POST /admin/migrations/:id/items/:itemId/reject
Reject a migration item. The item’s encrypted value is immediately zeroed. Auth:migration_reviewer permission + a recent step-up verification (5-minute window)
Class B reveal (since 2026-10-05). This action also passes the reveal chokepoint: the caller’s own membership must be Owner or Admin (an Admin also needs the Owner-granted migration_reviewer delegation, checked first), the ONE secret.migration verification is consumed by the chokepoint itself (one verification per action), the per-person reveal budget is charged (60 per 5 minutes: 429 reveal_budget_exceeded, or 503 reveal_budget_unavailable when it cannot be counted), and a plaintext.reveal audit entry is written before anything is decrypted or changed (503 reveal_audit_unavailable if it cannot be). A missing verification answers 403 with "code": "reveal_step_up_required", "requires_step_up": true, "action_scope": "secret.migration" and "allowed_methods": ["passkey", "2fa"].
Step-up is enforced server-side: the request carries no step-up token or header. The signed-in user must have completed a second-factor step-up within the last 5 minutes, passing "action_scope": "secret.migration" in the body: an authenticator-app code via POST /auth/2fa/verify-step-up, a passkey via POST /auth/passkey/verify-step-up, or a security key (or passkey) via POST /auth/2fa/webauthn/step-up-options then POST /auth/2fa/webauthn/verify-step-up. An emailed code does not satisfy this gate. If no recent verification exists, this endpoint returns 403 { "error": "Recent step-up verification required for this action", "requires_step_up": true, "max_age_minutes": 5, "action_scope": "secret.migration", "allowed_methods": ["passkey", "2fa"] }.
Request body
Response
409 if the item is not in pending_review status.