Skip to main content
Reissue requires applications:handoff:reissue and fresh current authorization. It can replace active, expired or explicitly revoked access on an eligible unsigned, unfrozen Application. It creates a fresh 30-day grant on the same Application and authoritative session; it does not revive the old URL or cookie. Answers, protected records, pricing and documents remain intact.

​
Prepare a deliberate replacement

First recover the current handoff. Use its handoff.id as expectedHandoffId. Generate and persist a new UUID v4 for this reissue operation, then save the original body. The identifiers below are illustrative; replace both before the first attempt and keep them unchanged for retries. Save as reissue.json:
This example passed the identified Sandbox run. Successful responses use disposition: reissued or recovered. Deliver only the current usable URL through your approved merchant flow. Predecessor links, cookies and delayed writes lose authority after replacement.

​
Retry and eligibility boundaries

After response loss or 503 operation_unconfirmed, back off and retry the same operation ID and original body. Receipt identity includes environment, tenant, stable caller, Application, operation and request ID. Changing the expected predecessor under the same identity returns request_conflict. Competing new operations on one predecessor return handoff_changed to the loser; reconcile current state before deciding whether another deliberate replacement is needed. Same-operation recovery returns the current handoff projection without renewing expiry, including after later reissue or signing. Ordinary create retries and GETs also never renew access. Reissue denies archive, linked Merchant, ambiguous session authority, building or active signing input, and accepted signing. Only canonical machine-created draft/in_progress Applications qualify. signing_input_locked, already_signed or reissue_ineligible must not trigger an automatic new ceremony. Failed artifact finalization is not permission to reopen signed input. Reissue bodies are limited to 1,024 UTF-8 bytes with an 8-second body-read deadline. There is a separate limit of 30 attempts per stable caller per 60-second window.