Report an event for one CertOps job
POST/api/v1/certops/jobs/:jobId/events
Machine-token route for reporting lifecycle events scoped to the path jobId. Requires certops:events:write. Workspace identity is derived from the authenticated CertOps API token; body workspaceId cannot override it. The route uses the same private-key rejection, generic-secret redaction, idempotency, audit, and persistence path as POST /api/v1/certops/executor/events.
Request
Responses
- 202
- 400
- 401
- 403
- 404
- 409
- 413
- 422
- 429
- 500
- 503
Event accepted
Event body failed schema/idempotency validation (CERTOPS_EXECUTOR_EVENT_INVALID, CERTOPS_EXECUTOR_EVENT_TYPE_INVALID, CERTOPS_EXECUTOR_EVENT_STATUS_MISMATCH, or CERTOPS_JOB_STATUS_INVALID)
Unauthorized
Caller lacks the required events-write scope (CERTOPS_API_TOKEN_SCOPE_DENIED), or the token's workspace does not match the job's workspace (CERTOPS_EXECUTOR_WORKSPACE_MISMATCH)
CertOps is disabled or the certificate job was not found in the authenticated workspace
Executor event idempotency key conflicts with a different sanitized payload (CERTOPS_EXECUTOR_EVENT_CONFLICT), or the job is currently claimed by a CertOps agent and the event carries a terminal status (CERTOPS_EXECUTOR_JOB_AGENT_CLAIMED). The executor and agent lanes share one certificate_jobs table but the executor lane holds no lease, so allowing an executor token to end a job an agent is still executing would land the agent's side effects against a terminal row.
The machine request body exceeded the dedicated 4 MiB pre-auth boundary (CERTOPS_EXECUTOR_EVENT_BODY_TOO_LARGE), or normalized evidence output exceeded 65,536 UTF-8 bytes (CERTOPS_EVIDENCE_OUTPUT_TOO_LARGE). The payload is not echoed.
Request rejected because it contained private key material
CertOps machine-token rate limit exceeded
Internal server error
The security audit sink was unavailable while recording a private-key-material rejection. The endpoint fails closed; the payload is neither persisted nor echoed and no executor-event side effects occur.