Docs Sign in Start building

Read the five gates on a Core digest

product.gates

Returns design review, infosec, SIT, UAT and go-live for the Product's sandbox Core, or the sandbox or live Core coreDigest names. A gate is required when the tenant wrote an approval policy under its key, `core.gate.<gate>`, in this environment, and its state comes from the approvals product.gate.submit opened on that digest, a signed one first, else the newest: open while it waits, signed once every step approved, rejected or returned by a decider, unsubmitted when none waits. Each gate names its policy version, the approval, its steps and every decision. SIT and UAT also name the SHA-256 of the Tests document the stored check outcome renders into. Nothing is stored beside the approvals: a new digest has no approvals, so every gate on it reads unsubmitted.

GET /v1/products/{productId}/gates

Principal api_key. Idempotency not_required. Environment sandbox.

Input

FieldInTypeDescription
productId requiredpathstringHyperscale product ID
coreDigestquerystringThe Product's sandbox or live Core digest; the sandbox Core when omitted
X-Hyperscale-Environmentheadersandbox | live

Output

FieldTypeDescription
productId requiredstringHyperscale product ID
coreDigest requiredstringThe digest the gates are read on
sandboxCoreDigest requiredstringSHA-256 digest of the resolved Core closure
liveCoreDigest requiredstring | nullThe live Core's digest; null before the first promotion
gates requiredobject[]

Request sample

curl

curl --request GET 'https://hyperscale0.ai/v1/products/prd_sandbox_00000000000000000001/gates' \
  --header "Authorization: Bearer $HYPERSCALE_API_KEY" \
  --header 'X-Hyperscale-Environment: sandbox'

TypeScript SDK

import { createClient } from "@hyperscale0/sdk";

const hs = createClient({
  apiKey: process.env.HYPERSCALE_API_KEY,
  productId: process.env.HYPERSCALE_PRODUCT_ID,
});
const result = await hs.call("product.gates");

CLI

hyperscale api call product.gates

Errors

CodeHTTPCause
approval_rejected403A person rejected the call or returned it to the maker, so it never runs.
approval_required202The call waits for decisions: an agent's call over its grant waits on its delegator, and a program action under `requires approval` waits on distinct people other than the maker.
environment_mismatch403The session was issued for sandbox or live and the request targets the other environment.
internal_error500Hyperscale hit an unexpected server-side condition and hid internal implementation details from this audience.
invalid_request400The request does not match the API reference.
method_not_allowed405The route exists, but not for the request's HTTP method.
missing_required_permission403The signed-in member's current role does not grant the permission required for this operation.
missing_required_product_capability403The Product was created without a capability required by this operation.
missing_required_scope403The credential is valid but does not grant one or more operation scopes.
not_found404No Hyperscale route matched the requested path and method.
oauth_client_not_admitted403The bearer is an OAuth client token, and this operation does not admit the oauth2_client principal.
operation_not_allowed403The credential authenticated, but the operation is outside the allowlist its Product's composition produced. The message names the operation and the capability that would admit it.
rate_limited429The credential sent more than its limit in the current 60-second window: 600 requests per API key or session, 1,200 per IP address. Every response carries `x-ratelimit-limit`, `x-ratelimit-remaining` and `x-ratelimit-reset` (Unix seconds).
resource_not_found404The requested resource does not exist in the credential's visible scope.
resource_reader_unavailable503A generated read model could not serve the request at this moment.
state_conflict409The operation conflicts with the current durable state of the resource.
tenant_mismatch403The request mixed tenant-owned identifiers across tenant boundaries.
tenant_not_found404The credential resolved to a tenant Hyperscale cannot find.
unauthorized403The request did not include a valid Hyperscale bearer credential for this environment.
agent_token_expired401The agent token is real, but its grant ended. A grant lasts 30 days, or 7 days unused. `details.expiresAt` holds the date in ISO 8601 and `details.agentName` names the agent.
agent_token_replaced401The account owner ran `hyperscale agent setup` again for this agent, which replaced this token with a newer one. `details.agentName` names the agent and `details.replacedAt` holds the date.
core_digest_unknown404A gate signs one Core of the Product: its current sandbox Core or its live Core. coreDigest names neither. details.sandboxCoreDigest and details.liveCoreDigest name the two it accepts.
device_login_expired401The bearer is the account owner's own device login from `hyperscale auth login`, not an agent token. Its access token lasts an hour and the CLI refreshes it; the login itself ends after 30 days, or 7 days unused. `details.expiresAt` holds when it ended in ISO 8601.
invalid_credentials401Hyperscale could not accept the account or credential request. Signup, login, and bearer authentication use one 401 for every case they reject, so the response exposes no credential-specific reason or registered-email verdict. The single exception is a key that is real but homed in the other environment: because the presented secret already matched a stored key, the message names the mismatch instead of leaving a working credential looking unknown. A bearer that matched nothing gets text that fits its prefix (an agent token, a refresh token, a personal access token, a session or no Hyperscale token at all), which says only what the caller sent, never whether a credential like it exists.
key_revoked401The Product API key exists, but it was revoked. `details.revokedAt` holds the date.
product_not_found404No Product matches the `productId` in this tenant and environment, or a resource the request names belongs to a different Product than the API key's. A missing, foreign or ambiguous resource binding also reports this code.
session_expired401The session behind this request has ended. A console session ends 30 days after sign-in, or after 12 hours with no request. An admin or customer session ends 24 hours after sign-in, or after 15 minutes with no request. A personal access token ends at the `expiresAt` set when it was created.
session_required401This operation needs a person signed in through the browser or the `hyperscale` CLI. A Product API key cannot call it. The request carried no session, or its token matched no live session.
session_revoked401The session or personal access token behind this request was ended before its expiry. Sign-out, `user.session.revoke`, a password reset, a role change, removal from the team, user suspension and `personal_access_token.revoke` all end sessions.
tenant_status_forbidden409The company is suspended or closed, so every credential bound to it is refused, reads included. `details.tenantId` names the company.

All operations