Accept Agent-only procedure as the verified principal
Exact packet digest and side-specific statement required. Both principals must accept independently before a representative can open the case. Acceptance and OAuth/account guards commit atomically.
Use one listed account-session, scoped OAuth, or partner credential alternative. Account tokens retain the approving account’s authority. Cookie-authenticated writes require same-origin authorization. Alternatives are OR; schemes in one alternative are AND.
AccountOAuth
Account tokens authorize only their approving account and case scope. S256 PKCE is mandatory on the code flow. Explicit reacceptance is required after Rules/disclosure changes.
Read the response status and stable error code. See errors and rate limits for recovery. Refresh the resource before resolving a state or digest conflict.
Idempotency and retries
For throttling, honor Retry-After when present. Back off on retryable server failures.
The request is accepted only when its credential, authority, case state, and resource preconditions are satisfied.