Recovery and inclusion

Recovery changes how evidence is collected. It never changes a mandatory result to pass and never approves an application.

Read the workbench

GET /v1/recovery
Authorization: Bearer <operator-session>

The response contains the route catalogue, every workflow-version policy, the request ledger and a machine-readable safety contract. Policy and request records carry a SHA-256 digest. Applicant identity fields and raw evidence are not part of policy objects.

Bind policy to a workflow version

Administrators and compliance users can enable only the routes appropriate for a released workflow:

PUT /v1/recovery/workflows/wf_individual_standard/versions/3
Authorization: Bearer <administrator-session>
Idempotency-Key: recovery-policy-wf-standard-v3-01
Content-Type: application/json

{
  "enabled": true,
  "enabledRoutes": [
    "accessible_retry",
    "low_bandwidth",
    "alternate_document",
    "camera_less",
    "attended_assistance"
  ],
  "assistedSlaHours": 4,
  "applicantMessage": "Choose another secure route. The required evidence and checks do not change."
}

Publishing a later workflow version does not mutate this record. Configure or import the policy for the new version explicitly.

Applicant request

Hosted journeys render available alternatives automatically. A custom UI calls the public session operation:

POST /public/sessions/{sessionToken}/recovery
Content-Type: application/json

{
  "route": "low_bandwidth",
  "reasonCode": "network_limit"
}

The server checks the active step, exact workflow-version policy and tenant entitlement. Exact active retries return the existing request. A self-serve route keeps the current step open. Camera-less and attended routes set the application to review, open a recovery case and emit application.recovery_requested.

attended_assistance may return handoffUrl. Open it immediately; it is an invitation-scoped, consent-led reviewer session.

Route semantics

Route	Effect	Assurance behavior
accessible_retry	Simplified/manual capture controls	Same server checks and thresholds
low_bandwidth	Smaller encrypted uploads	Same server checks and thresholds
alternate_document	Another document selection	Document verification remains mandatory
camera_less	Alternative-evidence case	Enters review; no pass is created
attended_assistance	Trained-reviewer handoff	Enters review; attended evidence is evaluated separately

Close an operational request

Closing recovery work records disposition only. It does not decide the application:

POST /v1/recovery/requests/rec_123/close
Authorization: Bearer <operator-session>
Idempotency-Key: close-recovery-rec-123-01
Content-Type: application/json

{
  "status": "completed",
  "note": "Alternative evidence was handed to the linked compliance case."
}

Use the normal case and decision ledgers for any subsequent applicant decision.