Submit a previewed renewal under workspace job approval policy

POST 
/api/v1/operator/renewals/requests

Needs mcp:renew:request and both write switches. Creates an ordinary renewal job attributed to the person and connection. CertOps Job approval on creates pending_approval for independent review; off creates immediately claimable pending work without recording human approval. Existing jobs retain their gate; a policy change invalidates an unsubmitted preview. The body is exactly planId, planHash and requestId and cannot override policy. An identical retry returns the original outcome (200, replayed true), even after preview expiry or completion; reused requestId with different content is a 409. Revocation is serialized with submission. Submission is not proof of renewal. Response shape: packages/contracts/mcp/mcp-renew-tools.schema.json definition tt_request_renew_output.

Responses

200

Original request returned for an identical retry (replayed true); no new job or quota charge

201

Request created, queued or waiting for approval according to workspace policy

400

Bad request

401

Unauthorized

402

Cloud workspace plan does not include certificate operations (PLAN_FEATURE_REQUIRED)

403

The connection lacks scope, assistant writes are disabled, or the Cloud workspace is frozen (WORKSPACE_FROZEN)

404

Not found

409

Refused for a stable reason: the plan does not match or the certificate changed since the preview, the request id was used for something different, the certificate is retired or unmanaged, the certificate authority is at capacity, or the workspace is paused. The code says which; the message is fixed wording.

410

The preview expired

429

Too many assistant requests await approval, or Cloud monthly renewal quota is exhausted (CERTOPS_RENEWAL_QUOTA_EXCEEDED)

500

Internal server error