---
title: "Record one provider-authenticated commercial acceptance"
method: POST
path: "/provider/commercial-acceptances"
---

# Record one provider-authenticated commercial acceptance

`POST /provider/commercial-acceptances`

Provider-key-authenticated append-only acceptance only. It cannot establish a deduplicated company, funding, exact terms, renewal, or pilot proof until NHS separately records the applicable owner-verified company and commercial evidence. Accepted event shapes are exact and unknown fields are rejected.

## Headers

- `Idempotency-Key` string, required

## Request body

- union — Exact provider-authenticated acceptance shapes. Unknown fields and shape-inappropriate fields are rejected.
  - object
    - `event_type` 'pilot_company', required
    - `provider_acceptance_reference` string, required — Non-secret provider evidence reference
  - object
    - `event_type` 'terms_acceptance', required
    - `offer_id` string, uuid, required
    - `offer_version` integer, required — Exact version reviewed by the provider; rejected if the current draft differs
    - `exact_terms_sha256` string, required — Exact commercial terms hash reviewed by the provider; rejected if the current draft differs
    - `provider_acceptance_reference` string, required — Non-secret provider evidence reference
  - object
    - `event_type` 'terms_renewal', required
    - `offer_id` string, uuid, required
    - `related_acceptance_event_id` string, uuid, required — Prior terms_acceptance or terms_renewal in the same exact-terms chain
    - `offer_version` integer, required — Exact version reviewed by the provider; rejected if the current draft differs
    - `exact_terms_sha256` string, required — Exact commercial terms hash reviewed by the provider; rejected if the current draft differs
    - `provider_acceptance_reference` string, required — Non-secret provider evidence reference

## Response `200`

Exact idempotent replay of the existing provider-authenticated acceptance

- ProviderCommercialAcceptanceResponse
  - `acceptance` ProviderCommercialAcceptanceEvent, required — Append-only provider-key-authenticated event; not owner verification or commercial proof by itself
    - `id` string, uuid, required
    - `provider_claim_id` string, uuid, required
    - `provider_offer_id` string, uuid
    - `provider_api_key_id` integer, required
    - `event_type` 'pilot_company' | 'terms_acceptance' | 'terms_renewal', required
    - `related_acceptance_event_id` string, uuid
    - `offer_version` integer
    - `terms_contract_version` 'nhs-provider-commercial-terms-v1'
    - `exact_terms_sha256` string
    - `provider_acceptance_reference` string, required
    - `provider_accepted_at` string, date-time, required
    - `valid_until` string, date-time
    - `created_at` string, date-time, required
  - `created` boolean, required
  - `idempotent_replay` boolean, required
  - `provider_authenticated` true, required
  - `owner_verification_required` true, required
  - `commercial_proof_created` false, required
  - `evidence_scope` string, required

## Other responses

- `201` — New provider-authenticated acceptance; owner verification is still required and commercial proof is false
- `400` — Invalid header
- `401` — Valid active claim-scoped provider key required
- `409` — Stale claim

---

[API](https://skmtc.net/nothumansearch/apis/not-human-search-api.md) · [All operations](https://skmtc.net/nothumansearch/apis/not-human-search-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/nothumansearch/not-human-search-api/revisions/129e69d16c7f/schema)