Ratify policy version

curl --request POST \
  --url https://api.meshqu.com/v1/policies/{id}/versions/{version}/ratify \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-MeshQu-Tenant-Id: <api-key>' \
  --data '
{
  "expected_revision": 1,
  "approval_authority": "<string>",
  "ratifier_role": "<string>"
}
'

import requests

url = "https://api.meshqu.com/v1/policies/{id}/versions/{version}/ratify"

payload = {
    "expected_revision": 1,
    "approval_authority": "<string>",
    "ratifier_role": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "X-MeshQu-Tenant-Id": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <token>',
    'X-MeshQu-Tenant-Id': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    expected_revision: 1,
    approval_authority: '<string>',
    ratifier_role: '<string>'
  })
};

fetch('https://api.meshqu.com/v1/policies/{id}/versions/{version}/ratify', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.meshqu.com/v1/policies/{id}/versions/{version}/ratify",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'expected_revision' => 1,
    'approval_authority' => '<string>',
    'ratifier_role' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "X-MeshQu-Tenant-Id: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.meshqu.com/v1/policies/{id}/versions/{version}/ratify"

	payload := strings.NewReader("{\n  \"expected_revision\": 1,\n  \"approval_authority\": \"<string>\",\n  \"ratifier_role\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("X-MeshQu-Tenant-Id", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.meshqu.com/v1/policies/{id}/versions/{version}/ratify")
  .header("Authorization", "Bearer <token>")
  .header("X-MeshQu-Tenant-Id", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"expected_revision\": 1,\n  \"approval_authority\": \"<string>\",\n  \"ratifier_role\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.meshqu.com/v1/policies/{id}/versions/{version}/ratify")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-MeshQu-Tenant-Id"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"expected_revision\": 1,\n  \"approval_authority\": \"<string>\",\n  \"ratifier_role\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "policy_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "version": 123,
  "draft_revision": 1,
  "rules": [
    {
      "code": "<string>",
      "name": "<string>",
      "rule_type": "presence",
      "condition": {
        "required_fields": [
          "<string>"
        ],
        "forbidden_fields": [
          "<string>"
        ],
        "min_length": {}
      },
      "severity": "low",
      "description": "<string>",
      "is_active": true,
      "when": {
        "field": "<string>",
        "equals": "<string>",
        "case_sensitive": true
      },
      "source_ref": {
        "document": "<string>",
        "section": "<string>",
        "url": "<string>"
      },
      "replaces_rule_code": "<string>"
    }
  ],
  "active_rules_hash": "<string>",
  "is_active": true,
  "status": "draft",
  "created_at": "2023-11-07T05:31:56Z",
  "created_by": "<string>",
  "change_reason": "<string>",
  "policy_approval_receipt": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "tenant_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "policy_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "policy_version_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "policy_version_number": 2,
    "ratifier_id": "<string>",
    "ratifier_role": "<string>",
    "ratified_at": "2023-11-07T05:31:56Z",
    "workflow_state": "<string>",
    "approval_authority": "<string>",
    "policy_rules_hash": "<string>",
    "ratifier_signature": {
      "kid": "<string>",
      "signature": "<string>",
      "algorithm": "ed25519"
    },
    "approval_receipt_digest": "<string>",
    "created_at": "2023-11-07T05:31:56Z"
  },
  "ratified_by": "<string>",
  "ratified_at": "2023-11-07T05:31:56Z",
  "submitted_by": "<string>",
  "submitted_at": "2023-11-07T05:31:56Z",
  "rejected_by": "<string>",
  "rejected_at": "2023-11-07T05:31:56Z",
  "rejection_reason": "<string>",
  "closed_at": "2023-11-07T05:31:56Z",
  "closed_by": "<string>",
  "closed_reason": "<string>",
  "supersedes_version_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "codification_record": {
    "schema": "meshqu-codification-record/v1",
    "source": {
      "document": "<string>",
      "url": "<string>"
    },
    "clauses": [
      {
        "unit_id": "<string>",
        "locator": "<string>",
        "text": "<string>"
      }
    ],
    "ledger": [
      {
        "unit_id": "<string>",
        "disposition": "mapped",
        "note": "<string>"
      }
    ],
    "counts": {
      "clauses": 123,
      "mapped": 123,
      "ambiguous": 123,
      "unsupported": 123,
      "non_normative": 123,
      "refused": 123
    },
    "refusals": [
      {
        "unit_id": "<string>",
        "rule_code": "<string>",
        "kind": "<string>",
        "message": "<string>"
      }
    ],
    "lint": {
      "schema": "meshqu-codification-lint/v1",
      "status": "ran",
      "answerer": "jev",
      "questions_version": "<string>",
      "floor": 123,
      "clauses": [
        {
          "unit_id": "<string>",
          "findings": [
            {
              "code": "guidance_as_obligation",
              "message": "<string>",
              "evidence": {
                "confidence": 123
              }
            }
          ],
          "needs_context": true
        }
      ],
      "reason": "<string>",
      "model": "<string>",
      "elapsed_ms": 123
    }
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

Policies

Ratify policy version

Records that a human approved this exact draft version: the version becomes ratified. Ratification does not put the version in force — the version currently in force keeps governing evaluations until the ratified version is activated with POST /v1/policies//versions//activate. Returns a signed PolicyApprovalReceipt when a ratifier key is configured.

The review gate (OPD-130, MCP-020 R-A). Once any seal of this version, or of a draft it supersedes, was made under an authoring capability, ratification requires an ACCEPT review record as the newest record on THIS version’s own latest sealed submission, whoever sealed it; otherwise 409 RATIFY_NO_ACCEPT_RECORD with details.reason NO_SEAL_ON_HEAD, NO_ACCEPT_RECORD or LINEAGE_UNRESOLVED. The human who issued that capability and the human who recorded the ACCEPT may not ratify (403). An ACCEPT recorded against an earlier draft never carries.

The reviewed subject (B1-01). On every path, while the version is still ratifiable: if the newest record on this version’s latest sealed submission is an ACCEPT, the version’s current active rules must hash to the active_rules_hash that submission sealed; otherwise 409 REVIEWED_SUBJECT_STALE (details: submission_id, review_record_id, sealed_active_rules_hash, current_active_rules_hash, candidate_revision, draft_revision). Reseal and have the current rules reviewed, or restore the accepted rules. When no authoring capability is involved and that newest record is CORRECT_AND_RESUBMIT or STOP, 409 RATIFY_REVIEW_ADVERSE (details.reason is the disposition). A ratification that relied on an ACCEPT cites it in the policy_ratified audit row on both paths. Limit: only the hashed fields of the active rules (code, condition, severity, when) are compared; a rule’s name, description, source_ref, replaces_rule_code and rule_type, and inactive rules, are not.

expected_revision is required. The body accepts only expected_revision, approval_authority and ratifier_role: any other key is 400.

POST

policies

{id}

versions

{version}

ratify

Ratify policy version

curl --request POST \
  --url https://api.meshqu.com/v1/policies/{id}/versions/{version}/ratify \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-MeshQu-Tenant-Id: <api-key>' \
  --data '
{
  "expected_revision": 1,
  "approval_authority": "<string>",
  "ratifier_role": "<string>"
}
'

import requests

url = "https://api.meshqu.com/v1/policies/{id}/versions/{version}/ratify"

payload = {
    "expected_revision": 1,
    "approval_authority": "<string>",
    "ratifier_role": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "X-MeshQu-Tenant-Id": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <token>',
    'X-MeshQu-Tenant-Id': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    expected_revision: 1,
    approval_authority: '<string>',
    ratifier_role: '<string>'
  })
};

fetch('https://api.meshqu.com/v1/policies/{id}/versions/{version}/ratify', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.meshqu.com/v1/policies/{id}/versions/{version}/ratify",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'expected_revision' => 1,
    'approval_authority' => '<string>',
    'ratifier_role' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "X-MeshQu-Tenant-Id: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.meshqu.com/v1/policies/{id}/versions/{version}/ratify"

	payload := strings.NewReader("{\n  \"expected_revision\": 1,\n  \"approval_authority\": \"<string>\",\n  \"ratifier_role\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("X-MeshQu-Tenant-Id", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.meshqu.com/v1/policies/{id}/versions/{version}/ratify")
  .header("Authorization", "Bearer <token>")
  .header("X-MeshQu-Tenant-Id", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"expected_revision\": 1,\n  \"approval_authority\": \"<string>\",\n  \"ratifier_role\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.meshqu.com/v1/policies/{id}/versions/{version}/ratify")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-MeshQu-Tenant-Id"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"expected_revision\": 1,\n  \"approval_authority\": \"<string>\",\n  \"ratifier_role\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "policy_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "version": 123,
  "draft_revision": 1,
  "rules": [
    {
      "code": "<string>",
      "name": "<string>",
      "rule_type": "presence",
      "condition": {
        "required_fields": [
          "<string>"
        ],
        "forbidden_fields": [
          "<string>"
        ],
        "min_length": {}
      },
      "severity": "low",
      "description": "<string>",
      "is_active": true,
      "when": {
        "field": "<string>",
        "equals": "<string>",
        "case_sensitive": true
      },
      "source_ref": {
        "document": "<string>",
        "section": "<string>",
        "url": "<string>"
      },
      "replaces_rule_code": "<string>"
    }
  ],
  "active_rules_hash": "<string>",
  "is_active": true,
  "status": "draft",
  "created_at": "2023-11-07T05:31:56Z",
  "created_by": "<string>",
  "change_reason": "<string>",
  "policy_approval_receipt": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "tenant_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "policy_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "policy_version_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "policy_version_number": 2,
    "ratifier_id": "<string>",
    "ratifier_role": "<string>",
    "ratified_at": "2023-11-07T05:31:56Z",
    "workflow_state": "<string>",
    "approval_authority": "<string>",
    "policy_rules_hash": "<string>",
    "ratifier_signature": {
      "kid": "<string>",
      "signature": "<string>",
      "algorithm": "ed25519"
    },
    "approval_receipt_digest": "<string>",
    "created_at": "2023-11-07T05:31:56Z"
  },
  "ratified_by": "<string>",
  "ratified_at": "2023-11-07T05:31:56Z",
  "submitted_by": "<string>",
  "submitted_at": "2023-11-07T05:31:56Z",
  "rejected_by": "<string>",
  "rejected_at": "2023-11-07T05:31:56Z",
  "rejection_reason": "<string>",
  "closed_at": "2023-11-07T05:31:56Z",
  "closed_by": "<string>",
  "closed_reason": "<string>",
  "supersedes_version_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "codification_record": {
    "schema": "meshqu-codification-record/v1",
    "source": {
      "document": "<string>",
      "url": "<string>"
    },
    "clauses": [
      {
        "unit_id": "<string>",
        "locator": "<string>",
        "text": "<string>"
      }
    ],
    "ledger": [
      {
        "unit_id": "<string>",
        "disposition": "mapped",
        "note": "<string>"
      }
    ],
    "counts": {
      "clauses": 123,
      "mapped": 123,
      "ambiguous": 123,
      "unsupported": 123,
      "non_normative": 123,
      "refused": 123
    },
    "refusals": [
      {
        "unit_id": "<string>",
        "rule_code": "<string>",
        "kind": "<string>",
        "message": "<string>"
      }
    ],
    "lint": {
      "schema": "meshqu-codification-lint/v1",
      "status": "ran",
      "answerer": "jev",
      "questions_version": "<string>",
      "floor": 123,
      "clauses": [
        {
          "unit_id": "<string>",
          "findings": [
            {
              "code": "guidance_as_obligation",
              "message": "<string>",
              "evidence": {
                "confidence": 123
              }
            }
          ],
          "needs_context": true
        }
      ],
      "reason": "<string>",
      "model": "<string>",
      "elapsed_ms": 123
    }
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

Authorizations

Authorization

string

header

required

MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).

X-MeshQu-Tenant-Id

string

header

required

Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked.

Path Parameters

string<uuid>

required

version

integer

required

Required range: x >= 1

Body

application/json

expected_revision

integer

required

The draft_revision of the version the ratifier read. While the version can still be ratified, a value that is not its current draft_revision is refused 409 STALE_DRAFT_REVISION.

Required range: x >= 0

approval_authority

string

Free-form string identifying the regulatory or governance framework under which this ratification is performed (e.g. "ifrs-9-credit-risk"). Stored in the PolicyApprovalReceipt. Defaults to "unspecified".

Maximum string length: 500

ratifier_role

string

Organizational role of the ratifier at approval time (e.g. "compliance", "risk-officer"). Stored in the PolicyApprovalReceipt. Defaults to the API key identity.

Maximum string length: 200

Response

Default Response

string<uuid>

required

policy_id

string<uuid>

required

version

integer

required

draft_revision

integer

required

Required range: x >= 0

rules

object[]

required

Show child attributes

active_rules_hash

string

required

SHA-256 hex of projectActiveRules(rules) — the same projection and hash the review-submission seal's active_rules_hash and the ratification receipt's policy_rules_hash use. Compare against a sealed subject's active_rules_hash to tell whether the ACTIVE RULES' EVALUATED CONTENT (code/condition/severity/when, in stored order) is unchanged since that seal — not whether the rule objects as a whole (name, description, source_ref, an added inactive rule) are unchanged.

Pattern: ^[0-9a-f]{64}$

is_active

boolean

required

status

required

Lifecycle status: draft → submitted → ratified → (activated, then) superseded (or back to draft on reject); discarded = soft-discarded draft (PWB-039). A pending version that ends without governing is closed: reopened (a ratified version whose content continues as a new draft), set_aside (put aside with a reason), replaced (a draft whose correction continues as a new draft) — PAL-004/005.

Available options:

draft

created_at

string<date-time>

required

created_by

string | null

required

change_reason

string | null

required

policy_approval_receipt

object | null

required

APR-005: Signed approval receipt produced at ratification time. Null when the ratifier key is not configured.

Show child attributes

ratified_by

string

ratified_at

string<date-time>

submitted_by

string

submitted_at

string<date-time>

rejected_by

string

rejected_at

string<date-time>

rejection_reason

string

closed_at

string<date-time>

closed_by

string

closed_reason

string

supersedes_version_id

string<uuid>

Present only on a version created by draft supersession: the id of the replaced draft this version continues. Written when the version is created and never changed. Absent on every other version, including one started after a set-aside or a reopen.

codification_record

object

What the codification that produced this version accounted for. Unsigned and unhashed; NOT a sealed review package.

Show child attributes

Getting Started

Concepts

API Reference

SDK

Guides

Recipes

Security

Meta

Ratify policy version

Authorizations

Path Parameters

Body

Response