United Kingdom · solution reference

UK Vendor Change & Continuous Authorization

RunOnProof answers this one bounded UK business question and returns the evidence, limits and next machine action with the answer. A successful HTTP response is not automatically permission to proceed.

SOLUTION

Canonical ID

gb.solution.vendor_change_continuous_authorization.v1 · POST /v1/gb/solutions/vendor-change-continuous-authorization · 0.20 USDC per settled delivery

Problem it solves

Authorize a scoped UK vendor payment-detail change with current company/sanctions controls and a fresh independent challenge. Use before changing the payee, then continue monitoring through separate technical controls. The authorization is expiring and single-use.

When to use

authorize a UK vendor payee change
continue monitoring an approved vendor

When not to use

automatic bank-detail updates
permanent authorization

Coverage and limitations

LIMITED. UK_COMPANIES_HOUSE, UK_SANCTIONS_LIST, INDEPENDENT_PAYEE_BINDING_EVIDENCE within Companies House registered UK entities and the exact declared caller-evidence boundary.

Authorize a scoped UK vendor payment-detail change with current company/sanctions controls and a fresh independent challenge. Use before changing the payee, then continue monitoring through separate technical controls. The authorization is expiring and single-use.
No omitted source, field or population may be inferred.
An HTTP 200 response may still require review, retry or stop.

Freshness. Read valid_as_of, valid_until, each evidence timestamp and source_health on every response. Expired or stale mandatory evidence cannot support continuation.

Source provenance

Sources: UK_COMPANIES_HOUSE UK_SANCTIONS_LIST INDEPENDENT_PAYEE_BINDING_EVIDENCE

Every source observation carries its source ID and URL, source version/timestamp, retrieval time, parser version, raw SHA-256 digest, freshness and scoped claims. Caller/provider evidence remains labelled as an attestation.

Failure and attention states

A required source that is unavailable, stale, disabled or schema-broken produces RETRY or NO_DECISION with HOLD and no settled delivery. Partial or ambiguous evidence produces REVIEW/HOLD. It never becomes a clean finding.

Decisions or lifecycle states: APPROVE CONDITIONAL REVIEW BLOCK RETRY NO_DECISION

Representative reason codes: CURRENT_EVIDENCE_WITHIN_DECLARED_COVERAGE LIMITED_COVERAGE SOURCE_UNAVAILABLE SOURCE_STALE SOURCE_SCHEMA_BREAK EVIDENCE_INSUFFICIENT

A person must review REVIEW, HOLD, RETRY, NO_DECISION, LIMITED/conditional results, every HTTP 402 quote before payment, and any consequential action required by the caller's policy. BLOCK/DENY means stop.

x402 and price

The live economic path is allowlisted at 0.20 USDC on Base. A request without Payment-Signature receives HTTP 402 with a body-bound quote. Do not sign or retry automatically; invalid input, source failure and undelivered decisions are not charged.

Input fields

change idempotency_key

Complete request example

{
  "change": {
    "company_number": "00006400",
    "current_payee_fingerprint": "sha256:1111111111111111111111111111111111111111111111111111111111111111",
    "proposed_payee_fingerprint": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
    "prior_authorization_reference": "buyer-held-prior-authorization",
    "challenge": {
      "type": "CHALLENGE",
      "verified_at": "2026-08-11T12:00:00Z",
      "valid_until": "2030-08-11T12:00:00Z",
      "reference": "buyer-held-control-example"
    },
    "idempotency_key": "bazaar_gb_solution_vendor_change_continuous_authorization_v1"
  },
  "idempotency_key": "bazaar_gb_solution_vendor_change_continuous_authorization_v1"
}

Complete response example

Illustrative contract shape.

Live evidence, health, coverage, decision, reason codes, validity and payment state prevail.

{
  "schema_version": "1.0.0",
  "product_or_solution": "gb.solution.vendor_change_continuous_authorization.v1",
  "request_id": "gbreq_documentation_example",
  "execution_id": "gbexec_documentationexample",
  "delivery_id": "gbdel_documentationexample",
  "replayed": false,
  "decision": "CONDITIONAL",
  "authorization": "ALLOW_WITH_CONDITIONS",
  "machine_action": "CONTINUE_WITH_DECLARED_CONDITIONS",
  "policy": {
    "id": "GB_VENDOR_CHANGE_V1",
    "version": "1.0.0",
    "checksum": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  },
  "reason_codes": [
    "LIMITED_COVERAGE",
    "HUMAN_CONTROL_BOUND"
  ],
  "conditions": [
    "USE_ONLY_WITHIN_DECLARED_COVERAGE"
  ],
  "required_information": [],
  "coverage": {
    "country": "GB",
    "jurisdiction": "UNITED_KINGDOM",
    "population": "COMPANIES_HOUSE_REGISTERED_ENTITIES",
    "supported": true,
    "limitations": [
      "Source-scoped UK evidence only"
    ]
  },
  "source_health": {
    "UK_COMPANIES_HOUSE": "HEALTHY",
    "UK_SANCTIONS_LIST": "HEALTHY",
    "INDEPENDENT_PAYEE_BINDING_EVIDENCE": "HEALTHY"
  },
  "evidence": [
    {
      "evidence_id": "ev_docs_1",
      "source_id": "UK_COMPANIES_HOUSE",
      "source_url": "https://find-and-update.company-information.service.gov.uk/",
      "source_version": "documentation-example-1.0.0",
      "source_timestamp": "2030-01-02T11:55:00.000Z",
      "retrieved_at": "2030-01-02T12:00:00.000Z",
      "parser_version": "documented-contract-1.0.0",
      "raw_sha256": "sha256:1111111111111111111111111111111111111111111111111111111111111111",
      "freshness": "FRESH",
      "claims": [
        "Illustrative source-scoped claim; inspect the live response"
      ]
    },
    {
      "evidence_id": "ev_docs_2",
      "source_id": "UK_SANCTIONS_LIST",
      "source_url": "https://www.gov.uk/government/publications/the-uk-sanctions-list",
      "source_version": "documentation-example-1.0.0",
      "source_timestamp": "2030-01-02T11:55:00.000Z",
      "retrieved_at": "2030-01-02T12:00:00.000Z",
      "parser_version": "documented-contract-1.0.0",
      "raw_sha256": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
      "freshness": "FRESH",
      "claims": [
        "Illustrative source-scoped claim; inspect the live response"
      ]
    },
    {
      "evidence_id": "ev_docs_3",
      "source_id": "INDEPENDENT_PAYEE_BINDING_EVIDENCE",
      "source_url": "urn:runonproof:evidence:caller-payee-binding",
      "source_version": "documentation-example-1.0.0",
      "source_timestamp": "2030-01-02T11:55:00.000Z",
      "retrieved_at": "2030-01-02T12:00:00.000Z",
      "parser_version": "documented-contract-1.0.0",
      "raw_sha256": "sha256:3333333333333333333333333333333333333333333333333333333333333333",
      "freshness": "FRESH",
      "claims": [
        "Illustrative source-scoped claim; inspect the live response"
      ]
    }
  ],
  "valid_as_of": "2030-01-02T12:00:00.000Z",
  "valid_until": "2030-01-02T13:00:00.000Z",
  "limitations": [
    "This example is illustrative; live evidence, coverage, health and reason codes prevail.",
    "Does not provide automatic bank-detail updates.",
    "Does not provide permanent authorization."
  ],
  "economic_activity": {
    "charged": true,
    "quote_created": true,
    "settlement_created": true
  },
  "payment": {
    "protocol": "x402",
    "payment_status": "SETTLED",
    "charged_price_usd": 0.2,
    "network": "eip155:8453",
    "asset": "USDC",
    "persistence_status": "PERSISTED"
  },
  "result": {
    "company_number": "00006400",
    "change_state": "AUTHORIZED",
    "proposed_payee_fingerprint": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
    "authorization_token": "gbchg_example",
    "single_use": true,
    "revocable": true
  }
}

Idempotency, replay and security

Idempotency. Use one stable body idempotency_key and the identical Idempotency-Key header. Reusing the key with a different payload or digest returns 409 and never creates a second charge.

Replay. GET /v1/gb/executions/{executionId} returns the persisted semantic delivery with zero live source calls, signing, settlement or additional charge.

Security and privacy. Send opaque payee fingerprints and non-secret evidence references only. Never send raw bank details, wallet keys, payment secrets or credentials. Evidence and responses retain only the minimum source-scoped material required for audit.

Relationship to the UK V1 core

Composes gb.vendor.payment_detail_change.authorize.v1.
A committed result may contribute scoped claims to company.capability.passport.v1.

Copyable quickstart

curl -i -sS -X POST https://api.runonproof.com/v1/gb/solutions/vendor-change-continuous-authorization \
+  -H 'Content-Type: application/json' \
+  -H 'Idempotency-Key: bazaar_gb_solution_vendor_change_continuous_authorization_v1' \
+  -H 'X-CDO-Request-Body-Digest: sha256:e4643b5c26140ad4dd025fc15d63ee8e82e58506833d49e6471b5b10acdf2591' \
+  --data '{"change":{"company_number":"00006400","current_payee_fingerprint":"sha256:1111111111111111111111111111111111111111111111111111111111111111","proposed_payee_fingerprint":"sha256:2222222222222222222222222222222222222222222222222222222222222222","prior_authorization_reference":"buyer-held-prior-authorization","challenge":{"type":"CHALLENGE","verified_at":"2026-08-11T12:00:00Z","valid_until":"2030-08-11T12:00:00Z","reference":"buyer-held-control-example"},"idempotency_key":"bazaar_gb_solution_vendor_change_continuous_authorization_v1"},"idempotency_key":"bazaar_gb_solution_vendor_change_continuous_authorization_v1"}'

OpenAPI reference → · UK country pack → · UK manifest → · Company Capability Passport →