---
title: "Prepare an authorization-attested action for a disclosed paid offer"
method: POST
path: "/action-tickets"
---

# Prepare an authorization-attested action for a disclosed paid offer

`POST /action-tickets`

Requires a committed organic search receipt and exact principal-consent v1 attestation. Accepts controlled constraints only; no name, email, contact detail, raw prompt, agent identity, or principal identity. Returns the raw ticket bearer and POST handoff endpoint, not the provider action URL. Creating a ticket charges neither party. See https://nothumansearch.ai/privacy#consent-v1.

## Request body

- ActionTicketRequest
  - `offer_id` string, uuid, required
  - `search_id` string, required — Committed query-free organic search receipt
  - `demand_topic` 'payments' | 'commerce' | 'jobs' | 'data' | 'search' | 'weather' | 'maps' | 'email' | 'messaging' | 'image' | 'video' | 'audio' | 'documents' | 'security' | 'finance' | 'health' | 'education' | 'news' | 'analytics' | 'automation' | 'productivity' | 'identity' | 'storage' | 'ai-tools' | 'developer-tools' | 'other', required
  - `region_code` string
  - `budget_band` 'unspecified' | 'under_100' | '100_499' | '500_1999' | '2000_plus'
  - `urgency` 'unspecified' | 'now' | '7_days' | '30_days' | 'researching'
  - `requirement_flags` string[]
  - `principal_consent` true, required — Caller attests it is authorized by the principal under the exact published v1 wording
  - `consent_version` 'nhs-principal-consent-v1', required

## Response `200`

Exact replay with the attribution bearer reconstructed from the persisted ticket snapshot

- ActionTicketPreparationResponse — Ticket preparation returns a bearer plus the NHS handoff surface, never the provider action URL
  - `ticket` PublicActionTicket, required — Controlled consent-attested ticket snapshot. Provider action URL, token hash, token nonce, signing-key metadata, and internal evidence references are excluded.
    - `id` string, uuid, required
    - `provider_claim_id` string, uuid, required — Opaque provider claim identifier; not a provider identity or contact field
    - `provider_offer_id` string, uuid, required
    - `search_receipt_id` string, uuid — Removed when controlled intent is redacted
    - `offer_version` integer, required
    - `offer_name` string, required
    - `offer_summary` string, required
    - `action_type` 'lead' | 'demo' | 'trial' | 'signup' | 'purchase' | 'quote' | 'application' | 'booking', required
    - `disclosure` 'Provider-funded action', required
    - `charge_event` 'accepted' | 'activated' | 'converted', required
    - `bounty_cents` integer, required
    - `currency` 'usd', required
    - `billing_mode` 'terms', required
    - `commercial_terms_contract_version` 'nhs-provider-commercial-terms-v1', required
    - `commercial_terms_sha256` string, required
    - `principal_price_mode` 'free' | 'fixed' | 'quote' | 'provider_pricing', required
    - `principal_price_cents` integer
    - `principal_currency` 'usd', required
    - `demand_topic` 'payments' | 'commerce' | 'jobs' | 'data' | 'search' | 'weather' | 'maps' | 'email' | 'messaging' | 'image' | 'video' | 'audio' | 'documents' | 'security' | 'finance' | 'health' | 'education' | 'news' | 'analytics' | 'automation' | 'productivity' | 'identity' | 'storage' | 'ai-tools' | 'developer-tools' | 'other' | 'redacted', required
    - `region_code` string
    - `budget_band` 'unspecified' | 'under_100' | '100_499' | '500_1999' | '2000_plus', required
    - `urgency` 'unspecified' | 'now' | '7_days' | '30_days' | 'researching', required
    - `requirement_flags` string[], required
    - `principal_consent` true, required
    - `consent_version` 'nhs-principal-consent-v1', required
    - `status` 'created' | 'redirected' | 'accepted' | 'activated' | 'converted' | 'rejected' | 'duplicate' | 'invalid', required
    - `expires_at` string, date-time, required
    - `intent_redacted_at` string, date-time
    - `authorization_revoked_at` string, date-time
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
  - `offer` PublicProviderOffer, required — Separate disclosed action attached to an exact returned organic site; the provider action URL is withheld until the exact ticket bearer creates an NHS-observed handoff receipt
    - `id` string, uuid, required
    - `offer_version` integer, required
    - `provider_domain` string, required
    - `organic_position` integer, required
    - `name` string, required
    - `summary` string, required
    - `action_type` string, required
    - `disclosure` 'Provider-funded action', required
    - `organic_rank_paid` false, required
    - `principal_price` object, required
      - `mode` 'free' | 'fixed' | 'quote' | 'provider_pricing'
      - `amount_minor` integer
      - `currency` 'usd'
    - `nhs_compensation` object, required
      - `event` 'accepted' | 'activated' | 'converted', required
      - `amount_minor` integer, required
      - `currency` 'usd', required
    - `commercial_terms_contract_version` 'nhs-provider-commercial-terms-v1', required
    - `commercial_terms_sha256` string, required
    - `credit_rule` 'full_credit_on_provider_reported_invalid_or_duplicate', required
    - `response_expectation` 'provider_callback_before_attribution_expiry', required
    - `terms_period_anchor_rule` 'billing_period_begins_at_first_activation', required
    - `provider_acknowledges_merchant_of_record` true, required — Provider contractual acknowledgement; NHS does not independently verify Merchant-of-Record status
    - `prepare_action_endpoint` string, uri, required
  - `preparation_contract_version` 'nhs-action-ticket-preparation-v2', required — Explicit breaking contract revision that withholds the provider URL until separately consented handoff
  - `attribution_token` string, required — Raw bearer returned in the no-store response. The raw string is not stored in ticket or handoff rows; NHS stores its SHA-256 hash and retains nonce/key metadata plus signing material that can reconstruct an exact replay.
  - `handoff_endpoint` string, uri, required
  - `handoff_method` 'POST', required
  - `handoff_event_contract_version` 'nhs-action-handoff-v1', required
  - `handoff_consent_contract_url` string, uri, required
  - `controlled_intent_disclosure_optional` true, required — The optional separate disclosure may be declined without blocking handoff or free direct provider access
  - `controlled_intent_disclosure_consent_version` 'nhs-provider-controlled-intent-disclosure-consent-v1', required
  - `controlled_intent_disclosure_consent_url` string, uri, required
  - `created` boolean, required
  - `idempotent_replay` boolean, required
  - `attribution_token_stored_by_nhs` false, required
  - `token_reconstructed_for_exact_replay` boolean, required
  - `principal_consent_attested` true, required
  - `consent_contract_url` string, uri, required
  - `principal_charged` false, required
  - `provider_mor_contract_required` true, required
  - `principal_charged_by_nhs` false, required
  - `organic_rank_affected` false, required
  - `direct_provider_access_remains_free` true, required
  - `disclosure` string, required

## Other responses

- `201` — New ticket, raw attribution bearer, and POST handoff endpoint; no provider action URL and no charge
- `400` — Invalid JSON
- `404` — Exact public offer or returned-offer evidence unavailable; intentionally indistinguishable
- `409` — Provider claim
- `410` — Exact replay refers to an expired ticket authorization
- `429` — Temporary action-ticket safety limit exceeded
- `503` — Signed provider actions are not configured

---

[API](https://skmtc.net/nothumansearch/apis/not-human-search-api.md) · [All operations](https://skmtc.net/nothumansearch/apis/not-human-search-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/nothumansearch/not-human-search-api/revisions/a7faccfe4d5f/schema)