11.11 Marketplace decision

POST /api/v1/marketplace/applications/{applicationId}/decision

• Purpose. Platform Super Administrator accepts a public marketplace request into eligibility review, or declines it.
• Authentication. Session cookie. The account must be Platform Super Administrator; MFA enrolment is required, plus a registered passkey if the tenant policy requires MFA; session must be created within 5 minutes. Tenant header is ignored.
• Headers. Origin (must be allowed), Content-Type: application/json (otherwise 415).
• Path. applicationId: UUID.
• Body.

Field	Type	Required	Rules
decision	enum	Yes	APPROVED or REJECTED
note	string	Required when REJECTED	Trimmed; max 500; at least 5 characters when rejecting

curl -s -X POST https://dffms.org/api/v1/marketplace/applications/0190f2c4-6b3e-7a1d-8c2f-000000000110/decision \
  -H 'Cookie: __Secure-dffms.session_token=<session-cookie>' \
  -H 'Origin: https://dffms.org' \
  -H 'Content-Type: application/json' \
  -d '{"decision":"REJECTED","note":"Registration certificate not provided."}'

Response (200):

{
  "data": {
    "id": "0190f2c4-6b3e-7a1d-8c2f-000000000110",
    "reference": "MKT-2026-0042",
    "status": "REJECTED",
    "updatedAt": "2026-10-26T08:05:00.000Z"
  },
  "error": null,
  "requestId": "<request-id>"
}

Errors:

HTTP	Code	Meaning
401	MFA_REQUIRED	MFA or passkey missing.
401	FRESH_AUTH_REQUIRED	Session older than 5 minutes.
401	UNAUTHENTICATED	No session.
403	ORIGIN_DENIED	Origin not allowed.
403	FORBIDDEN	Not Platform Super Administrator.
404	NOT_FOUND	Request not found.
409	INVALID_STATE	Request not PENDING, already decided, or a legacy request that needs manual review.
413	PAYLOAD_TOO_LARGE	Declared length above 8 KiB.
415	INVALID_CONTENT_TYPE	Not JSON.
422	VALIDATION_ERROR	Body invalid, or rejection without a note.
500	INTERNAL_ERROR	Unhandled error.

Side effects:

• APPROVED: status APPROVED, lifecycle ELIGIBILITY_REVIEW. Creates a finance application in the product's tenant, keyed marketplace:<applicationId> (once only), with the state resolved from the applicant's state of operation. Writes audit and notifies the applicant.
• REJECTED: status REJECTED, lifecycle DECLINED. Notifies the applicant.