Transition the permit state

Safety module

POST/permit-requirements/{id}/transitionspermitRequirements.transition

Moves the permit lifecycle to another state through its transition RPC, which writes the transition ledger. Uses compare-and-set on `expected_state`; a disallowed transition returns a 422 refusal. Requires `Idempotency-Key`; a replay returns the original response. A rule that refuses the request returns 422 with `refusal` and `reason`.

Requires the capability safety.permit.write.
OAuth scopes: safety.
Send an Idempotency-Key header. A replay with the same key returns the original response.
Error statuses: 400, 401, 404, 409, 422, 429. Errors are RFC 9457 problem details.

Path and query parameters

permitRequirements.transition: Path and query parameters
Field	Type	Required	Description
id	string (uuid)	Yes	Identifier of the permit requirement.

Request body: PermitTransitionRequest

permitRequirements.transition: PermitTransitionRequest
Field	Type	Required	Description
expected_state	string	Yes	The state the caller believes the row is in (compare-and-set).Constraints: pattern ^[A-Z][A-Za-z]( [A-Z][A-Za-z])*$
to_state	string	Yes	Target state.Constraints: pattern ^[A-Z][A-Za-z]( [A-Z][A-Za-z])*$
reason	string	No	Reason, required by some transitions.Constraints: length 1 to any

{
  "expected_state": "Proposed",
  "to_state": "Active",
  "reason": "Client approved the revised scope."
}

Response 200: PermitRequirement

permitRequirements.transition: PermitRequirement
Field	Type	Required	Description
id	string (uuid)	Yes	Identifier of the permit requirement.
org_id	string (uuid)	Yes	Identifier of the owning organization, derived from the parent row and never accepted from the caller.
created_at	string (date-time)	Yes	When the row was created.
created_by	string (uuid) \| null	Yes	Identifier of the person who created the row; null when a seed, platform or system process created it.
updated_at	string (date-time)	Yes	When the row was last updated.
updated_by	string (uuid) \| null	Yes	Identifier of the person who last updated the row; null when a seed, platform or system process updated it.
project_id	string (uuid)	Yes	Identifier of the project.
rule	string	Yes	Canon permit rule that triggered it.Constraints: length 1 to 300
jurisdiction_id	JurisdictionId	Yes	Jurisdiction identifier from `xpms.dim_jurisdiction`. An unpopulated jurisdiction returns no answer.Constraints: pattern ^[A-Z]{2}(-[A-Z0-9]+)*$
permit	string	Yes	Permit required.Constraints: length 1 to 300
ahj	string	Yes	Authority having jurisdiction.Constraints: length 1 to 300
permit_state	string \| null	Yes	Permit state. A Title Case value from the lifecycle's database enum.Constraints: pattern ^[A-Z0-9][A-Za-z0-9&'/.()-]( [A-Za-z0-9&'/.()-]+)$
lead_time	string	Yes	Lead time as canon states it.Constraints: length 1 to 300
trigger_type	string	Yes	What triggers the canon rule: threshold, project, element or condition.Constraints: pattern ^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$
record_id	string (uuid) \| null	Yes	Identifier of the Permit record tracking the requirement.

{
  "id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "org_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "created_at": "2026-10-08T14:30:00Z",
  "created_by": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "updated_at": "2026-10-08T14:30:00Z",
  "updated_by": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "project_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
  "rule": "Assembly occupancy",
  "jurisdiction_id": "US-FL",
  "permit": "Certificate of occupancy",
  "ahj": "City Building and Fire",
  "permit_state": "Proposed",
  "lead_time": "4-6 wks",
  "trigger_type": "project",
  "record_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f"
}

Code samples

curl -X POST "$XOS_BASE_URL/permit-requirements/0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f/transitions" \
  -H "Authorization: Bearer $XOS_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"expected_state":"Proposed","to_state":"Active","reason":"Client approved the revised scope."}'

const { data } = await xos.permitRequirements.transition("0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f", {
    "expected_state": "Proposed",
    "to_state": "Active",
    "reason": "Client approved the revised scope."
  });

response = xos.permit_requirements.transition("0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f", {"expected_state": "Proposed", "to_state": "Active", "reason": "Client approved the revised scope."})

xos permit-requirements transition 0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f --data '{"expected_state":"Proposed","to_state":"Active","reason":"Client approved the revised scope."}'