Get Denial

Get one budget-denial episode by its unique ID.

GET /api/v1/spend-insights/denials/{block_id}

GetDenial

Go

package main

import(
	"context"
	"github.com/conductorone/conductorone-sdk-go/pkg/models/shared"
	conductoronesdkgo "github.com/conductorone/conductorone-sdk-go"
	"github.com/conductorone/conductorone-sdk-go/pkg/models/operations"
	"log"
)

func main() {
    ctx := context.Background()

    s := conductoronesdkgo.New(
        conductoronesdkgo.WithSecurity(shared.Security{
            BearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
            Oauth: "<YOUR_OAUTH_HERE>",
        }),
    )

    res, err := s.SpendInsights.GetDenial(ctx, operations.C1APISpendinsightsV1SpendInsightsServiceGetDenialRequest{
        BlockID: "<id>",
    })
    if err != nil {
        log.Fatal(err)
    }
    if res.GetDenialResponse != nil {
        // handle response
    }
}

200

{
  "episode": {
    "attemptCount": "<string>",
    "authorityId": "<string>",
    "authorityKind": "AUTHORITY_KIND_UNSPECIFIED",
    "authorityVersion": "<string>",
    "blockId": "<string>",
    "budgetKey": "<string>",
    "closedAt": "2023-11-07T05:31:56Z",
    "firstDeniedAt": "2023-11-07T05:31:56Z",
    "lastDeniedAt": "2023-11-07T05:31:56Z",
    "periodEnd": "2023-11-07T05:31:56Z",
    "periodKey": "<string>",
    "periodKind": "PERIOD_KIND_UNSPECIFIED",
    "periodStart": "2023-11-07T05:31:56Z",
    "reason": "DENY_REASON_UNSPECIFIED",
    "requestTaskId": "<string>",
    "requestTaskState": "TICKET_STATE_UNSPECIFIED",
    "scopeAppId": "<string>",
    "scopeKind": "SPEND_BLOCK_SCOPE_KIND_UNSPECIFIED",
    "scopeUserId": "<string>",
    "state": "SPEND_BLOCK_STATE_UNSPECIFIED"
  },
  "firstDenialMoney": {
    "consumedNano": "<string>",
    "currencyCode": "<string>",
    "limitNano": "<string>",
    "requestedNano": "<string>",
    "reservedNano": "<string>"
  },
  "historicalTrace": {
    "allocations": [
      {
        "budgetKey": "<string>",
        "limit": {
          "amount": {
            "amountNano": "<string>"
          },
          "unlimited": {}
        },
        "period": "PERIOD_KIND_UNSPECIFIED",
        "source": {
          "absent": true,
          "appEntitlementId": "<string>",
          "appId": "<string>",
          "appUserId": "<string>",
          "kind": "AUTHORITY_KIND_UNSPECIFIED",
          "ruleId": "<string>",
          "userId": "<string>",
          "version": "<string>"
        }
      }
    ],
    "authorityRefs": [
      {
        "absent": true,
        "appEntitlementId": "<string>",
        "appId": "<string>",
        "appUserId": "<string>",
        "kind": "AUTHORITY_KIND_UNSPECIFIED",
        "ruleId": "<string>",
        "userId": "<string>",
        "version": "<string>"
      }
    ]
  }
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Authorization · string · header · required

This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.

Path Parameters

block_id · string · required

Unique identifier for the denial episode.

Response

200 - application/json

GetDenialResponse contains a denial episode and its first-refusal context.

GetDenialResponse contains a denial episode and its first-refusal context.

episode · Denial Episode · object | null

DenialEpisode represents repeated budget refusals for one scope and budget period.

Show child attributes

firstDenialMoney · Denial Money Snapshot · object | null

DenialMoneySnapshot captures account amounts at the first refusal.

Show child attributes

historicalTrace · Admission Trace · object | null

AdmissionTrace is the bounded authority decision committed with a reservation. It stores typed row references and resolved limits, never full authority rows. Relevant absences remain explicit because a row created between resolution and commit is the fail-open half of the pin set.

Reservation.expires_at is the Dynamo TTL attribute, so this trace supports in-flight atomicity and bounded operational diagnosis only. The durable copy belongs on M2's per-call usage record.

Show child attributes