Renew a claimed job lease

POST 
/api/v1/certops/agent/jobs/:jobId/lease

Re-proves claim ownership (authenticated agent + claimId), transitions claimed→running on first renew, extends lease_expires_at, stamps lease_renewed_at, and extends the still-open dispatch nonce so late results remain reportable through the reaper hard-grace window. The agent must call this before each external side effect (ACME/DNS/deploy/ reload). See COORDINATION-B6.md. Not an agent-protocol envelope messageType: lean JSON body with claimId and optional sequence.

Request

Responses

200

Lease renewed; job is running

400

Lease body invalid or job not in a renewable state (CERTOPS_AGENT_MESSAGE_INVALID or CERTOPS_AGENT_LEASE_INVALID)

401

Per-agent credential missing, unknown, or revoked

404

Job not found, or CertOps is disabled deployment-wide

409

Claim ownership mismatch (CERTOPS_AGENT_CLAIM_OWNERSHIP_MISMATCH) or sequence regression (CERTOPS_AGENT_SEQUENCE_REGRESSION)

410

Agent is retired

422

Request rejected because it contained private key material

429

CertOps machine-token rate limit exceeded

500

Internal server error

503

Security audit sink unavailable while rejecting private material