Capture a manual step (the Phase B automation backlog)

One-tap log of an action the product could not yet do. Operator-only.

POST/operator/manual-steps

Authorization

AuthorizationBearer token (JWT) · headerrequired

JWT issued by the external IdP via the OAuth 2.0 authorization-code flow (Kinde in production; a simulator in test). The client obtains it and sends it as a Bearer token on every authenticated call. Sarvex's services verify it — issuer, audience, signature (IdP JWKS), expiry — and read identity and tenant from its claims. Sarvex does not issue or revoke these tokens. merchant_id/store_id are read from the verified claims (and the merchant→store mapping), never from the URL. The operator scope is required for /operator/*. Operators acting on a specific merchant pass the X-Operate-As header, which is recorded in the audit log.

Scopes:operator

Header parameters

X-Operate-Asstring

Merchant id an operator is acting on behalf of (audit-logged).

Request body

requiredapplication/json

manual_step_idstring

target_merchant_idstring

descriptionstringrequired

What was done by hand.

dispositionmanual_step_disposition

default: "unclassified"

Allowed:unclassifiedautomatetemplatiseaccept_manual

created_atstring<date-time>

Responses

201

Captured.

manual_step_idstring

target_merchant_idstring

descriptionstringrequired

What was done by hand.

dispositionmanual_step_disposition

default: "unclassified"

Allowed:unclassifiedautomatetemplatiseaccept_manual

created_atstring<date-time>

403

Authenticated but not permitted (e.g. non-operator on an operator route).

errorobjectrequired

Show properties

codestringrequired

messagestringrequired

detailsobject | null

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer token (JWT)Remember on this deviceInclude my values in samples

Parameters

X-Operate-AsheaderMerchant id an operator is acting on behalf of (audit-logged).

Bodyapplication/json

manual_step_idstringtarget_merchant_idstringdescriptionstring*What was done by hand.dispositionstringcreated_atstring

Request

curl -X POST "https://api.sarvex.example.com/v1/operator/manual-steps" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "description": "string",
  "disposition": "unclassified"
}'

const response = await fetch("https://api.sarvex.example.com/v1/operator/manual-steps", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type": "application/json"
  },
  body: "{\n  \"description\": \"string\",\n  \"disposition\": \"unclassified\"\n}"
});

import requests

response = requests.post(
    "https://api.sarvex.example.com/v1/operator/manual-steps",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Content-Type": "application/json"
    },
    data="{\n  \"description\": \"string\",\n  \"disposition\": \"unclassified\"\n}",
)

Response

{
  "description": "string",
  "disposition": "unclassified"
}

{
  "error": {
    "code": "string",
    "message": "string",
    "details": {}
  }
}