​
Overview

A connected subscription runs in its own browser on the person’s Sessions computer. The Allternit API forwards requests to that computer’s gateway and adds the gateway token server-side. Every task that would send something through a subscription needs a human action: proof that a person sent or confirmed that task. Agents, tools, bots and schedules never get one on their own. They prepare the task on an approval card, and the action is created when a person approves it.
This namespace is served by the Allternit API data-plane node (http://127.0.0.1:8013 on the same machine, or your paired or provisioned node), under /api/v1.

​
Endpoints

​
Submitting a task

POST /api/v1/subscriptions/gateway/v1/tasks with the action in the x-allternit-human-action header:
The forwarder checks, in order: the body, the provider, the disclosure version, then the human action. The action is used up only when everything passes. It belongs to one user, expires after 10 minutes, and works once; a retry with the same idempotency_key may reuse it. Accepted tasks are stamped with initiated_by: {kind: "human", user_id, action_id}.

​
Approval cards are bound to their task

When a person approves a subscription card, the action created for it can start only the task on that card. The card carries the task as subscription.task: Submit exactly that task with the action. A task with a different capability, provider, prompt or options is refused with human_action_task_mismatch, and the action is not used up. The card’s preview and provider are taken from subscription.task, so what the person reads is the start of what runs. A card without a complete subscription.task (sent by an Allternit runtime from before task binding) cannot be approved: the decision returns 409 task_required, the card stays open with that message, and the person can reject it and ask again once Allternit has updated.

​
Errors