Skip to content
KataraKatara documentation

reviewOrganizationSession

GET
/katara/v1/orgs/{org_id}/session-evidence/{session_id}
curl --request GET \
  --url https://api.katara.com/katara/v1/orgs/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/session-evidence/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0 \
  --header 'Authorization: Bearer <token>'

Organization-wide human-session surface. No environment or reset generation. Current policy and current membership remain authoritative. Evidence contains only exact app-session review metadata and enrolled connection/profile pins, issuer and bounded authentication times; never private upstream subjects, client identifiers, claims or tokens. The exact-target review requires current old-policy owner authority and an independent local sign-in, and only returns a same-user live SSO session; no enumeration. Configuration requires owner authority, an independent local credential sign-in (with MFA when the account has a verified factor), the exact reviewed same-user live SSO session, and expected policy revision. Preserve the full metadata request and caller key after an unknown result. Completed same-key replay is historical and does not state current policy. Operator enrollment and installed provider acceptance remain separate.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
org_id
required
string format: uuid
session_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000

Responses

Section titled “Responses”

200

Section titled “200”

Current safe organization metadata, or a historical completed operation receipt.

Media typeapplication/json
object
org_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
evidence
required
Any of:
object
org_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
reviewed_session_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
connection
required
object
id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
version
required
integer
>= 1 <= 9223372036854776000
integrity
required
string
/^sha256:[a-f0-9]{64}$/
profile_integrity
required
string
/^sha256:[a-f0-9]{64}$/
max_authentication_age_seconds
required
integer
>= 1 <= 86400
issuer
required
string
<= 2048 characters /^https://[^/?#@\s]+(?:/[^?#\s]*)?$/
//$/
authenticated_at
required
string format: date-time
/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d{0,8}[1-9])?Z$/
Allowed value: 0001-01-01T00:00:00Z
expires_at
required
string format: date-time
/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d{0,8}[1-9])?Z$/
Allowed value: 0001-01-01T00:00:00Z
Examplegenerated
{
  "org_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "evidence": {
    "org_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "reviewed_session_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "connection": {
      "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "version": 1,
      "integrity": "example"
    },
    "profile_integrity": "example",
    "max_authentication_age_seconds": 1,
    "issuer": "example",
    "authenticated_at": "2026-04-15T12:00:00Z",
    "expires_at": "2026-04-15T12:00:00Z"
  }
}

Headers

Section titled “Headers”
Cache-Control
string
Allowed value: no-store

default

Section titled “default”

Request refused or service unavailable

Media typeapplication/json
object
error
required
object
message
required
string
>= 1 characters <= 500 characters
type
required
string
>= 1 characters <= 100 characters
code
required

Stable; branch on it. Any operation can answer invalid_request, with param naming the refused field when there is one; human_session_required, when an API key, service account or workload calls an operation only a signed-in person may perform; reauthentication_required, when a person’s sign-in is too old for the operation; permission_denied; route_not_found and method_not_allowed, when no operation matches the path or method; and feature_unavailable, when the operation’s service is not enabled on this deployment.

string
>= 1 characters <= 100 characters
param
required

The request field a refusal is about, such as the agent_id or run_id query parameter; null when the refusal is not about one field.

string | null
request_id
required
string
>= 1 characters <= 100 characters
upstream_status
required
integer | null
action
Allowed values: sign_in reauthenticate request_access review fund retry reconcile refresh support
operation_id
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
snapshot_ref
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
Example
{
  "error": {
    "action": "sign_in"
  }
}