://api.spacefast.com/v1/actions/resume" \
  -H "Content-Type: application/json" \
  -d '{
  "continuationToken": "string"
}'

JavaScript

const response = await fetch("https://api.spacefast.com/v1/actions/resume", {
  method: "POST",
  headers: {
    "Content-Type": "application/json"
  },
  body: "{\n  \"continuationToken\": \"string\"\n}"
});

Python

import requests

response = requests.post(
    "https://api.spacefast.com/v1/actions/resume",
    headers={
        "Content-Type": "application/json"
    },
    data="{\n  \"continuationToken\": \"string\"\n}",
)

Response

200 default

{
  "$schema": "http://example.com",
  "data": {
    "status": "pending",
    "requiresAction": {
      "actionType": "device_authorization",
      "instruction": "string",
      "url": "http://example.com",
      "pollUrl": "http://example.com",
      "continuationToken": "string",
      "pollAfterSeconds": 9007199254740991,
      "expiresAt": "2019-08-24T14:15:22Z"
    }
  }
}

Error Response

{
  "$schema": "http://example.com",
  "type": "string",
  "title": "string",
  "status": -9007199254740991,
  "detail": "string",
  "code": "string",
  "pointer": "string",
  "details": {
    "property1": null,
    "property2": null
  },
  "suggestions": [
    "string"
  ],
  "next": [
    "string"
  ],
  "requestId": "string"
}