Report a public cert-manager observation
POST/api/v1/certops/executor/observations
Additive controller transport, not the agent protocol. Requires certops:observations:write and a token immutable controllerClusterId binding. Workspace and cluster provenance are derived from that token; body values must match. Private material is audited and rejected before rollout, extension, or scope denial. The passive route remains available while a workspace is paused. Idempotency is semantic and excludes only retry diagnostic observationId and observedAt fields.
Request
Responses
- 200
- 201
- 400
- 401
- 403
- 404
- 409
- 422
- 429
- 500
- 503
Exact idempotent replay
Observation accepted
Bad request
Unauthorized
Forbidden
Not found
Idempotency key conflicts with a different semantic observation (CERTOPS_CONTROLLER_OBSERVATION_CONFLICT)
Request rejected because it contained private key material
CertOps machine-token rate limit exceeded
Observation could not be persisted after acceptance (CERTOPS_CONTROLLER_OBSERVATION_PERSIST_FAILED)
Security audit sink unavailable while rejecting private material