Report job results and evidence

POST 
/api/v1/certops/agent/jobs/results

Result/evidence ingestion authenticated with the per-agent credential (bearer). Request body is the agent-protocol envelope with messageType result or evidence, dispatched on the envelope messageType (packages/contracts/certops/agent-protocol.schema.json, additionalProperties false). Result ingestion re-proves claim ownership (agent + claimId, where attemptId doubles as the claimId), consumes the single-use dispatch nonce (replay ledger), and transitions the job terminally in one transaction. Evidence messages append job-scoped public evidence without any job transition. The workspace kill switch never blocks results. A retired agent receives 410. Payloads containing private key material are rejected with 422. Hidden with 404 while certops.enabled is disabled.

Request

Responses

200

Result acknowledged (jobId/status/errorCode/completedAt) or evidence appended (ok/evidenceCount)

400

Invalid envelope, body, or result status (CERTOPS_AGENT_MESSAGE_INVALID or CERTOPS_AGENT_RESULT_STATUS_INVALID)

401

Per-agent credential missing, unknown, or revoked

404

Certificate job not found (CERTOPS_AGENT_JOB_NOT_FOUND), or CertOps disabled deployment-wide (NOT_FOUND)

409

Claim ownership mismatch (CERTOPS_AGENT_CLAIM_OWNERSHIP_MISMATCH) or single-use nonce rejected/replayed (CERTOPS_AGENT_RESULT_NONCE_REJECTED)

410

Agent is retired

422

Request rejected because it contained private key material

429

CertOps machine-token rate limit exceeded

500

Internal server error

503

Security audit sink unavailable while rejecting private material