Automate the governed release lifecycle

Authentication and scopes

Create a bearer key in Settings and select only required scopes. Keys are shown once, hashed at rest, individually revocable, and rate limited.

Authorization: Bearer accordgate_<48 hex characters>

The legacy key prefix remains stable for compatibility. Scopes include agreements:read/write, releases:read/write, evidence:read, approvals:write, exceptions:write, policy:read, audit:read, webhooks:write, connectors:write, and governance:read/write.

Agreements

GET  /api/v1/accordgate/agreements?q=genomics&limit=50&offset=0
POST /api/v1/accordgate/agreements
GET  /api/v1/accordgate/agreements/{id}
POST /api/v1/accordgate/agreements/{id}/documents
POST /api/v1/accordgate/agreements/{id}/controls
POST /api/v1/accordgate/agreements/{id}/controls/{controlId}/review
GET  /api/v1/accordgate/agreements/{id}/versions
GET  /api/v1/accordgate/agreements/{id}/diff?from=1&to=2

{
  "name": "Research cohort DUA",
  "agreementType": "dua",
  "counterparty": "Example University",
  "effectiveDate": "2026-07-01",
  "expiresAt": "2027-06-30"
}

Releases

GET  /api/v1/accordgate/releases
POST /api/v1/accordgate/releases
GET  /api/v1/accordgate/releases/{id}
POST /api/v1/accordgate/releases/{id}/artifacts
POST /api/v1/accordgate/releases/{id}/evaluate
GET  /api/v1/accordgate/releases/{id}/runs
GET  /api/v1/accordgate/releases/{id}/diff?from=1&to=2
GET  /api/v1/accordgate/releases/{id}/evidence

Artifact uploads use JSON with artifactType, name, mimeType, and contentBase64. Supported types are schema, payload, authorized users, and query manifest.

Approvals, exceptions, and institutional governance

POST /api/v1/accordgate/releases/{id}/attestations
POST /api/v1/accordgate/releases/{id}/approvals/configure
POST /api/v1/accordgate/releases/{id}/approvals
POST /api/v1/accordgate/releases/{id}/exceptions
GET  /api/v1/accordgate/library-cards
POST /api/v1/accordgate/library-cards
POST /api/v1/accordgate/library-cards/{id}/renew
POST /api/v1/accordgate/library-cards/{id}/revoke
GET  /api/v1/accordgate/access-reviews
POST /api/v1/accordgate/access-reviews/{id}/submit
POST /api/v1/accordgate/access-reviews/{id}/decide

Policy, connectors, webhooks, and audit

GET  /api/v1/accordgate/releases/{id}/policy
POST /api/v1/accordgate/releases/{id}/policy
POST /api/v1/accordgate/releases/{id}/connectors
POST /api/v1/accordgate/connectors/{id}/observe
POST /api/v1/accordgate/webhooks
GET  /api/v1/accordgate/audit?limit=100&offset=0

Policy creation returns the bundle identifier and signature. Connector observations compare the observed hash with the approved desired policy and return the current drift status.

Pagination and errors

Collection endpoints use limit and offset. Errors use a stable envelope.

{ "error": { "code": "invalid_request", "message": "..." } }

Common statuses are 400 invalid request, 401 invalid or revoked key, 403 plan or scope required, 404 tenant-scoped record not found, 409 lifecycle conflict, 422 validation failure, and 429 rate limit.