# Resume a blocked flow

Polls a flow that answered with a `requiresAction` envelope, using the continuation token from it. Returns `pending` with a fresh envelope to keep polling, `completed` carrying the one-time result, or `denied` or `expired`. One path serves every `requiresAction` flow, device authorization and agent approvals alike.

## POST `/v1/actions/resume`

### Request body

required `application/json`

- **`continuationToken` string required**  
  The `continuationToken` from a `requiresAction` envelope. Send it in the body; it is a secret and must never ride a URL.

min length 1 · max length 4096

### Responses

#### 200 Response for status 200

- **`$schema` string <uri>**  
  Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.

- **`data` object required**  
  One resume result for every flow. Keep polling on `pending`. Read `result` on `completed`, which is the only time a minted secret is returned. Stop on `denied` and `expired`.

##### Show properties

One of:
  - **`status` string required**  
  - **`requiresAction` object required**  
    The step is still open. Wait `pollAfterSeconds`, then resume again with the token carried here.

##### Show properties

- **`actionType` string required**  
        Which step is blocking: `device_authorization` waits for a browser sign-in, `confirmation` waits for a person to approve one action, `elevation` waits for a person to grant temporary access.
        - Allowed: `device_authorization`, `confirmation`, `elevation`
      - **`instruction` string required**  
        One sentence an agent can show a person, naming what they have to do.
      - **`url` string <uri> | any**  
        Page to send the person to. Absent on a `device_authorization` poll, where the agent already holds the verification URL from the response that started the flow.
      - **`pollUrl` string <uri>**  
        Endpoint that takes `continuationToken` and drives this flow: `POST /v1/actions/resume`.
      - **`continuationToken` string required**  
        Signed capability naming this one flow and the principal that started it. It is the only credential `POST /v1/actions/resume` needs for a device sign-in; a confirmation or elevation also has to be resumed with the same agent credential that requested it. Treat it as a secret and never log it.
        
        min length 1
      - **`pollAfterSeconds` integer required**  
        How long to wait before calling resume again, in seconds.
        
        max 9007199254740991
      - **`expiresAt` string <date-time> required**  
        ISO 8601 deadline for the human step. Resuming after it answers `expired`. The token itself outlives the deadline by a short grace so resume can report that rather than rejecting the token.
        
        matches ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|1\d|3[01])|(?:0[469]|11)-(?:0[1-9]|1\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$

### Example Call

#### cURL

```bash
curl -X POST "https://api.spacefast.com/v1/actions/resume" \
  -H "Content-Type: application/json" \
  -d '{
  "continuationToken": "string"
}'
```

#### JavaScript

```javascript
const response = await fetch("https://api.spacefast.com/v1/actions/resume", {
  method: "POST",
  headers: {
    "Content-Type": "application/json"
  },
  body: "{\n  \"continuationToken\": \"string\"\n}"
});
```

#### Python

```python
import requests

response = requests.post(
    "https://api.spacefast.com/v1/actions/resume",
    headers={
        "Content-Type": "application/json"
    },
    data="{\n  \"continuationToken\": \"string\"\n}",
)
```

### Response

#### 200 default

```json
{
  "$schema": "http://example.com",
  "data": {
    "status": "pending",
    "requiresAction": {
      "actionType": "device_authorization",
      "instruction": "string",
      "url": "http://example.com",
      "pollUrl": "http://example.com",
      "continuationToken": "string",
      "pollAfterSeconds": 9007199254740991,
      "expiresAt": "2019-08-24T14:15:22Z"
    }
  }
}
```

#### Error Response

```json
{
  "$schema": "http://example.com",
  "type": "string",
  "title": "string",
  "status": -9007199254740991,
  "detail": "string",
  "code": "string",
  "pointer": "string",
  "details": {
    "property1": null,
    "property2": null
  },
  "suggestions": [
    "string"
  ],
  "next": [
    "string"
  ],
  "requestId": "string"
}
```