Stream a provider's logo from platform object storage.
Looks up the live provider_brand_assets row for the provider id, streams its bytes from object storage with the stored content type, a stable ETag and long public cache headers. Unknown provider ids return 404 without touching storage.
curl -X GET 'https://app.rensei.ai/api/brand-assets/providers/string'"string"Apply one approve / reject decision to many approval gates.
Applies one decision to many gates, each decided independently with the same records as POST /api/approval-gates/{id}/decide, with a per-gate result. The decision actor identity and role are derived from the authenticated context, never trusted from the request body (SR 11-7). A gate the caller may not act on (ineligible role, terminal state, outside the org) refuses in its result slot without failing the other gates; already-resolved gates refuse 409. A failed workflow resume rides on that gate's ok slot as resumeError without un-recording the committed decision.
Re-converge a daemon projection with committed host authority.
The caller projection identifies the current authority; its quarantinedSessions field is discarded, and stored platform quarantine authority is retained unless matching terminal proof permits removal.