POST /api/org/sign-off-consents — append the next consent version. The version comes from the current max; existing sign-offs keep their own snapshot, so revising the wording never rewrites a past agreement.

Request body

CreateConsentRequest

Responses

Security: bearer

GET /api/org/sign-off-consents/current — the wording a pad must show. The pad fetches this before capture so the version it sends back is the one the signer actually read.

Responses

Security: bearer

GET /api/sign-offs/{id}/payload — streams the mark's bytes. Staff-only and audit-free by intent: reading evidence is not the same act as capturing it, and the row's own trail is the record of decisions.

Parameters

Responses

Security: bearer

GET /api/tickets/{id}/sign-offs — the ticket's sign-offs with payload facts, revocation state and the correction relation. Renders a timeline row without ever moving the mark's bytes.

Parameters

Responses

Security: bearer

POST /api/tickets/{id}/sign-offs — capture one signature.

The whole capture lands in one transaction: the payload row in the content-addressed store, the evidence row, `sign_off.created`, and the audit entry. The body's `idempotency_key` is the anchor the offline queue replays on, so a retried queue op is a no-op rather than a second signature.

Parameters

Request body

CreateSignOffRequest

Responses

Security: bearer

POST /api/tickets/{id}/sign-offs/{sign_off_id}/revoke

Appends one entry to the sign-off's revocation trail. The row and its bytes are untouched — this is why a revoked signature reads as revoked rather than as gone, which is the whole point of keeping evidence.

Parameters

Request body

RevokeSignOffRequest

Responses

Security: bearer