Version 1 / Guides / Interventions

Two independent checks before mutation

An intervention needs both a scoped tenant service credential and a tenant-signed operator capability for the exact command. Platform membership alone is insufficient.

Contract-shaped example

curl --fail-with-body \
  --request POST \
  --header "Authorization: Bearer $HEADLESS_SERVICE_CREDENTIAL" \
  --header "Ledgero-Operator-Capability: $LEDGERO_OPERATOR_CAPABILITY" \
  --header "Content-Type: application/json" \
  --data '{"interventionSchemaVersion":"1.0","commandId":"cmd_pause_001","type":"lot:pause","expectedState":"open","pauseDurationMs":120000,"reasonCode":"operational_disruption"}' \
  "$LEDGERO_CONTROL_URL/v1/lots/lot_opaque/interventions"

The commandId is stable across a retry. State and revision preconditions prevent a stale approval from applying to a different Lot state. A conflicting reuse fails closed.