Activate the exact reviewed rollback
const url = 'https://api.katara.com/katara/v1/orgs/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/environments/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/agent-rollbacks/reviews/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/activate';const options = { method: 'POST', headers: { 'Idempotency-Key': 'example', 'X-Katara-CSRF': '1', Authorization: 'Bearer <token>', 'Content-Type': 'application/json' }, body: '{"review_digest":"example","target_version_id":"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0","acknowledge":true}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.katara.com/katara/v1/orgs/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/environments/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/agent-rollbacks/reviews/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/activate \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --header 'Idempotency-Key: example' \ --header 'X-Katara-CSRF: 1' \ --data '{ "review_digest": "example", "target_version_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "acknowledge": true }'Requires a signed-in human owner session in the selected Live environment. API keys, service accounts and workloads are refused. Query parameters are rejected and responses are no-store. Rollback restores an exact prior approved immutable definition as a new monotonically increasing publication; it never moves a deployment pointer or restores historical authority. Current source, model, tool, collection, policy, grant, funded consent and head-version checks remain mandatory. Requires explicit acknowledgement and the exact review digest and prepared target version ID. Publication and the immutable receipt commit atomically. Recover an uncertain response with the same key and unchanged body.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Header Parameters
Section titled “Header Parameters”Browser cookie mutations require value 1 and an allowed Origin. Session bearer clients may omit this header.
Required for cookie-authenticated changes. Use the UUID of the account that loaded the application. A different current cookie account returns account_changed before the handler runs. Session bearer and API key clients do not require this header.
Request Bodyrequired
Section titled “Request Bodyrequired”object
Responses
Section titled “Responses”Successful request
object
object
object
Examplegenerated
{ "org_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "environment_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "operation_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "review_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "review_digest": "example", "restored_version": { "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "version": 1, "integrity": "example" }, "published_version": { "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "version": 1, "integrity": "example" }, "created_by": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "created_at": "2026-04-15T12:00:00Z"}Headers
Section titled “Headers”Account_changed: reload and review with the signed-in account.
default
Section titled “default”Request error
object
object
Stable; branch on it. Any operation can answer invalid_request, with param naming the refused field when there is one; human_session_required, when an API key, service account or workload calls an operation only a signed-in person may perform; reauthentication_required, when a person’s sign-in is too old for the operation; permission_denied; route_not_found and method_not_allowed, when no operation matches the path or method; and feature_unavailable, when the operation’s service is not enabled on this deployment.
The request field a refusal is about, such as the agent_id or run_id query parameter; null when the refusal is not about one field.
Example
{ "error": { "action": "sign_in" }}