Missions API

These routes are operator-scoped. STACK hides cross-operator Mission IDs with a 404. Opening a Mission counts as one metered action. Complete, revoke, replay, and reads do not.

Open a Mission

POST /v1/missions

curl -X POST https://api.getstack.run/v1/missions \
  -H "Authorization: Bearer $STACK_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "intent_summary": "Reconcile August invoices",
    "intent_services": ["stripe", "quickbooks"],
    "expected_counterparties": ["acct_123"],
    "max_actions": 200,
    "coverage_cap_cents": 5000,
    "max_duration_seconds": 3600,
    "cap_behavior": { "max_actions": "auto_revoke" }
  }'

The response contains mission_id, the signed Mission claim_id, and expires_at.

A Mission bounds the job; it is not a mandate. An authority binding can pin the Mission ID, and a Passport can carry both mission_ids and opaque authority_refs. See Authority API.

Read Missions

• GET /v1/missions - list Missions. Filter with status, page, and limit.
• GET /v1/missions/:id - return the Mission and current cap_usage.
• GET /v1/missions/:id/replay - reconstruct its signed event timeline.
• GET /v1/missions/:id/dossiers - list human dossier revisions in issue order.

Complete or revoke

curl -X POST https://api.getstack.run/v1/missions/ms_123/complete \
  -H "Authorization: Bearer $STACK_TOKEN" -H "Content-Type: application/json" \
  -d '{"output":{"reconciled":42}}'

curl -X POST https://api.getstack.run/v1/missions/ms_123/revoke \
  -H "Authorization: Bearer $STACK_TOKEN" -H "Content-Type: application/json" \
  -d '{"reason":"adversarial","notes":"Unexpected recipient"}'

Repeating the same terminal transition is safe. An incompatible second transition returns 409. A revoke can use adversarial or operator_initiated_clean.

Author a dossier

POST /v1/missions/:id/dossier

The body accepts narrative, optional decision-tree and alert detail, lessons_learned, and an incident classification. The Enterprise entitlement is enforced when STACK creates the signed claim.

Operator reviews use separate routes and a stricter dashboard-session rule. See Evidence API.