Release an **external** gate by presenting its token (ADR-0034) — the path an outside system (a deploy webhook, a change-management tool) uses instead of an interactive approval. The token is `HMAC-SHA256(secret, "{run}:{step}")` (`sha256=<hex>`), verified in constant time; no per-gate storage. The endpoint is 404 when no token secret is configured, and only releases gates of kind `external` (manual gates stay approval-only).
POST
/v1/runs/{id}/gates/{step}/release
const url = 'https://example.com/v1/runs/example/gates/example/release';const options = {method: 'POST'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://example.com/v1/runs/example/gates/example/releaseParameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”id
required
string
Run id
step
required
string
Gate step id
Responses
Section titled “Responses”Gate released
Bad or missing token
No such external gate, or token release disabled