# attest

URL: /business/nouns/action/attest · Id: `verb:Action.attest` · Call: `await $.Action.attest({ … })` (SDK) or the `do` tool at `https://api.sb/mcp`. Inputs says what to pass, Outputs what returns, When it waits who approves.

> Attest records a credentialed Human’s signed performance of a Reserved Act that an Action needs to finish.

Attest records a credentialed [Human](/business/nouns/human)’s signed performance of a [Reserved Act](/business/nouns/reserved-act) that an [Action](/business/nouns/action) needs to finish.

## Inputs
| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `action` | [Action](/business/nouns/action) | Yes | The Action that waits on the Reserved Act. |
| `credential` | [Credential](/business/nouns/credential) | Yes | The Credential that authorizes it. |

## Outputs
| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `action` | [Action](/business/nouns/action) | Yes | The Action, free to finish. |

## Effects
- Emits [`Action.attested`](/business/events/Action.attested).
- Performed by the [Legal Lead](/agents/legal/legal-lead).
- Records who signed, under which Credential, and when.

## Refuses when
| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The input does not match the schema of the operation. | [`invalid-input`](/code/api/errors/invalid-input) | Read the schema of the operation, then send every required field with the right type. | [Action.attest](/business/nouns/action/attest) |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | [Action.attest](/business/nouns/action/attest) |

## When it waits
| Gate | Default |
| --- | --- |
| Decision class | Low: two-way, nothing at stake |
| [Delay window](/systems/trust-and-governance/controls/one-way-windows) | None: it runs once review passes. |
| Limit | The call [Limit](/business/nouns/limit) of the [Permission](/business/nouns/permission) it runs under. |
| Over the Limit | It waits `pending` for an [Approval](/business/nouns/approval) from the [Founder](/agents/founding/founder). Approved, it runs; refused, it ends `refused` with [`limit-exceeded`](/code/api/errors/limit-exceeded); unanswered by its deadline, it ends `canceled`. |

## Example

**Ask**

```text
Attest the latest action with a credential.
```

**API**

```bash
curl -X POST https://api.sb/shiftnote.app/actions/action_1/attest \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"credential":"credential_1"}'
```

```json
{
  "api": "https://api.sb/shiftnote.app",
  "action": {
    "$id": "https://api.sb/shiftnote.app/actions/action_1",
    "$type": "Action",
    "status": "done",
    "mode": "try",
    "operation": "Action.attest"
  },
  "links": {
    "self": "https://api.sb/shiftnote.app/actions/action_1"
  }
}
```

**SDK**

```ts
import { $ } from 'startup-builder'

const action = await $.Action.attest({ action: 'action_1', credential: 'credential_1' })
```

**CLI**

```bash
npx startup-builder do Action.attest --json '{"action":"action_1","credential":"credential_1"}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "return await $.Action.attest({ action: 'action_1', credential: 'credential_1' })"
  }
}
```