> ## Documentation Index
> Fetch the complete documentation index at: https://docs.attesso.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Complete an authorization

> Commit or cancel a reservation safely and handle retries without double execution.

After Attesso returns an authorization, your backend must gate execution, respect the deadline, and close the reservation exactly once.

## Gate execution

Do not use the HTTP status, `decision`, or `state` alone. Execute only when the latest representation has:

```json theme={null}
{
  "decision": "ALLOW",
  "state": "RESERVED",
  "can_execute": true,
  "execute_before": "2026-08-10T03:05:00Z"
}
```

If your execution starts asynchronously, ensure the external capability cannot act after `execute_before`.

## Commit after acceptance

Commit means the executor accepted the authorized action. It does not mean a virtual card was created, a payment settled, or a service was later fulfilled.

```http theme={null}
PUT /v1/authorizations/{authorization_id}/commit
Authorization: Bearer att_test_...
Idempotency-Key: cmt_...
Content-Type: application/json
```

```json theme={null}
{
  "external_action_reference": "booking_91823",
  "provider_transaction_reference": "provider_77401",
  "reported_accepted_at": "2026-08-10T03:02:41Z"
}
```

A successful commit changes the authorization to `COMMITTED` and atomically changes the mandate to `CONSUMED`.

## Cancel only when execution is impossible

Before cancellation, prove through your own controls that the external action can no longer occur. Disable any card, token, job, or provider capability first.

```http theme={null}
PUT /v1/authorizations/{authorization_id}/cancellation
Authorization: Bearer att_test_...
Idempotency-Key: cnl_...
Content-Type: application/json
```

```json theme={null}
{
  "reason": "EXECUTION_FAILED",
  "execution_disposition": "NO_LONGER_POSSIBLE",
  "external_credential_reference": "vcc_opaque_481"
}
```

Use `NEVER_BECAME_POSSIBLE` only when no external execution capability ever became usable.

## Retry safely

All lifecycle writes require an idempotency key.

* Retry the same logical operation with the same key and identical canonical input.
* Generate a new key for a new logical operation.
* Reusing a key with different input returns a conflict.
* A replay returns the same resource identity in its current state.

## Resolve uncertain outcomes

<Steps>
  <Step title="Stop new execution">
    If a network failure makes the result uncertain, do not start another action.
  </Step>

  <Step title="Read the authorization">
    Call `GET /v1/authorizations/{authorization_id}` and reconcile its current state.
  </Step>

  <Step title="Replay when safe">
    Retry the original commit or cancellation with the same idempotency key and body.
  </Step>

  <Step title="Escalate terminal conflicts">
    A committed, cancelled, or expired authorization cannot transition to another terminal state. Treat a conflicting terminal outcome as an operational incident.
  </Step>
</Steps>

<Warning>
  Never cancel or allow a reservation to expire while an external credential can still execute. Attesso records your disposition assertion but cannot independently disable that credential.
</Warning>