API RESOURCE LIFECYCLE

State transitions, cancellation and retry

Clients integrate against explicit state machines instead of guessing whether a timed-out request was processed.

Signing request state machine

created
  → awaiting_approval
  → approved
  → activated
  → signing
  → completed

Terminal/exception states:
rejected · expired · cancelled · provider_unavailable · failed

Transition rules

From	Action	To	Idempotency
created	Request approval options	awaiting_approval	Safe repeat
awaiting_approval	Verify WebAuthn approval	approved	Idempotent by assertion/challenge
approved	Activate signing authorization	activated	Idempotency key required
activated	Execute signature	signing/completed	Idempotency key required
created/awaiting_approval	Cancel	cancelled	Safe repeat
any non-terminal	Expire by policy	expired	Server controlled

Asynchronous operations

202 Accepted returns resource URI and retry-after guidance.
GET resource supports polling with bounded backoff.
Webhook events are at-least-once and must be deduplicated.
Cancellation is best-effort after protected execution begins.
Partial verification is represented explicitly, never converted to success.