Skip to main content
FetchSandboxInconclusive
Outcome

Workflow verification incomplete

This receipt shows the requests we made, what the app reported back, and which checks passed or failed. It covers what ran in this sandbox session against the rules we set.

20 / 22

Inconclusive

20Passed0Failed2Not measured
What we did

Each check was set up before the run. This shows what we tried, what came back, and which rule it was checked against.

Scope

This receipt covers the checks in this run only. Passing all checks does not certify the whole app as production-ready.

Test scenarios

01

A high-risk takeover holds the account's refunds and removes its admin seat in an organization that keeps another admin; the record and alert go out

baseline
Passed

What we probed

A high-risk takeover holds the account's refunds and removes its admin seat in an organization that keeps another admin; the record and alert go out

How we probed it

Frozen intended probe steps. Recorded requests show what actually ran.

  1. POST /invocations

Expected vs actual

Expected
A high-risk takeover holds the account's refunds and removes its admin seat in an organization that keeps another admin; the record and alert go out
Actual
expected exactly 1, found 1; stable under 2 repeats (1)

Requests and responses

01GET /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/baseline/runs200
We sent

GET /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/baseline/runs

This request had no body.

Server returned

HTTP 200

{
  "runs": []
}

HTTP status is a response, not the scenario verdict. State shown here is reported by the app.

Technical details
Headers and timing

https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/baseline/runs

{
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}
{
  "content-type": "application/json",
  "content-length": "11"
}
Rebuilt curl
curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/baseline/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

02POST /invocations200
We sent

POST /invocations

{
  "action": "start",
  "runId": "baseline-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-baseline",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "baseline"
  }
}
Server returned

HTTP 200

{
  "runId": "baseline-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "baseline"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "2 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 785
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 307
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 1
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_0221QSEOSMCHWTVT",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_0221QSEOSMCHWTVT",
        "alert": "SEC-baseline"
      },
      "attempts": 1,
      "ref": "cus_0221QSEOSMCHWTVT",
      "appliedAt": "2026-10-22T01:44:27.235Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "3a8914b461",
        "organization": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
      "detail": {
        "organizationId": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:27.615Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-baseline",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "94f554ee-86c5-4e87-b877-86a6f8cbd8b7",
      "appliedAt": "2026-10-22T01:44:27.780Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17UL1L369A.MY9D4Y",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:27.913Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:26.311Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:27.097Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:27.100Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:27.236Z",
      "msg": "stripe.hold_customer:cus_0221QSEOSMCHWTVT: applied"
    },
    {
      "at": "2026-10-22T01:44:27.616Z",
      "msg": "workos.remove_membership:om_O563T9H0D3ZI3E1M7WCQ7PTWGT: applied"
    },
    {
      "at": "2026-10-22T01:44:27.780Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:27.913Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:27.914Z",
      "msg": "done (ok)"
    }
  ],
  "createdAt": "2026-10-22T01:44:26.311Z",
  "updatedAt": "2026-10-22T01:44:27.914Z",
  "duplicate": false
}

HTTP status is a response, not the scenario verdict. State shown here is reported by the app.

Technical details
Headers and timing

https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations

{
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "405",
  "content-type": "application/json"
}
{
  "content-type": "application/json"
}
Rebuilt curl
curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "baseline-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-baseline",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "baseline"
  }
}'

This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

03GET /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/baseline/runs200
We sent

GET /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/baseline/runs

This request had no body.

Server returned

HTTP 200

{
  "runs": [
    {
      "runId": "baseline-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "baseline"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "2 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 785
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 307
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 1
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_0221QSEOSMCHWTVT",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_0221QSEOSMCHWTVT",
            "alert": "SEC-baseline"
          },
          "attempts": 1,
          "ref": "cus_0221QSEOSMCHWTVT",
          "appliedAt": "2026-10-22T01:44:27.235Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "3a8914b461",
            "organization": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
          "detail": {
            "organizationId": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:27.615Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-baseline",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "94f554ee-86c5-4e87-b877-86a6f8cbd8b7",
          "appliedAt": "2026-10-22T01:44:27.780Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17UL1L369A.MY9D4Y",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:27.913Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:26.311Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:27.097Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:27.100Z",
          "msg": "planned 4 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:44:27.236Z",
          "msg": "stripe.hold_customer:cus_0221QSEOSMCHWTVT: applied"
        },
        {
          "at": "2026-10-22T01:44:27.616Z",
          "msg": "workos.remove_membership:om_O563T9H0D3ZI3E1M7WCQ7PTWGT: applied"
        },
        {
          "at": "2026-10-22T01:44:27.780Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:27.913Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:27.914Z",
          "msg": "done (ok)"
        }
      ],
      "createdAt": "2026-10-22T01:44:26.311Z",
      "updatedAt": "2026-10-22T01:44:27.914Z"
    }
  ]
}

HTTP status is a response, not the scenario verdict. State shown here is reported by the app.

Technical details
Headers and timing

https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/baseline/runs

{
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}
{
  "content-type": "application/json"
}
Rebuilt curl
curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/baseline/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

04POST /invocations200
We sent

POST /invocations

{
  "action": "start",
  "runId": "baseline-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-baseline",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "baseline"
  }
}
Server returned

HTTP 200

{
  "runId": "baseline-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "baseline"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "2 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 785
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 307
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 1
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_0221QSEOSMCHWTVT",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_0221QSEOSMCHWTVT",
        "alert": "SEC-baseline"
      },
      "attempts": 1,
      "ref": "cus_0221QSEOSMCHWTVT",
      "appliedAt": "2026-10-22T01:44:27.235Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "3a8914b461",
        "organization": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
      "detail": {
        "organizationId": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:27.615Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-baseline",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "94f554ee-86c5-4e87-b877-86a6f8cbd8b7",
      "appliedAt": "2026-10-22T01:44:27.780Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17UL1L369A.MY9D4Y",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:27.913Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:26.311Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:27.097Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:27.100Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:27.236Z",
      "msg": "stripe.hold_customer:cus_0221QSEOSMCHWTVT: applied"
    },
    {
      "at": "2026-10-22T01:44:27.616Z",
      "msg": "workos.remove_membership:om_O563T9H0D3ZI3E1M7WCQ7PTWGT: applied"
    },
    {
      "at": "2026-10-22T01:44:27.780Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:27.913Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:27.914Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:44:28.439Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:26.311Z",
  "updatedAt": "2026-10-22T01:44:28.439Z",
  "duplicate": true
}

HTTP status is a response, not the scenario verdict. State shown here is reported by the app.

Technical details
Headers and timing

https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations

{
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "405",
  "content-type": "application/json"
}
{
  "content-type": "application/json"
}
Rebuilt curl
curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "baseline-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-baseline",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "baseline"
  }
}'

This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

05GET /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/baseline/runs200
We sent

GET /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/baseline/runs

This request had no body.

Server returned

HTTP 200

{
  "runs": [
    {
      "runId": "baseline-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "baseline"
      },
      "duplicateStarts": 1,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "2 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 785
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 307
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 1
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_0221QSEOSMCHWTVT",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_0221QSEOSMCHWTVT",
            "alert": "SEC-baseline"
          },
          "attempts": 1,
          "ref": "cus_0221QSEOSMCHWTVT",
          "appliedAt": "2026-10-22T01:44:27.235Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "3a8914b461",
            "organization": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
          "detail": {
            "organizationId": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:27.615Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-baseline",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "94f554ee-86c5-4e87-b877-86a6f8cbd8b7",
          "appliedAt": "2026-10-22T01:44:27.780Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17UL1L369A.MY9D4Y",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:27.913Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:26.311Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:27.097Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:27.100Z",
          "msg": "planned 4 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:44:27.236Z",
          "msg": "stripe.hold_customer:cus_0221QSEOSMCHWTVT: applied"
        },
        {
          "at": "2026-10-22T01:44:27.616Z",
          "msg": "workos.remove_membership:om_O563T9H0D3ZI3E1M7WCQ7PTWGT: applied"
        },
        {
          "at": "2026-10-22T01:44:27.780Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:27.913Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:27.914Z",
          "msg": "done (ok)"
        },
        {
          "at": "2026-10-22T01:44:28.439Z",
          "msg": "duplicate start ignored"
        }
      ],
      "createdAt": "2026-10-22T01:44:26.311Z",
      "updatedAt": "2026-10-22T01:44:28.439Z"
    }
  ]
}

HTTP status is a response, not the scenario verdict. State shown here is reported by the app.

Technical details
Headers and timing

https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/baseline/runs

{
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}
{
  "content-type": "application/json"
}
Rebuilt curl
curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/baseline/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

Evidence
Run
vr_2e81298bdd5645a38f14efcf2db1dcf0
App version (declared)
acme-ops-account-takeover-co…
Source receipt
Source receipt ↗
Technical referencebaseline

App version (declared): acme-ops-account-takeover-containment-1.0.0-40b5cbb

A high-risk takeover holds the account's refunds and removes its admin seat in an organization that keeps another admin; the record and alert go out

expected exactly 1, found 1; stable under 2 repeats (1)

  • Verification covers the declared HTTP actions and state reads in this run.
  • The app version shown was supplied by the app itself, not independently checked.
  • Passing all checks in this run does not certify the whole app as production-ready.
  • The verifier session does not survive a restart. This says nothing about the durability of the app under test.
  • App state shown here is what the app's own endpoint reported. It is not independently checked against the database.
Provider traffic in the same time window (12)

These calls were recorded during the same request window as this check but are not directly linked to it. Timing alone is not proof that they caused or were caused by this check.

stripe · GET /v1/customers · HTTP 200
We sent

GET /v1/customers

No body shown for this read.

Server returned

HTTP 200

{
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_0221QSEOSMCHWTVT",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 60,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}

HTTP status is a response, not the scenario verdict. State shown here is reported by the app.

Technical details
Headers and timing

https://fetchsandbox.com/sandbox/25a585649b/v1/customers

{
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

Response headers were not saved in this run.

Rebuilt curl
curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

workos · GET /user_management/users · HTTP 200
We sent

GET /user_management/users

No body shown for this read.

Server returned

HTTP 200

{
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "61452c65-1a8d-47d0-97d6-a51ddb5ef512",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/1ab2f5b2",
      "email_verified": true,
      "external_id": "ext_b2ba9c3da11d4a1b9e842317a8",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}

HTTP status is a response, not the scenario verdict. State shown here is reported by the app.

Technical details
Headers and timing

https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users

{
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

Response headers were not saved in this run.

Rebuilt curl
curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

stripe · GET /v1/payment_intents · HTTP 200
We sent

GET /v1/payment_intents

No body shown for this read.

Server returned

HTTP 200

{
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}

HTTP status is a response, not the scenario verdict. State shown here is reported by the app.

Technical details
Headers and timing

https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents

{
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

Response headers were not saved in this run.

Rebuilt curl
curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

workos · GET /user_management/organization_memberships · HTTP 200
We sent

GET /user_management/organization_memberships

No body shown for this read.

Server returned

HTTP 200

{
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "61452c65-1a8d-47d0-97d6-a51ddb5ef512",
      "organization_id": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT"
    },
    {
      "object": "organization_membership",
      "user_id": "61452c65-1a8d-47d0-97d6-a51ddb5ef512",
      "organization_id": "73baadd9-64a0-4d68-b4de-0acc57066ee1",
      "status": "active",
      "role": {
        "slug": "member"
      },
      "roles": [
        {
          "slug": "member"
        }
      ],
      "id": "om_6MOVJPWLGG82NA33W073UJ4QG3"
    }
  ],
  "list_metadata": {
    "before": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
    "after": null
  }
}

HTTP status is a response, not the scenario verdict. State shown here is reported by the app.

Technical details
Headers and timing

https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships

{
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

Response headers were not saved in this run.

Rebuilt curl
curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

workos · GET /user_management/organization_memberships · HTTP 200
We sent

GET /user_management/organization_memberships

No body shown for this read.

Server returned

HTTP 200

{
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "61452c65-1a8d-47d0-97d6-a51ddb5ef512",
      "organization_id": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT"
    },
    {
      "object": "organization_membership",
      "user_id": "ae717352-4a34-4e34-8640-9f334788687d",
      "organization_id": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_BI9CAZ9ES6XQJ1EDJFXR1I37ZU"
    }
  ],
  "list_metadata": {
    "before": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
    "after": null
  }
}

HTTP status is a response, not the scenario verdict. State shown here is reported by the app.

Technical details
Headers and timing

https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships

{
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

Response headers were not saved in this run.

Rebuilt curl
curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

workos · GET /user_management/users/61452c65-1a8d-47d0-97d6-a51ddb5ef512/sessions · HTTP 200
We sent

GET /user_management/users/61452c65-1a8d-47d0-97d6-a51ddb5ef512/sessions

No body shown for this read.

Server returned

HTTP 200

{
  "items": [
    {
      "session_id": "[redacted]",
      "name": "Sample Session 1",
      "id": "65028467-bd15-479d-b741-4630a662fd42"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 2",
      "id": "b0b28c4e-bdc3-4ed9-9483-fdd724aeb3ef"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 3",
      "id": "ab7c709c-c32d-4aa0-911b-52c680ee248f"
    }
  ]
}

HTTP status is a response, not the scenario verdict. State shown here is reported by the app.

Technical details
Headers and timing

https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/61452c65-1a8d-47d0-97d6-a51ddb5ef512/sessions

{
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

Response headers were not saved in this run.

Rebuilt curl
curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/61452c65-1a8d-47d0-97d6-a51ddb5ef512/sessions' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

stripe · POST /v1/customers/cus_0221QSEOSMCHWTVT · HTTP 200
We sent

POST /v1/customers/cus_0221QSEOSMCHWTVT

{
  "metadata": {
    "acme_ato_hold": "SEC-baseline",
    "acme_ato_hold_at": "2026-10-22T01:44:26.311Z"
  }
}
Server returned

HTTP 200

{
  "email": "[email protected]",
  "name": "Robin Customer",
  "id": "cus_0221QSEOSMCHWTVT",
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 60,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "SEC-baseline",
    "acme_ato_hold_at": "2026-10-22T01:44:26.311Z"
  }
}

HTTP status is a response, not the scenario verdict. State shown here is reported by the app.

Technical details
Headers and timing

https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_0221QSEOSMCHWTVT

{
  "host": "fetchsandbox.com",
  "content-length": "100",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/x-www-form-urlencoded"
}

Response headers were not saved in this run.

Rebuilt curl
curl --request POST 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_0221QSEOSMCHWTVT' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-raw '{
  "metadata": {
    "acme_ato_hold": "SEC-baseline",
    "acme_ato_hold_at": "2026-10-22T01:44:26.311Z"
  }
}'

This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

workos · GET /user_management/organization_memberships · HTTP 200
We sent

GET /user_management/organization_memberships

No body shown for this read.

Server returned

HTTP 200

{
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "61452c65-1a8d-47d0-97d6-a51ddb5ef512",
      "organization_id": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT"
    },
    {
      "object": "organization_membership",
      "user_id": "61452c65-1a8d-47d0-97d6-a51ddb5ef512",
      "organization_id": "73baadd9-64a0-4d68-b4de-0acc57066ee1",
      "status": "active",
      "role": {
        "slug": "member"
      },
      "roles": [
        {
          "slug": "member"
        }
      ],
      "id": "om_6MOVJPWLGG82NA33W073UJ4QG3"
    }
  ],
  "list_metadata": {
    "before": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
    "after": null
  }
}

HTTP status is a response, not the scenario verdict. State shown here is reported by the app.

Technical details
Headers and timing

https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships

{
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

Response headers were not saved in this run.

Rebuilt curl
curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

workos · GET /user_management/organization_memberships · HTTP 200
We sent

GET /user_management/organization_memberships

No body shown for this read.

Server returned

HTTP 200

{
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "61452c65-1a8d-47d0-97d6-a51ddb5ef512",
      "organization_id": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT"
    },
    {
      "object": "organization_membership",
      "user_id": "ae717352-4a34-4e34-8640-9f334788687d",
      "organization_id": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_BI9CAZ9ES6XQJ1EDJFXR1I37ZU"
    }
  ],
  "list_metadata": {
    "before": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
    "after": null
  }
}

HTTP status is a response, not the scenario verdict. State shown here is reported by the app.

Technical details
Headers and timing

https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships

{
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

Response headers were not saved in this run.

Rebuilt curl
curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

workos · DELETE /user_management/organization_memberships/om_O563T9H0D3ZI3E1M7WCQ7PTWGT · HTTP 204
We sent

DELETE /user_management/organization_memberships/om_O563T9H0D3ZI3E1M7WCQ7PTWGT

No body was saved. This receipt cannot tell whether it was empty or not captured.

Server returned

HTTP 204

Response body was not recorded.

HTTP status is a response, not the scenario verdict. State shown here is reported by the app.

Technical details
Headers and timing

https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships/om_O563T9H0D3ZI3E1M7WCQ7PTWGT

{
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

Response headers were not saved in this run.

Rebuilt curl
curl --request DELETE 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships/om_O563T9H0D3ZI3E1M7WCQ7PTWGT' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

asana · POST /tasks · HTTP 201
We sent

POST /tasks

{
  "data": {
    "name": "SEC-baseline: account takeover contain (contain)",
    "notes": "Alert SEC-baseline for user 3a8914b461 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_0221QSEOSMCHWTVT.\nPrivileged memberships removed (restore input):\n- 100bd8fa-90ba-413c-8dcf-325c92b48e42 admin (om_O563T9H0D3ZI3E1M7WCQ7PTWGT) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-baseline\",\"memberships\":[{\"organizationId\":\"100bd8fa-90ba-413c-8dcf-325c92b48e42\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}
Server returned

HTTP 201

{
  "data": {
    "name": "SEC-baseline: account takeover contain (contain)",
    "notes": "Alert SEC-baseline for user 3a8914b461 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_0221QSEOSMCHWTVT.\nPrivileged memberships removed (restore input):\n- 100bd8fa-90ba-413c-8dcf-325c92b48e42 admin (om_O563T9H0D3ZI3E1M7WCQ7PTWGT) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-baseline\",\"memberships\":[{\"organizationId\":\"100bd8fa-90ba-413c-8dcf-325c92b48e42\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  },
  "id": "94f554ee-86c5-4e87-b877-86a6f8cbd8b7"
}

HTTP status is a response, not the scenario verdict. State shown here is reported by the app.

Technical details
Headers and timing

https://fetchsandbox.com/sandbox/b4506e3288/tasks

{
  "host": "fetchsandbox.com",
  "content-length": "645",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

Response headers were not saved in this run.

Rebuilt curl
curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-baseline: account takeover contain (contain)",
    "notes": "Alert SEC-baseline for user 3a8914b461 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_0221QSEOSMCHWTVT.\nPrivileged memberships removed (restore input):\n- 100bd8fa-90ba-413c-8dcf-325c92b48e42 admin (om_O563T9H0D3ZI3E1M7WCQ7PTWGT) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-baseline\",\"memberships\":[{\"organizationId\":\"100bd8fa-90ba-413c-8dcf-325c92b48e42\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}'

This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

slack · POST /api/chat.postMessage · HTTP 200
We sent

POST /api/chat.postMessage

{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-baseline (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}
Server returned

HTTP 200

{
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_b937db5defe8489c92f8645a37",
    "client_msg_id": "cli_13c1ae5aa829498cb76cc95a83",
    "name": "item-ecb96f",
    "old_name": "Sample Old",
    "parent_user_id": "par_15dfc3577af84d7fbcced1e9e7",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "17UL1L369A.MY9D4Y"
}

HTTP status is a response, not the scenario verdict. State shown here is reported by the app.

Technical details
Headers and timing

https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage

{
  "host": "fetchsandbox.com",
  "content-length": "180",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

Response headers were not saved in this run.

Rebuilt curl
curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-baseline (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}'

This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

Run details

Run vr_2e81298bdd5645a38f14efcf2db1dcf0

22 required checks for the declared application workflow. Results apply to the recorded observation windows.

20 passed · 0 failed · 2 not checked

Coverage beyond the declared checks

Passing these checks does not establish every production behavior.

  • Normal successful behavior · Linked checks passed · baseline
  • The right user gets the right access · Linked checks passed · last_admin_parked, approve_by_stranger_refused, unknown_account_nothing
  • Valid data and boundary values · Linked checks passed · invalid_input_rejected, low_risk_monitors
  • Correct amount, currency and quantity · Linked checks passed · refund_spike_escalates
  • Duplicate requests and events · Linked checks passed · duplicate_start, rerun_finds_contained
  • Requests arriving together · Not checked · concurrent_start, co_admin_left_before_removal
  • Out-of-order and stale events · Not checked · restore_leaves_other_hold, co_admin_left_before_removal
  • Delayed or missing events · Proposed as not applicable
  • Provider authentication and permissions · Linked checks passed · workos_auth_failure
  • Rate limits, server failures and timeouts · Linked checks passed · stripe_rate_limited, slack_rate_limited
  • Completed action with a lost response · Proposed as not applicable
  • Partial completion and recovery · Linked checks passed · stripe_rate_limited, slack_rate_limited, restore_with_approval
  • Restart without losing or duplicating work · Linked checks passed · restart_while_parked
  • Finding and repairing inconsistent state · Linked checks passed · reconcile_reads_back
  • Cancellation, refunds and access · Not checked · last_admin_approved, last_admin_rejected, medium_risk_asks_first, sessions_revoked
  • Data ownership and privacy · Proposed as not applicable
  • Test isolation and cleanup · Linked checks passed · baseline, concurrent_start

Applicability comes from the proposed plan. Test results come from the recorded execution.

App version: acme-ops-account-takeover-containment-1.0.0-40b5cbb (declared)

Measured run: 2026-10-22T01:44:26.000033+00:00 – 2026-10-22T01:46:06.474682+00:00

Recorded execution

Recorded application requests and state reads for the declared HTTP contract.

The timeline below merges all requests from this run, sorted by recorded timestamp.

Recorded requests and deliveries: 399/437 successful · checkpoints: 20/22 recorded

Why checks are unmeasured

  • sessions_revoked: The WorkOS twin's GET /user_management/users/{id}/sessions returns sample sessions under `items` (not the API's `data`), and POST /user_management/sessions/revoke echoes any id, so revocation can't be observed. The runtime lists and revokes real sessions; covered by local tests.
  • co_admin_left_before_removal: The verifier can't place a provider write between the runtime's directory read and its removal inside one run. The write-time re-check is covered by a deterministic local test.
Sanitized request and event timeline (417 events)
  1. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/baseline/runs · baseline · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/baseline/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:26.241796+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  2. · POST app request /invocations · baseline · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "baseline-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-baseline",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "baseline"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:28.076594+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "405",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "baseline-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-baseline",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "baseline"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "baseline-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "baseline"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "2 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 785
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 307
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 1
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_0221QSEOSMCHWTVT",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_0221QSEOSMCHWTVT",
        "alert": "SEC-baseline"
      },
      "attempts": 1,
      "ref": "cus_0221QSEOSMCHWTVT",
      "appliedAt": "2026-10-22T01:44:27.235Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "3a8914b461",
        "organization": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
      "detail": {
        "organizationId": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:27.615Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-baseline",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "94f554ee-86c5-4e87-b877-86a6f8cbd8b7",
      "appliedAt": "2026-10-22T01:44:27.780Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17UL1L369A.MY9D4Y",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:27.913Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:26.311Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:27.097Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:27.100Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:27.236Z",
      "msg": "stripe.hold_customer:cus_0221QSEOSMCHWTVT: applied"
    },
    {
      "at": "2026-10-22T01:44:27.616Z",
      "msg": "workos.remove_membership:om_O563T9H0D3ZI3E1M7WCQ7PTWGT: applied"
    },
    {
      "at": "2026-10-22T01:44:27.780Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:27.913Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:27.914Z",
      "msg": "done (ok)"
    }
  ],
  "createdAt": "2026-10-22T01:44:26.311Z",
  "updatedAt": "2026-10-22T01:44:27.914Z",
  "duplicate": false
}
  3. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request bb43ee3b20c9 · processing 15.25ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 15.25ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_0221QSEOSMCHWTVT",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 60,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  4. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request bcccc2e9aee7 · processing 1.71ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.71ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "61452c65-1a8d-47d0-97d6-a51ddb5ef512",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/1ab2f5b2",
      "email_verified": true,
      "external_id": "ext_b2ba9c3da11d4a1b9e842317a8",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  5. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request c478dd449e23 · processing 6ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 6ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  6. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request e8a08ef3a872 · processing 0.62ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.62ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "61452c65-1a8d-47d0-97d6-a51ddb5ef512",
      "organization_id": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT"
    },
    {
      "object": "organization_membership",
      "user_id": "61452c65-1a8d-47d0-97d6-a51ddb5ef512",
      "organization_id": "73baadd9-64a0-4d68-b4de-0acc57066ee1",
      "status": "active",
      "role": {
        "slug": "member"
      },
      "roles": [
        {
          "slug": "member"
        }
      ],
      "id": "om_6MOVJPWLGG82NA33W073UJ4QG3"
    }
  ],
  "list_metadata": {
    "before": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
    "after": null
  }
}
  7. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 46386deb79c9 · processing 0.57ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.57ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "61452c65-1a8d-47d0-97d6-a51ddb5ef512",
      "organization_id": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT"
    },
    {
      "object": "organization_membership",
      "user_id": "ae717352-4a34-4e34-8640-9f334788687d",
      "organization_id": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_BI9CAZ9ES6XQJ1EDJFXR1I37ZU"
    }
  ],
  "list_metadata": {
    "before": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
    "after": null
  }
}
  8. · GET workos request · provider traffic · /user_management/users/61452c65-1a8d-47d0-97d6-a51ddb5ef512/sessions · HTTP 200 · request 987ffc3a731f · processing 1.51ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/61452c65-1a8d-47d0-97d6-a51ddb5ef512/sessions' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.51ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "items": [
    {
      "session_id": "[redacted]",
      "name": "Sample Session 1",
      "id": "65028467-bd15-479d-b741-4630a662fd42"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 2",
      "id": "b0b28c4e-bdc3-4ed9-9483-fdd724aeb3ef"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 3",
      "id": "ab7c709c-c32d-4aa0-911b-52c680ee248f"
    }
  ]
}
  9. · POST stripe request · provider traffic · /v1/customers/cus_0221QSEOSMCHWTVT · HTTP 200 · request eacbc6e3064f · processing 13.31ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_0221QSEOSMCHWTVT' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-raw '{
  "metadata": {
    "acme_ato_hold": "SEC-baseline",
    "acme_ato_hold_at": "2026-10-22T01:44:26.311Z"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 13.31ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "100",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/x-www-form-urlencoded"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "metadata": {
    "acme_ato_hold": "SEC-baseline",
    "acme_ato_hold_at": "2026-10-22T01:44:26.311Z"
  }
}

    Recorded response · HTTP 200

    {
  "email": "[email protected]",
  "name": "Robin Customer",
  "id": "cus_0221QSEOSMCHWTVT",
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 60,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "SEC-baseline",
    "acme_ato_hold_at": "2026-10-22T01:44:26.311Z"
  }
}
  10. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request a098dc454504 · processing 0.56ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.56ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "61452c65-1a8d-47d0-97d6-a51ddb5ef512",
      "organization_id": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT"
    },
    {
      "object": "organization_membership",
      "user_id": "61452c65-1a8d-47d0-97d6-a51ddb5ef512",
      "organization_id": "73baadd9-64a0-4d68-b4de-0acc57066ee1",
      "status": "active",
      "role": {
        "slug": "member"
      },
      "roles": [
        {
          "slug": "member"
        }
      ],
      "id": "om_6MOVJPWLGG82NA33W073UJ4QG3"
    }
  ],
  "list_metadata": {
    "before": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
    "after": null
  }
}
  11. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request b43b17aecba2 · processing 0.57ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.57ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "61452c65-1a8d-47d0-97d6-a51ddb5ef512",
      "organization_id": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT"
    },
    {
      "object": "organization_membership",
      "user_id": "ae717352-4a34-4e34-8640-9f334788687d",
      "organization_id": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_BI9CAZ9ES6XQJ1EDJFXR1I37ZU"
    }
  ],
  "list_metadata": {
    "before": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
    "after": null
  }
}
  12. · DELETE workos request · provider traffic · /user_management/organization_memberships/om_O563T9H0D3ZI3E1M7WCQ7PTWGT · HTTP 204 · request 71f27385f90b · processing 0.91ms
  13. · POST asana request · provider traffic · /tasks · HTTP 201 · request 9956caa9d31f · processing 13.21ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-baseline: account takeover contain (contain)",
    "notes": "Alert SEC-baseline for user 3a8914b461 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_0221QSEOSMCHWTVT.\nPrivileged memberships removed (restore input):\n- 100bd8fa-90ba-413c-8dcf-325c92b48e42 admin (om_O563T9H0D3ZI3E1M7WCQ7PTWGT) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-baseline\",\"memberships\":[{\"organizationId\":\"100bd8fa-90ba-413c-8dcf-325c92b48e42\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 13.21ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "645",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "data": {
    "name": "SEC-baseline: account takeover contain (contain)",
    "notes": "Alert SEC-baseline for user 3a8914b461 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_0221QSEOSMCHWTVT.\nPrivileged memberships removed (restore input):\n- 100bd8fa-90ba-413c-8dcf-325c92b48e42 admin (om_O563T9H0D3ZI3E1M7WCQ7PTWGT) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-baseline\",\"memberships\":[{\"organizationId\":\"100bd8fa-90ba-413c-8dcf-325c92b48e42\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}

    Recorded response · HTTP 201

    {
  "data": {
    "name": "SEC-baseline: account takeover contain (contain)",
    "notes": "Alert SEC-baseline for user 3a8914b461 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_0221QSEOSMCHWTVT.\nPrivileged memberships removed (restore input):\n- 100bd8fa-90ba-413c-8dcf-325c92b48e42 admin (om_O563T9H0D3ZI3E1M7WCQ7PTWGT) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-baseline\",\"memberships\":[{\"organizationId\":\"100bd8fa-90ba-413c-8dcf-325c92b48e42\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  },
  "id": "94f554ee-86c5-4e87-b877-86a6f8cbd8b7"
}
  14. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request b02f5872d61c · processing 12.48ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-baseline (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 12.48ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "180",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-baseline (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_b937db5defe8489c92f8645a37",
    "client_msg_id": "cli_13c1ae5aa829498cb76cc95a83",
    "name": "item-ecb96f",
    "old_name": "Sample Old",
    "parent_user_id": "par_15dfc3577af84d7fbcced1e9e7",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "17UL1L369A.MY9D4Y"
}
  15. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/baseline/runs · baseline · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/baseline/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:28.393190+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "baseline-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "baseline"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "2 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 785
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 307
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 1
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_0221QSEOSMCHWTVT",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_0221QSEOSMCHWTVT",
            "alert": "SEC-baseline"
          },
          "attempts": 1,
          "ref": "cus_0221QSEOSMCHWTVT",
          "appliedAt": "2026-10-22T01:44:27.235Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "3a8914b461",
            "organization": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
          "detail": {
            "organizationId": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:27.615Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-baseline",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "94f554ee-86c5-4e87-b877-86a6f8cbd8b7",
          "appliedAt": "2026-10-22T01:44:27.780Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17UL1L369A.MY9D4Y",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:27.913Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:26.311Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:27.097Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:27.100Z",
          "msg": "planned 4 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:44:27.236Z",
          "msg": "stripe.hold_customer:cus_0221QSEOSMCHWTVT: applied"
        },
        {
          "at": "2026-10-22T01:44:27.616Z",
          "msg": "workos.remove_membership:om_O563T9H0D3ZI3E1M7WCQ7PTWGT: applied"
        },
        {
          "at": "2026-10-22T01:44:27.780Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:27.913Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:27.914Z",
          "msg": "done (ok)"
        }
      ],
      "createdAt": "2026-10-22T01:44:26.311Z",
      "updatedAt": "2026-10-22T01:44:27.914Z"
    }
  ]
}
  16. · POST app request /invocations · baseline · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "baseline-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-baseline",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "baseline"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:28.605112+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "405",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "baseline-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-baseline",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "baseline"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "baseline-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "baseline"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "2 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 785
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 307
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 1
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_0221QSEOSMCHWTVT",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_0221QSEOSMCHWTVT",
        "alert": "SEC-baseline"
      },
      "attempts": 1,
      "ref": "cus_0221QSEOSMCHWTVT",
      "appliedAt": "2026-10-22T01:44:27.235Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "3a8914b461",
        "organization": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
      "detail": {
        "organizationId": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:27.615Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-baseline",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "94f554ee-86c5-4e87-b877-86a6f8cbd8b7",
      "appliedAt": "2026-10-22T01:44:27.780Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17UL1L369A.MY9D4Y",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:27.913Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:26.311Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:27.097Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:27.100Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:27.236Z",
      "msg": "stripe.hold_customer:cus_0221QSEOSMCHWTVT: applied"
    },
    {
      "at": "2026-10-22T01:44:27.616Z",
      "msg": "workos.remove_membership:om_O563T9H0D3ZI3E1M7WCQ7PTWGT: applied"
    },
    {
      "at": "2026-10-22T01:44:27.780Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:27.913Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:27.914Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:44:28.439Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:26.311Z",
  "updatedAt": "2026-10-22T01:44:28.439Z",
  "duplicate": true
}
  17. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/baseline/runs · baseline · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/baseline/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:28.910094+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "baseline-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "baseline"
      },
      "duplicateStarts": 1,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "2 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 785
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 307
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 1
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_0221QSEOSMCHWTVT",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_0221QSEOSMCHWTVT",
            "alert": "SEC-baseline"
          },
          "attempts": 1,
          "ref": "cus_0221QSEOSMCHWTVT",
          "appliedAt": "2026-10-22T01:44:27.235Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "3a8914b461",
            "organization": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_O563T9H0D3ZI3E1M7WCQ7PTWGT",
          "detail": {
            "organizationId": "100bd8fa-90ba-413c-8dcf-325c92b48e42",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:27.615Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-baseline",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "94f554ee-86c5-4e87-b877-86a6f8cbd8b7",
          "appliedAt": "2026-10-22T01:44:27.780Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17UL1L369A.MY9D4Y",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:27.913Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:26.311Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:27.097Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:27.100Z",
          "msg": "planned 4 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:44:27.236Z",
          "msg": "stripe.hold_customer:cus_0221QSEOSMCHWTVT: applied"
        },
        {
          "at": "2026-10-22T01:44:27.616Z",
          "msg": "workos.remove_membership:om_O563T9H0D3ZI3E1M7WCQ7PTWGT: applied"
        },
        {
          "at": "2026-10-22T01:44:27.780Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:27.913Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:27.914Z",
          "msg": "done (ok)"
        },
        {
          "at": "2026-10-22T01:44:28.439Z",
          "msg": "duplicate start ignored"
        }
      ],
      "createdAt": "2026-10-22T01:44:26.311Z",
      "updatedAt": "2026-10-22T01:44:28.439Z"
    }
  ]
}
  18. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/last_admin_parked/runs · last admin parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/last_admin_parked/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:29.162881+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  19. · POST app request /invocations · last admin parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "last-admin-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-last-admin-parked",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_parked"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:30.799598+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "441",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "last-admin-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-last-admin-parked",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_parked"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "last-admin-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "AWAITING_APPROVAL",
  "closed": false,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_parked"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "2 membership(s), 2 privileged, 0 session(s)",
      "durationMs": 616
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 290
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 1
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_83CN4DCJLPU87ZU5",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_83CN4DCJLPU87ZU5",
        "alert": "SEC-last-admin-parked"
      },
      "attempts": 1,
      "ref": "cus_83CN4DCJLPU87ZU5",
      "appliedAt": "2026-10-22T01:44:29.961Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_LMERHZPVVBZQU7VNF3Q8RXEUUK",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "pending_approval",
      "summary": {
        "user": "5997f3875c",
        "organization": "55dc7326-97c5-4a13-8a2c-a0a5b3fc9e98",
        "role": "admin",
        "why": "last admin of the organization"
      },
      "attempts": 0,
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_6PBQE3PQH57H5LSIJA8V0527I7",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "5997f3875c",
        "organization": "c34f2393-be15-4f58-9393-289dc92a73a0",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_6PBQE3PQH57H5LSIJA8V0527I7",
      "detail": {
        "organizationId": "c34f2393-be15-4f58-9393-289dc92a73a0",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:30.294Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-last-admin-parked",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "90d0148c-2af2-4c53-a1d4-ef249f1da091",
      "appliedAt": "2026-10-22T01:44:30.470Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17SD20T0ZX.707ZOE",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:30.642Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 1,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:44:30.643Z"
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 2,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:29.211Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:29.828Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:29.831Z",
      "msg": "planned 5 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:44:29.961Z",
      "msg": "stripe.hold_customer:cus_83CN4DCJLPU87ZU5: applied"
    },
    {
      "at": "2026-10-22T01:44:30.294Z",
      "msg": "workos.remove_membership:om_6PBQE3PQH57H5LSIJA8V0527I7: applied"
    },
    {
      "at": "2026-10-22T01:44:30.470Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:30.642Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:30.643Z",
      "msg": "awaiting approval"
    }
  ],
  "createdAt": "2026-10-22T01:44:29.211Z",
  "updatedAt": "2026-10-22T01:44:30.643Z",
  "duplicate": false
}
  20. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request 20d7dfcdc18c · processing 1.86ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.86ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "6407e613-08cf-44cf-9320-c9b438935aeb",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/0ca4ec36",
      "email_verified": true,
      "external_id": "ext_ab98ad91189a48b7b7c3b05a2d",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  21. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request 6b0848e9cb54 · processing 15.6ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 15.6ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_83CN4DCJLPU87ZU5",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 34,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  22. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request e7162970f9ed · processing 0.65ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.65ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "6407e613-08cf-44cf-9320-c9b438935aeb",
      "organization_id": "55dc7326-97c5-4a13-8a2c-a0a5b3fc9e98",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_LMERHZPVVBZQU7VNF3Q8RXEUUK"
    },
    {
      "object": "organization_membership",
      "user_id": "6407e613-08cf-44cf-9320-c9b438935aeb",
      "organization_id": "c34f2393-be15-4f58-9393-289dc92a73a0",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_6PBQE3PQH57H5LSIJA8V0527I7"
    }
  ],
  "list_metadata": {
    "before": "om_LMERHZPVVBZQU7VNF3Q8RXEUUK",
    "after": null
  }
}
  23. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request 0cfbdf99d53b · processing 5.81ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 5.81ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  24. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request e57ec6a70d0e · processing 0.6ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.6ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "6407e613-08cf-44cf-9320-c9b438935aeb",
      "organization_id": "55dc7326-97c5-4a13-8a2c-a0a5b3fc9e98",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_LMERHZPVVBZQU7VNF3Q8RXEUUK"
    }
  ],
  "list_metadata": {
    "before": "om_LMERHZPVVBZQU7VNF3Q8RXEUUK",
    "after": null
  }
}
  25. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 6cc566e007f9 · processing 0.61ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.61ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "48e269c0-0bff-44bf-bae3-4a611d87a4e5",
      "organization_id": "c34f2393-be15-4f58-9393-289dc92a73a0",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_9A5E6PH4KH4YR7UL6IVQOUMBUL"
    },
    {
      "object": "organization_membership",
      "user_id": "6407e613-08cf-44cf-9320-c9b438935aeb",
      "organization_id": "c34f2393-be15-4f58-9393-289dc92a73a0",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_6PBQE3PQH57H5LSIJA8V0527I7"
    }
  ],
  "list_metadata": {
    "before": "om_9A5E6PH4KH4YR7UL6IVQOUMBUL",
    "after": null
  }
}
  26. · GET workos request · provider traffic · /user_management/users/6407e613-08cf-44cf-9320-c9b438935aeb/sessions · HTTP 200 · request 7be646c50929 · processing 1.4ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/6407e613-08cf-44cf-9320-c9b438935aeb/sessions' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.4ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "items": [
    {
      "session_id": "[redacted]",
      "name": "Sample Session 1",
      "id": "65028467-bd15-479d-b741-4630a662fd42"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 2",
      "id": "b0b28c4e-bdc3-4ed9-9483-fdd724aeb3ef"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 3",
      "id": "ab7c709c-c32d-4aa0-911b-52c680ee248f"
    }
  ]
}
  27. · POST stripe request · provider traffic · /v1/customers/cus_83CN4DCJLPU87ZU5 · HTTP 200 · request a305b38280a3 · processing 14.24ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_83CN4DCJLPU87ZU5' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-raw '{
  "metadata": {
    "acme_ato_hold": "SEC-last-admin-parked",
    "acme_ato_hold_at": "2026-10-22T01:44:29.211Z"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.24ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "109",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/x-www-form-urlencoded"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "metadata": {
    "acme_ato_hold": "SEC-last-admin-parked",
    "acme_ato_hold_at": "2026-10-22T01:44:29.211Z"
  }
}

    Recorded response · HTTP 200

    {
  "email": "[email protected]",
  "name": "Robin Customer",
  "id": "cus_83CN4DCJLPU87ZU5",
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 34,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "SEC-last-admin-parked",
    "acme_ato_hold_at": "2026-10-22T01:44:29.211Z"
  }
}
  28. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 165030b5182d · processing 0.64ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.64ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "6407e613-08cf-44cf-9320-c9b438935aeb",
      "organization_id": "55dc7326-97c5-4a13-8a2c-a0a5b3fc9e98",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_LMERHZPVVBZQU7VNF3Q8RXEUUK"
    },
    {
      "object": "organization_membership",
      "user_id": "6407e613-08cf-44cf-9320-c9b438935aeb",
      "organization_id": "c34f2393-be15-4f58-9393-289dc92a73a0",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_6PBQE3PQH57H5LSIJA8V0527I7"
    }
  ],
  "list_metadata": {
    "before": "om_LMERHZPVVBZQU7VNF3Q8RXEUUK",
    "after": null
  }
}
  29. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 5547aca9a2f2 · processing 0.64ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.64ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "48e269c0-0bff-44bf-bae3-4a611d87a4e5",
      "organization_id": "c34f2393-be15-4f58-9393-289dc92a73a0",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_9A5E6PH4KH4YR7UL6IVQOUMBUL"
    },
    {
      "object": "organization_membership",
      "user_id": "6407e613-08cf-44cf-9320-c9b438935aeb",
      "organization_id": "c34f2393-be15-4f58-9393-289dc92a73a0",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_6PBQE3PQH57H5LSIJA8V0527I7"
    }
  ],
  "list_metadata": {
    "before": "om_9A5E6PH4KH4YR7UL6IVQOUMBUL",
    "after": null
  }
}
  30. · DELETE workos request · provider traffic · /user_management/organization_memberships/om_6PBQE3PQH57H5LSIJA8V0527I7 · HTTP 204 · request 7d91ac5f7a74 · processing 0.83ms
  31. · POST asana request · provider traffic · /tasks · HTTP 201 · request 7c3af18aef47 · processing 14.99ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-last-admin-parked: account takeover contain (contain)",
    "notes": "Alert SEC-last-admin-parked for user 5997f3875c from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_83CN4DCJLPU87ZU5.\nPrivileged memberships removed (restore input):\n- 55dc7326-97c5-4a13-8a2c-a0a5b3fc9e98 admin (om_LMERHZPVVBZQU7VNF3Q8RXEUUK) approval: last admin of the organization\n- c34f2393-be15-4f58-9393-289dc92a73a0 admin (om_6PBQE3PQH57H5LSIJA8V0527I7) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-last-admin-parked\",\"memberships\":[{\"organizationId\":\"55dc7326-97c5-4a13-8a2c-a0a5b3fc9e98\",\"role\":\"admin\"},{\"organizationId\":\"c34f2393-be15-4f58-9393-289dc92a73a0\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.99ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "872",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "data": {
    "name": "SEC-last-admin-parked: account takeover contain (contain)",
    "notes": "Alert SEC-last-admin-parked for user 5997f3875c from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_83CN4DCJLPU87ZU5.\nPrivileged memberships removed (restore input):\n- 55dc7326-97c5-4a13-8a2c-a0a5b3fc9e98 admin (om_LMERHZPVVBZQU7VNF3Q8RXEUUK) approval: last admin of the organization\n- c34f2393-be15-4f58-9393-289dc92a73a0 admin (om_6PBQE3PQH57H5LSIJA8V0527I7) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-last-admin-parked\",\"memberships\":[{\"organizationId\":\"55dc7326-97c5-4a13-8a2c-a0a5b3fc9e98\",\"role\":\"admin\"},{\"organizationId\":\"c34f2393-be15-4f58-9393-289dc92a73a0\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}

    Recorded response · HTTP 201

    {
  "data": {
    "name": "SEC-last-admin-parked: account takeover contain (contain)",
    "notes": "Alert SEC-last-admin-parked for user 5997f3875c from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_83CN4DCJLPU87ZU5.\nPrivileged memberships removed (restore input):\n- 55dc7326-97c5-4a13-8a2c-a0a5b3fc9e98 admin (om_LMERHZPVVBZQU7VNF3Q8RXEUUK) approval: last admin of the organization\n- c34f2393-be15-4f58-9393-289dc92a73a0 admin (om_6PBQE3PQH57H5LSIJA8V0527I7) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-last-admin-parked\",\"memberships\":[{\"organizationId\":\"55dc7326-97c5-4a13-8a2c-a0a5b3fc9e98\",\"role\":\"admin\"},{\"organizationId\":\"c34f2393-be15-4f58-9393-289dc92a73a0\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  },
  "id": "90d0148c-2af2-4c53-a1d4-ef249f1da091"
}
  32. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request e4441c5f65a6 · processing 13.63ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-last-admin-parked (contain): contain, high risk (score 75). 2 privileged membership(s). Refunds held. 1 change(s) need approval.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 13.63ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "216",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-last-admin-parked (contain): contain, high risk (score 75). 2 privileged membership(s). Refunds held. 1 change(s) need approval.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_3985e1a846f34c7a8aa3f899a1",
    "client_msg_id": "cli_be573313fd114c258aaf9f3e7e",
    "name": "item-c39349",
    "old_name": "Sample Old",
    "parent_user_id": "par_5e49aa598ffa425bb0d8b6b03e",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "17SD20T0ZX.707ZOE"
}
  33. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/last_admin_parked/runs · last admin parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/last_admin_parked/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:31.103131+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "last-admin-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "AWAITING_APPROVAL",
      "closed": false,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "last_admin_parked"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "2 membership(s), 2 privileged, 0 session(s)",
          "durationMs": 616
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 290
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 1
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_83CN4DCJLPU87ZU5",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_83CN4DCJLPU87ZU5",
            "alert": "SEC-last-admin-parked"
          },
          "attempts": 1,
          "ref": "cus_83CN4DCJLPU87ZU5",
          "appliedAt": "2026-10-22T01:44:29.961Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_LMERHZPVVBZQU7VNF3Q8RXEUUK",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "approval",
          "status": "pending_approval",
          "summary": {
            "user": "5997f3875c",
            "organization": "55dc7326-97c5-4a13-8a2c-a0a5b3fc9e98",
            "role": "admin",
            "why": "last admin of the organization"
          },
          "attempts": 0,
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_6PBQE3PQH57H5LSIJA8V0527I7",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "5997f3875c",
            "organization": "c34f2393-be15-4f58-9393-289dc92a73a0",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_6PBQE3PQH57H5LSIJA8V0527I7",
          "detail": {
            "organizationId": "c34f2393-be15-4f58-9393-289dc92a73a0",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:30.294Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-last-admin-parked",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "90d0148c-2af2-4c53-a1d4-ef249f1da091",
          "appliedAt": "2026-10-22T01:44:30.470Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17SD20T0ZX.707ZOE",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:30.642Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 1,
        "skipped": 0,
        "rejected": 0
      },
      "approval": {
        "approvers": [
          "U_CISO"
        ],
        "expiresAt": "2026-10-23T01:44:30.643Z"
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 2,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:29.211Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:29.828Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:29.831Z",
          "msg": "planned 5 action(s): 1 need approval"
        },
        {
          "at": "2026-10-22T01:44:29.961Z",
          "msg": "stripe.hold_customer:cus_83CN4DCJLPU87ZU5: applied"
        },
        {
          "at": "2026-10-22T01:44:30.294Z",
          "msg": "workos.remove_membership:om_6PBQE3PQH57H5LSIJA8V0527I7: applied"
        },
        {
          "at": "2026-10-22T01:44:30.470Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:30.642Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:30.643Z",
          "msg": "awaiting approval"
        }
      ],
      "createdAt": "2026-10-22T01:44:29.211Z",
      "updatedAt": "2026-10-22T01:44:30.643Z"
    }
  ]
}
  34. · POST app request /invocations · last admin parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "last-admin-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-last-admin-parked",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_parked"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:31.309978+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "441",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "last-admin-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-last-admin-parked",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_parked"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "last-admin-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "AWAITING_APPROVAL",
  "closed": false,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_parked"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "2 membership(s), 2 privileged, 0 session(s)",
      "durationMs": 616
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 290
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 1
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_83CN4DCJLPU87ZU5",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_83CN4DCJLPU87ZU5",
        "alert": "SEC-last-admin-parked"
      },
      "attempts": 1,
      "ref": "cus_83CN4DCJLPU87ZU5",
      "appliedAt": "2026-10-22T01:44:29.961Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_LMERHZPVVBZQU7VNF3Q8RXEUUK",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "pending_approval",
      "summary": {
        "user": "5997f3875c",
        "organization": "55dc7326-97c5-4a13-8a2c-a0a5b3fc9e98",
        "role": "admin",
        "why": "last admin of the organization"
      },
      "attempts": 0,
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_6PBQE3PQH57H5LSIJA8V0527I7",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "5997f3875c",
        "organization": "c34f2393-be15-4f58-9393-289dc92a73a0",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_6PBQE3PQH57H5LSIJA8V0527I7",
      "detail": {
        "organizationId": "c34f2393-be15-4f58-9393-289dc92a73a0",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:30.294Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-last-admin-parked",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "90d0148c-2af2-4c53-a1d4-ef249f1da091",
      "appliedAt": "2026-10-22T01:44:30.470Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17SD20T0ZX.707ZOE",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:30.642Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 1,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:44:30.643Z"
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 2,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:29.211Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:29.828Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:29.831Z",
      "msg": "planned 5 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:44:29.961Z",
      "msg": "stripe.hold_customer:cus_83CN4DCJLPU87ZU5: applied"
    },
    {
      "at": "2026-10-22T01:44:30.294Z",
      "msg": "workos.remove_membership:om_6PBQE3PQH57H5LSIJA8V0527I7: applied"
    },
    {
      "at": "2026-10-22T01:44:30.470Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:30.642Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:30.643Z",
      "msg": "awaiting approval"
    },
    {
      "at": "2026-10-22T01:44:31.151Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:29.211Z",
  "updatedAt": "2026-10-22T01:44:31.151Z",
  "duplicate": true
}
  35. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/last_admin_parked/runs · last admin parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/last_admin_parked/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:31.622945+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "last-admin-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "AWAITING_APPROVAL",
      "closed": false,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "last_admin_parked"
      },
      "duplicateStarts": 1,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "2 membership(s), 2 privileged, 0 session(s)",
          "durationMs": 616
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 290
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 1
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_83CN4DCJLPU87ZU5",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_83CN4DCJLPU87ZU5",
            "alert": "SEC-last-admin-parked"
          },
          "attempts": 1,
          "ref": "cus_83CN4DCJLPU87ZU5",
          "appliedAt": "2026-10-22T01:44:29.961Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_LMERHZPVVBZQU7VNF3Q8RXEUUK",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "approval",
          "status": "pending_approval",
          "summary": {
            "user": "5997f3875c",
            "organization": "55dc7326-97c5-4a13-8a2c-a0a5b3fc9e98",
            "role": "admin",
            "why": "last admin of the organization"
          },
          "attempts": 0,
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_6PBQE3PQH57H5LSIJA8V0527I7",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "5997f3875c",
            "organization": "c34f2393-be15-4f58-9393-289dc92a73a0",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_6PBQE3PQH57H5LSIJA8V0527I7",
          "detail": {
            "organizationId": "c34f2393-be15-4f58-9393-289dc92a73a0",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:30.294Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-last-admin-parked",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "90d0148c-2af2-4c53-a1d4-ef249f1da091",
          "appliedAt": "2026-10-22T01:44:30.470Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17SD20T0ZX.707ZOE",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:30.642Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 1,
        "skipped": 0,
        "rejected": 0
      },
      "approval": {
        "approvers": [
          "U_CISO"
        ],
        "expiresAt": "2026-10-23T01:44:30.643Z"
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 2,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:29.211Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:29.828Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:29.831Z",
          "msg": "planned 5 action(s): 1 need approval"
        },
        {
          "at": "2026-10-22T01:44:29.961Z",
          "msg": "stripe.hold_customer:cus_83CN4DCJLPU87ZU5: applied"
        },
        {
          "at": "2026-10-22T01:44:30.294Z",
          "msg": "workos.remove_membership:om_6PBQE3PQH57H5LSIJA8V0527I7: applied"
        },
        {
          "at": "2026-10-22T01:44:30.470Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:30.642Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:30.643Z",
          "msg": "awaiting approval"
        },
        {
          "at": "2026-10-22T01:44:31.151Z",
          "msg": "duplicate start ignored"
        }
      ],
      "createdAt": "2026-10-22T01:44:29.211Z",
      "updatedAt": "2026-10-22T01:44:31.151Z"
    }
  ]
}
  36. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/last_admin_approved/runs · last admin approved · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/last_admin_approved/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:31.861807+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  37. · POST app request /invocations · last admin approved · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "last-admin-approved-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-last-admin-approved",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_approved"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:33.463864+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "449",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "last-admin-approved-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-last-admin-approved",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_approved"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "last-admin-approved-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "AWAITING_APPROVAL",
  "closed": false,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_approved"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "2 membership(s), 2 privileged, 0 session(s)",
      "durationMs": 564
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 285
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_8K2R9JFUIW79RMCL",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_8K2R9JFUIW79RMCL",
        "alert": "SEC-last-admin-approved"
      },
      "attempts": 1,
      "ref": "cus_8K2R9JFUIW79RMCL",
      "appliedAt": "2026-10-22T01:44:32.611Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_WYX7VIOKH8BQ7558CKXCKEYCSI",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "bf512a07f9",
        "organization": "cf4a75fc-d469-406e-b3db-d45d57811a0a",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_WYX7VIOKH8BQ7558CKXCKEYCSI",
      "detail": {
        "organizationId": "cf4a75fc-d469-406e-b3db-d45d57811a0a",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:32.949Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_RLLP0HXB2KQRYR4JD0WJRUSDLN",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "pending_approval",
      "summary": {
        "user": "bf512a07f9",
        "organization": "665a4339-b8b1-427d-9cfd-24b003507217",
        "role": "admin",
        "why": "last admin of the organization"
      },
      "attempts": 0,
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-last-admin-approved",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "d6cb3823-cbe0-4545-9ff6-bc6f562f44ae",
      "appliedAt": "2026-10-22T01:44:33.086Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "1726V4CXU7.S7Y6U7",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:33.263Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 1,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:44:33.264Z"
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 2,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:31.913Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:32.478Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:32.480Z",
      "msg": "planned 5 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:44:32.611Z",
      "msg": "stripe.hold_customer:cus_8K2R9JFUIW79RMCL: applied"
    },
    {
      "at": "2026-10-22T01:44:32.949Z",
      "msg": "workos.remove_membership:om_WYX7VIOKH8BQ7558CKXCKEYCSI: applied"
    },
    {
      "at": "2026-10-22T01:44:33.086Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:33.263Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:33.264Z",
      "msg": "awaiting approval"
    }
  ],
  "createdAt": "2026-10-22T01:44:31.913Z",
  "updatedAt": "2026-10-22T01:44:33.264Z",
  "duplicate": false
}
  38. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request 345f96cc7e12 · processing 1.66ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.66ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "724d7e93-a7e1-475f-872e-b13b67bc0183",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/e50affc3",
      "email_verified": true,
      "external_id": "ext_c389ee1c531a45df8d21aaf6a1",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  39. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request d327356e53a4 · processing 15.65ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 15.65ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_8K2R9JFUIW79RMCL",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 11,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  40. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request f11903ac9ad5 · processing 0.58ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.58ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "724d7e93-a7e1-475f-872e-b13b67bc0183",
      "organization_id": "cf4a75fc-d469-406e-b3db-d45d57811a0a",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_WYX7VIOKH8BQ7558CKXCKEYCSI"
    },
    {
      "object": "organization_membership",
      "user_id": "724d7e93-a7e1-475f-872e-b13b67bc0183",
      "organization_id": "665a4339-b8b1-427d-9cfd-24b003507217",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_RLLP0HXB2KQRYR4JD0WJRUSDLN"
    }
  ],
  "list_metadata": {
    "before": "om_WYX7VIOKH8BQ7558CKXCKEYCSI",
    "after": null
  }
}
  41. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request 31c03679a61b · processing 6.01ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 6.01ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  42. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 991902344763 · processing 0.71ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.71ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "724d7e93-a7e1-475f-872e-b13b67bc0183",
      "organization_id": "cf4a75fc-d469-406e-b3db-d45d57811a0a",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_WYX7VIOKH8BQ7558CKXCKEYCSI"
    },
    {
      "object": "organization_membership",
      "user_id": "7a7416c0-518f-4668-ad2a-975f81a618dc",
      "organization_id": "cf4a75fc-d469-406e-b3db-d45d57811a0a",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_8Z3QZB9QDAZPVK5PIJFYV7U75H"
    }
  ],
  "list_metadata": {
    "before": "om_WYX7VIOKH8BQ7558CKXCKEYCSI",
    "after": null
  }
}
  43. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request dd0c6e8fe0d3 · processing 0.56ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.56ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "724d7e93-a7e1-475f-872e-b13b67bc0183",
      "organization_id": "665a4339-b8b1-427d-9cfd-24b003507217",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_RLLP0HXB2KQRYR4JD0WJRUSDLN"
    }
  ],
  "list_metadata": {
    "before": "om_RLLP0HXB2KQRYR4JD0WJRUSDLN",
    "after": null
  }
}
  44. · GET workos request · provider traffic · /user_management/users/724d7e93-a7e1-475f-872e-b13b67bc0183/sessions · HTTP 200 · request be7843239254 · processing 1.47ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/724d7e93-a7e1-475f-872e-b13b67bc0183/sessions' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.47ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "items": [
    {
      "session_id": "[redacted]",
      "name": "Sample Session 1",
      "id": "65028467-bd15-479d-b741-4630a662fd42"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 2",
      "id": "b0b28c4e-bdc3-4ed9-9483-fdd724aeb3ef"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 3",
      "id": "ab7c709c-c32d-4aa0-911b-52c680ee248f"
    }
  ]
}
  45. · POST stripe request · provider traffic · /v1/customers/cus_8K2R9JFUIW79RMCL · HTTP 200 · request 2a164152b2ab · processing 13.23ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_8K2R9JFUIW79RMCL' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-raw '{
  "metadata": {
    "acme_ato_hold": "SEC-last-admin-approved",
    "acme_ato_hold_at": "2026-10-22T01:44:31.913Z"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 13.23ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "111",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/x-www-form-urlencoded"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "metadata": {
    "acme_ato_hold": "SEC-last-admin-approved",
    "acme_ato_hold_at": "2026-10-22T01:44:31.913Z"
  }
}

    Recorded response · HTTP 200

    {
  "email": "[email protected]",
  "name": "Robin Customer",
  "id": "cus_8K2R9JFUIW79RMCL",
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 11,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "SEC-last-admin-approved",
    "acme_ato_hold_at": "2026-10-22T01:44:31.913Z"
  }
}
  46. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request bae85dbd4c24 · processing 0.59ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.59ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "724d7e93-a7e1-475f-872e-b13b67bc0183",
      "organization_id": "cf4a75fc-d469-406e-b3db-d45d57811a0a",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_WYX7VIOKH8BQ7558CKXCKEYCSI"
    },
    {
      "object": "organization_membership",
      "user_id": "724d7e93-a7e1-475f-872e-b13b67bc0183",
      "organization_id": "665a4339-b8b1-427d-9cfd-24b003507217",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_RLLP0HXB2KQRYR4JD0WJRUSDLN"
    }
  ],
  "list_metadata": {
    "before": "om_WYX7VIOKH8BQ7558CKXCKEYCSI",
    "after": null
  }
}
  47. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 998b6e3ad680 · processing 0.59ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.59ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "724d7e93-a7e1-475f-872e-b13b67bc0183",
      "organization_id": "cf4a75fc-d469-406e-b3db-d45d57811a0a",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_WYX7VIOKH8BQ7558CKXCKEYCSI"
    },
    {
      "object": "organization_membership",
      "user_id": "7a7416c0-518f-4668-ad2a-975f81a618dc",
      "organization_id": "cf4a75fc-d469-406e-b3db-d45d57811a0a",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_8Z3QZB9QDAZPVK5PIJFYV7U75H"
    }
  ],
  "list_metadata": {
    "before": "om_WYX7VIOKH8BQ7558CKXCKEYCSI",
    "after": null
  }
}
  48. · DELETE workos request · provider traffic · /user_management/organization_memberships/om_WYX7VIOKH8BQ7558CKXCKEYCSI · HTTP 204 · request 4e83b6a5eed8 · processing 0.83ms
  49. · POST asana request · provider traffic · /tasks · HTTP 201 · request 7f2b9fb53ab7 · processing 18.63ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-last-admin-approved: account takeover contain (contain)",
    "notes": "Alert SEC-last-admin-approved for user bf512a07f9 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_8K2R9JFUIW79RMCL.\nPrivileged memberships removed (restore input):\n- cf4a75fc-d469-406e-b3db-d45d57811a0a admin (om_WYX7VIOKH8BQ7558CKXCKEYCSI) auto: high risk\n- 665a4339-b8b1-427d-9cfd-24b003507217 admin (om_RLLP0HXB2KQRYR4JD0WJRUSDLN) approval: last admin of the organization\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-last-admin-approved\",\"memberships\":[{\"organizationId\":\"cf4a75fc-d469-406e-b3db-d45d57811a0a\",\"role\":\"admin\"},{\"organizationId\":\"665a4339-b8b1-427d-9cfd-24b003507217\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 18.63ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "878",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "data": {
    "name": "SEC-last-admin-approved: account takeover contain (contain)",
    "notes": "Alert SEC-last-admin-approved for user bf512a07f9 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_8K2R9JFUIW79RMCL.\nPrivileged memberships removed (restore input):\n- cf4a75fc-d469-406e-b3db-d45d57811a0a admin (om_WYX7VIOKH8BQ7558CKXCKEYCSI) auto: high risk\n- 665a4339-b8b1-427d-9cfd-24b003507217 admin (om_RLLP0HXB2KQRYR4JD0WJRUSDLN) approval: last admin of the organization\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-last-admin-approved\",\"memberships\":[{\"organizationId\":\"cf4a75fc-d469-406e-b3db-d45d57811a0a\",\"role\":\"admin\"},{\"organizationId\":\"665a4339-b8b1-427d-9cfd-24b003507217\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}

    Recorded response · HTTP 201

    {
  "data": {
    "name": "SEC-last-admin-approved: account takeover contain (contain)",
    "notes": "Alert SEC-last-admin-approved for user bf512a07f9 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_8K2R9JFUIW79RMCL.\nPrivileged memberships removed (restore input):\n- cf4a75fc-d469-406e-b3db-d45d57811a0a admin (om_WYX7VIOKH8BQ7558CKXCKEYCSI) auto: high risk\n- 665a4339-b8b1-427d-9cfd-24b003507217 admin (om_RLLP0HXB2KQRYR4JD0WJRUSDLN) approval: last admin of the organization\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-last-admin-approved\",\"memberships\":[{\"organizationId\":\"cf4a75fc-d469-406e-b3db-d45d57811a0a\",\"role\":\"admin\"},{\"organizationId\":\"665a4339-b8b1-427d-9cfd-24b003507217\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  },
  "id": "d6cb3823-cbe0-4545-9ff6-bc6f562f44ae"
}
  50. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request af5bf92be57f · processing 16.25ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-last-admin-approved (contain): contain, high risk (score 75). 2 privileged membership(s). Refunds held. 1 change(s) need approval.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 16.25ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "218",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-last-admin-approved (contain): contain, high risk (score 75). 2 privileged membership(s). Refunds held. 1 change(s) need approval.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_848610282c404d0f9857393b7b",
    "client_msg_id": "cli_049d22d02a0243b6a01cfb71f5",
    "name": "item-5e79a5",
    "old_name": "Sample Old",
    "parent_user_id": "par_300521a8197740a8903f5042e8",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "1726V4CXU7.S7Y6U7"
}
  51. · POST app request /invocations · last admin approved · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "decide",
  "runId": "last-admin-approved-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "decision": "approve",
  "userId": "U_CISO"
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:34.028913+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "124",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "decide",
  "runId": "last-admin-approved-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "decision": "approve",
  "userId": "U_CISO"
}

    Recorded response · HTTP 200

    {
  "runId": "last-admin-approved-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_approved"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "2 membership(s), 2 privileged, 0 session(s)",
      "durationMs": 564
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 285
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_8K2R9JFUIW79RMCL",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_8K2R9JFUIW79RMCL",
        "alert": "SEC-last-admin-approved"
      },
      "attempts": 1,
      "ref": "cus_8K2R9JFUIW79RMCL",
      "appliedAt": "2026-10-22T01:44:32.611Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_WYX7VIOKH8BQ7558CKXCKEYCSI",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "bf512a07f9",
        "organization": "cf4a75fc-d469-406e-b3db-d45d57811a0a",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_WYX7VIOKH8BQ7558CKXCKEYCSI",
      "detail": {
        "organizationId": "cf4a75fc-d469-406e-b3db-d45d57811a0a",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:32.949Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_RLLP0HXB2KQRYR4JD0WJRUSDLN",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "applied",
      "summary": {
        "user": "bf512a07f9",
        "organization": "665a4339-b8b1-427d-9cfd-24b003507217",
        "role": "admin",
        "why": "last admin of the organization"
      },
      "attempts": 1,
      "ref": "om_RLLP0HXB2KQRYR4JD0WJRUSDLN",
      "detail": {
        "organizationId": "665a4339-b8b1-427d-9cfd-24b003507217",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:33.838Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-last-admin-approved",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "d6cb3823-cbe0-4545-9ff6-bc6f562f44ae",
      "appliedAt": "2026-10-22T01:44:33.086Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "1726V4CXU7.S7Y6U7",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:33.263Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 5,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:44:33.264Z",
    "decision": "approve",
    "decidedBy": "U_CISO",
    "decidedAt": "2026-10-22T01:44:33.500Z"
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 2,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:31.913Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:32.478Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:32.480Z",
      "msg": "planned 5 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:44:32.611Z",
      "msg": "stripe.hold_customer:cus_8K2R9JFUIW79RMCL: applied"
    },
    {
      "at": "2026-10-22T01:44:32.949Z",
      "msg": "workos.remove_membership:om_WYX7VIOKH8BQ7558CKXCKEYCSI: applied"
    },
    {
      "at": "2026-10-22T01:44:33.086Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:33.263Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:33.264Z",
      "msg": "awaiting approval"
    },
    {
      "at": "2026-10-22T01:44:33.500Z",
      "msg": "approved by U_CISO"
    },
    {
      "at": "2026-10-22T01:44:33.838Z",
      "msg": "workos.remove_membership:om_RLLP0HXB2KQRYR4JD0WJRUSDLN: applied"
    },
    {
      "at": "2026-10-22T01:44:33.839Z",
      "msg": "done (ok)"
    }
  ],
  "createdAt": "2026-10-22T01:44:31.913Z",
  "updatedAt": "2026-10-22T01:44:33.839Z",
  "result": "recorded"
}
  52. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 52f99e5b60cc · processing 0.63ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.63ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "724d7e93-a7e1-475f-872e-b13b67bc0183",
      "organization_id": "665a4339-b8b1-427d-9cfd-24b003507217",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_RLLP0HXB2KQRYR4JD0WJRUSDLN"
    }
  ],
  "list_metadata": {
    "before": "om_RLLP0HXB2KQRYR4JD0WJRUSDLN",
    "after": null
  }
}
  53. · DELETE workos request · provider traffic · /user_management/organization_memberships/om_RLLP0HXB2KQRYR4JD0WJRUSDLN · HTTP 204 · request 5bd53594e222 · processing 0.78ms
  54. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/last_admin_approved/runs · last admin approved · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/last_admin_approved/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:34.329481+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "last-admin-approved-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "last_admin_approved"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "2 membership(s), 2 privileged, 0 session(s)",
          "durationMs": 564
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 285
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_8K2R9JFUIW79RMCL",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_8K2R9JFUIW79RMCL",
            "alert": "SEC-last-admin-approved"
          },
          "attempts": 1,
          "ref": "cus_8K2R9JFUIW79RMCL",
          "appliedAt": "2026-10-22T01:44:32.611Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_WYX7VIOKH8BQ7558CKXCKEYCSI",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "bf512a07f9",
            "organization": "cf4a75fc-d469-406e-b3db-d45d57811a0a",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_WYX7VIOKH8BQ7558CKXCKEYCSI",
          "detail": {
            "organizationId": "cf4a75fc-d469-406e-b3db-d45d57811a0a",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:32.949Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_RLLP0HXB2KQRYR4JD0WJRUSDLN",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "approval",
          "status": "applied",
          "summary": {
            "user": "bf512a07f9",
            "organization": "665a4339-b8b1-427d-9cfd-24b003507217",
            "role": "admin",
            "why": "last admin of the organization"
          },
          "attempts": 1,
          "ref": "om_RLLP0HXB2KQRYR4JD0WJRUSDLN",
          "detail": {
            "organizationId": "665a4339-b8b1-427d-9cfd-24b003507217",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:33.838Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-last-admin-approved",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "d6cb3823-cbe0-4545-9ff6-bc6f562f44ae",
          "appliedAt": "2026-10-22T01:44:33.086Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "1726V4CXU7.S7Y6U7",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:33.263Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 5,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "approval": {
        "approvers": [
          "U_CISO"
        ],
        "expiresAt": "2026-10-23T01:44:33.264Z",
        "decision": "approve",
        "decidedBy": "U_CISO",
        "decidedAt": "2026-10-22T01:44:33.500Z"
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 2,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:31.913Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:32.478Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:32.480Z",
          "msg": "planned 5 action(s): 1 need approval"
        },
        {
          "at": "2026-10-22T01:44:32.611Z",
          "msg": "stripe.hold_customer:cus_8K2R9JFUIW79RMCL: applied"
        },
        {
          "at": "2026-10-22T01:44:32.949Z",
          "msg": "workos.remove_membership:om_WYX7VIOKH8BQ7558CKXCKEYCSI: applied"
        },
        {
          "at": "2026-10-22T01:44:33.086Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:33.263Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:33.264Z",
          "msg": "awaiting approval"
        },
        {
          "at": "2026-10-22T01:44:33.500Z",
          "msg": "approved by U_CISO"
        },
        {
          "at": "2026-10-22T01:44:33.838Z",
          "msg": "workos.remove_membership:om_RLLP0HXB2KQRYR4JD0WJRUSDLN: applied"
        },
        {
          "at": "2026-10-22T01:44:33.839Z",
          "msg": "done (ok)"
        }
      ],
      "createdAt": "2026-10-22T01:44:31.913Z",
      "updatedAt": "2026-10-22T01:44:33.839Z"
    }
  ]
}
  55. · POST app request /invocations · last admin approved · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "last-admin-approved-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-last-admin-approved",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_approved"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:34.534253+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "449",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "last-admin-approved-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-last-admin-approved",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_approved"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "last-admin-approved-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_approved"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "2 membership(s), 2 privileged, 0 session(s)",
      "durationMs": 564
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 285
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_8K2R9JFUIW79RMCL",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_8K2R9JFUIW79RMCL",
        "alert": "SEC-last-admin-approved"
      },
      "attempts": 1,
      "ref": "cus_8K2R9JFUIW79RMCL",
      "appliedAt": "2026-10-22T01:44:32.611Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_WYX7VIOKH8BQ7558CKXCKEYCSI",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "bf512a07f9",
        "organization": "cf4a75fc-d469-406e-b3db-d45d57811a0a",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_WYX7VIOKH8BQ7558CKXCKEYCSI",
      "detail": {
        "organizationId": "cf4a75fc-d469-406e-b3db-d45d57811a0a",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:32.949Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_RLLP0HXB2KQRYR4JD0WJRUSDLN",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "applied",
      "summary": {
        "user": "bf512a07f9",
        "organization": "665a4339-b8b1-427d-9cfd-24b003507217",
        "role": "admin",
        "why": "last admin of the organization"
      },
      "attempts": 1,
      "ref": "om_RLLP0HXB2KQRYR4JD0WJRUSDLN",
      "detail": {
        "organizationId": "665a4339-b8b1-427d-9cfd-24b003507217",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:33.838Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-last-admin-approved",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "d6cb3823-cbe0-4545-9ff6-bc6f562f44ae",
      "appliedAt": "2026-10-22T01:44:33.086Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "1726V4CXU7.S7Y6U7",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:33.263Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 5,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:44:33.264Z",
    "decision": "approve",
    "decidedBy": "U_CISO",
    "decidedAt": "2026-10-22T01:44:33.500Z"
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 2,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:31.913Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:32.478Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:32.480Z",
      "msg": "planned 5 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:44:32.611Z",
      "msg": "stripe.hold_customer:cus_8K2R9JFUIW79RMCL: applied"
    },
    {
      "at": "2026-10-22T01:44:32.949Z",
      "msg": "workos.remove_membership:om_WYX7VIOKH8BQ7558CKXCKEYCSI: applied"
    },
    {
      "at": "2026-10-22T01:44:33.086Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:33.263Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:33.264Z",
      "msg": "awaiting approval"
    },
    {
      "at": "2026-10-22T01:44:33.500Z",
      "msg": "approved by U_CISO"
    },
    {
      "at": "2026-10-22T01:44:33.838Z",
      "msg": "workos.remove_membership:om_RLLP0HXB2KQRYR4JD0WJRUSDLN: applied"
    },
    {
      "at": "2026-10-22T01:44:33.839Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:44:34.378Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:31.913Z",
  "updatedAt": "2026-10-22T01:44:34.378Z",
  "duplicate": true
}
  56. · POST app request /invocations · last admin approved · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "decide",
  "runId": "last-admin-approved-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "decision": "approve",
  "userId": "U_CISO"
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:34.733935+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "124",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "decide",
  "runId": "last-admin-approved-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "decision": "approve",
  "userId": "U_CISO"
}

    Recorded response · HTTP 200

    {
  "runId": "last-admin-approved-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_approved"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "2 membership(s), 2 privileged, 0 session(s)",
      "durationMs": 564
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 285
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_8K2R9JFUIW79RMCL",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_8K2R9JFUIW79RMCL",
        "alert": "SEC-last-admin-approved"
      },
      "attempts": 1,
      "ref": "cus_8K2R9JFUIW79RMCL",
      "appliedAt": "2026-10-22T01:44:32.611Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_WYX7VIOKH8BQ7558CKXCKEYCSI",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "bf512a07f9",
        "organization": "cf4a75fc-d469-406e-b3db-d45d57811a0a",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_WYX7VIOKH8BQ7558CKXCKEYCSI",
      "detail": {
        "organizationId": "cf4a75fc-d469-406e-b3db-d45d57811a0a",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:32.949Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_RLLP0HXB2KQRYR4JD0WJRUSDLN",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "applied",
      "summary": {
        "user": "bf512a07f9",
        "organization": "665a4339-b8b1-427d-9cfd-24b003507217",
        "role": "admin",
        "why": "last admin of the organization"
      },
      "attempts": 1,
      "ref": "om_RLLP0HXB2KQRYR4JD0WJRUSDLN",
      "detail": {
        "organizationId": "665a4339-b8b1-427d-9cfd-24b003507217",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:33.838Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-last-admin-approved",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "d6cb3823-cbe0-4545-9ff6-bc6f562f44ae",
      "appliedAt": "2026-10-22T01:44:33.086Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "1726V4CXU7.S7Y6U7",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:33.263Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 5,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:44:33.264Z",
    "decision": "approve",
    "decidedBy": "U_CISO",
    "decidedAt": "2026-10-22T01:44:33.500Z"
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 2,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:31.913Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:32.478Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:32.480Z",
      "msg": "planned 5 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:44:32.611Z",
      "msg": "stripe.hold_customer:cus_8K2R9JFUIW79RMCL: applied"
    },
    {
      "at": "2026-10-22T01:44:32.949Z",
      "msg": "workos.remove_membership:om_WYX7VIOKH8BQ7558CKXCKEYCSI: applied"
    },
    {
      "at": "2026-10-22T01:44:33.086Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:33.263Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:33.264Z",
      "msg": "awaiting approval"
    },
    {
      "at": "2026-10-22T01:44:33.500Z",
      "msg": "approved by U_CISO"
    },
    {
      "at": "2026-10-22T01:44:33.838Z",
      "msg": "workos.remove_membership:om_RLLP0HXB2KQRYR4JD0WJRUSDLN: applied"
    },
    {
      "at": "2026-10-22T01:44:33.839Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:44:34.378Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:31.913Z",
  "updatedAt": "2026-10-22T01:44:34.577Z",
  "result": "already_decided"
}
  57. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/last_admin_approved/runs · last admin approved · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/last_admin_approved/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:35.065333+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "last-admin-approved-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "last_admin_approved"
      },
      "duplicateStarts": 1,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "2 membership(s), 2 privileged, 0 session(s)",
          "durationMs": 564
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 285
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_8K2R9JFUIW79RMCL",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_8K2R9JFUIW79RMCL",
            "alert": "SEC-last-admin-approved"
          },
          "attempts": 1,
          "ref": "cus_8K2R9JFUIW79RMCL",
          "appliedAt": "2026-10-22T01:44:32.611Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_WYX7VIOKH8BQ7558CKXCKEYCSI",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "bf512a07f9",
            "organization": "cf4a75fc-d469-406e-b3db-d45d57811a0a",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_WYX7VIOKH8BQ7558CKXCKEYCSI",
          "detail": {
            "organizationId": "cf4a75fc-d469-406e-b3db-d45d57811a0a",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:32.949Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_RLLP0HXB2KQRYR4JD0WJRUSDLN",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "approval",
          "status": "applied",
          "summary": {
            "user": "bf512a07f9",
            "organization": "665a4339-b8b1-427d-9cfd-24b003507217",
            "role": "admin",
            "why": "last admin of the organization"
          },
          "attempts": 1,
          "ref": "om_RLLP0HXB2KQRYR4JD0WJRUSDLN",
          "detail": {
            "organizationId": "665a4339-b8b1-427d-9cfd-24b003507217",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:33.838Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-last-admin-approved",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "d6cb3823-cbe0-4545-9ff6-bc6f562f44ae",
          "appliedAt": "2026-10-22T01:44:33.086Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "1726V4CXU7.S7Y6U7",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:33.263Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 5,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "approval": {
        "approvers": [
          "U_CISO"
        ],
        "expiresAt": "2026-10-23T01:44:33.264Z",
        "decision": "approve",
        "decidedBy": "U_CISO",
        "decidedAt": "2026-10-22T01:44:33.500Z"
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 2,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:31.913Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:32.478Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:32.480Z",
          "msg": "planned 5 action(s): 1 need approval"
        },
        {
          "at": "2026-10-22T01:44:32.611Z",
          "msg": "stripe.hold_customer:cus_8K2R9JFUIW79RMCL: applied"
        },
        {
          "at": "2026-10-22T01:44:32.949Z",
          "msg": "workos.remove_membership:om_WYX7VIOKH8BQ7558CKXCKEYCSI: applied"
        },
        {
          "at": "2026-10-22T01:44:33.086Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:33.263Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:33.264Z",
          "msg": "awaiting approval"
        },
        {
          "at": "2026-10-22T01:44:33.500Z",
          "msg": "approved by U_CISO"
        },
        {
          "at": "2026-10-22T01:44:33.838Z",
          "msg": "workos.remove_membership:om_RLLP0HXB2KQRYR4JD0WJRUSDLN: applied"
        },
        {
          "at": "2026-10-22T01:44:33.839Z",
          "msg": "done (ok)"
        },
        {
          "at": "2026-10-22T01:44:34.378Z",
          "msg": "duplicate start ignored"
        }
      ],
      "createdAt": "2026-10-22T01:44:31.913Z",
      "updatedAt": "2026-10-22T01:44:34.577Z"
    }
  ]
}
  58. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/last_admin_rejected/runs · last admin rejected · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/last_admin_rejected/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:35.291173+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  59. · POST app request /invocations · last admin rejected · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "last-admin-rejected-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-last-admin-rejected",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_rejected"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:36.842138+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "449",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "last-admin-rejected-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-last-admin-rejected",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_rejected"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "last-admin-rejected-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "AWAITING_APPROVAL",
  "closed": false,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_rejected"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "2 membership(s), 2 privileged, 0 session(s)",
      "durationMs": 587
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 275
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_WI0KV9X33C0Z78DR",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_WI0KV9X33C0Z78DR",
        "alert": "SEC-last-admin-rejected"
      },
      "attempts": 1,
      "ref": "cus_WI0KV9X33C0Z78DR",
      "appliedAt": "2026-10-22T01:44:36.066Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_PIA7964R13VGQ38VZGAKKAE2IO",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "pending_approval",
      "summary": {
        "user": "0d662ee73a",
        "organization": "81d61cee-14e3-49a6-8adb-ac66e188a262",
        "role": "admin",
        "why": "last admin of the organization"
      },
      "attempts": 0,
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_0VKOEC0E3LVU1ZASQ246ZNZQAM",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "0d662ee73a",
        "organization": "ab129bfb-dd68-4678-aa48-17d4b8ec6314",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_0VKOEC0E3LVU1ZASQ246ZNZQAM",
      "detail": {
        "organizationId": "ab129bfb-dd68-4678-aa48-17d4b8ec6314",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:36.404Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-last-admin-rejected",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "28946808-10c6-458b-9134-a729284b36d7",
      "appliedAt": "2026-10-22T01:44:36.560Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17OMWTOK2X.LKJAJ7",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:36.686Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 1,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:44:36.687Z"
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 2,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:35.337Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:35.925Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:35.929Z",
      "msg": "planned 5 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:44:36.066Z",
      "msg": "stripe.hold_customer:cus_WI0KV9X33C0Z78DR: applied"
    },
    {
      "at": "2026-10-22T01:44:36.404Z",
      "msg": "workos.remove_membership:om_0VKOEC0E3LVU1ZASQ246ZNZQAM: applied"
    },
    {
      "at": "2026-10-22T01:44:36.560Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:36.686Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:36.687Z",
      "msg": "awaiting approval"
    }
  ],
  "createdAt": "2026-10-22T01:44:35.337Z",
  "updatedAt": "2026-10-22T01:44:36.687Z",
  "duplicate": false
}
  60. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request 801956fca675 · processing 1.81ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.81ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "97c27ccb-6e29-46d8-be5f-a19cc09284a7",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/d76079a5",
      "email_verified": true,
      "external_id": "ext_24a2abf82f334ce7b8e57bf26e",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  61. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request f19695c53055 · processing 15.56ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 15.56ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_WI0KV9X33C0Z78DR",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 98,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  62. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 3c5c8fc7ce55 · processing 0.66ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.66ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "97c27ccb-6e29-46d8-be5f-a19cc09284a7",
      "organization_id": "81d61cee-14e3-49a6-8adb-ac66e188a262",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_PIA7964R13VGQ38VZGAKKAE2IO"
    },
    {
      "object": "organization_membership",
      "user_id": "97c27ccb-6e29-46d8-be5f-a19cc09284a7",
      "organization_id": "ab129bfb-dd68-4678-aa48-17d4b8ec6314",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_0VKOEC0E3LVU1ZASQ246ZNZQAM"
    }
  ],
  "list_metadata": {
    "before": "om_PIA7964R13VGQ38VZGAKKAE2IO",
    "after": null
  }
}
  63. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request a8a18455bcf3 · processing 6.13ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 6.13ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  64. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 11e5e19b10b0 · processing 0.6ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.6ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "97c27ccb-6e29-46d8-be5f-a19cc09284a7",
      "organization_id": "81d61cee-14e3-49a6-8adb-ac66e188a262",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_PIA7964R13VGQ38VZGAKKAE2IO"
    }
  ],
  "list_metadata": {
    "before": "om_PIA7964R13VGQ38VZGAKKAE2IO",
    "after": null
  }
}
  65. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 4a7452d8efce · processing 0.6ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.6ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "20d53d0d-335f-469f-b843-177f80fae1df",
      "organization_id": "ab129bfb-dd68-4678-aa48-17d4b8ec6314",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_KQYKVZXTTWEMXO4RX3A46MUPTP"
    },
    {
      "object": "organization_membership",
      "user_id": "97c27ccb-6e29-46d8-be5f-a19cc09284a7",
      "organization_id": "ab129bfb-dd68-4678-aa48-17d4b8ec6314",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_0VKOEC0E3LVU1ZASQ246ZNZQAM"
    }
  ],
  "list_metadata": {
    "before": "om_KQYKVZXTTWEMXO4RX3A46MUPTP",
    "after": null
  }
}
  66. · GET workos request · provider traffic · /user_management/users/97c27ccb-6e29-46d8-be5f-a19cc09284a7/sessions · HTTP 200 · request 6faf1425efbb · processing 1.54ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/97c27ccb-6e29-46d8-be5f-a19cc09284a7/sessions' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.54ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "items": [
    {
      "session_id": "[redacted]",
      "name": "Sample Session 1",
      "id": "65028467-bd15-479d-b741-4630a662fd42"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 2",
      "id": "b0b28c4e-bdc3-4ed9-9483-fdd724aeb3ef"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 3",
      "id": "ab7c709c-c32d-4aa0-911b-52c680ee248f"
    }
  ]
}
  67. · POST stripe request · provider traffic · /v1/customers/cus_WI0KV9X33C0Z78DR · HTTP 200 · request 19efb89c4dff · processing 13.77ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_WI0KV9X33C0Z78DR' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-raw '{
  "metadata": {
    "acme_ato_hold": "SEC-last-admin-rejected",
    "acme_ato_hold_at": "2026-10-22T01:44:35.337Z"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 13.77ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "111",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/x-www-form-urlencoded"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "metadata": {
    "acme_ato_hold": "SEC-last-admin-rejected",
    "acme_ato_hold_at": "2026-10-22T01:44:35.337Z"
  }
}

    Recorded response · HTTP 200

    {
  "email": "[email protected]",
  "name": "Robin Customer",
  "id": "cus_WI0KV9X33C0Z78DR",
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 98,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "SEC-last-admin-rejected",
    "acme_ato_hold_at": "2026-10-22T01:44:35.337Z"
  }
}
  68. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request c1a8c41bef89 · processing 0.68ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.68ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "97c27ccb-6e29-46d8-be5f-a19cc09284a7",
      "organization_id": "81d61cee-14e3-49a6-8adb-ac66e188a262",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_PIA7964R13VGQ38VZGAKKAE2IO"
    },
    {
      "object": "organization_membership",
      "user_id": "97c27ccb-6e29-46d8-be5f-a19cc09284a7",
      "organization_id": "ab129bfb-dd68-4678-aa48-17d4b8ec6314",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_0VKOEC0E3LVU1ZASQ246ZNZQAM"
    }
  ],
  "list_metadata": {
    "before": "om_PIA7964R13VGQ38VZGAKKAE2IO",
    "after": null
  }
}
  69. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request c481dd657d10 · processing 0.59ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.59ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "20d53d0d-335f-469f-b843-177f80fae1df",
      "organization_id": "ab129bfb-dd68-4678-aa48-17d4b8ec6314",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_KQYKVZXTTWEMXO4RX3A46MUPTP"
    },
    {
      "object": "organization_membership",
      "user_id": "97c27ccb-6e29-46d8-be5f-a19cc09284a7",
      "organization_id": "ab129bfb-dd68-4678-aa48-17d4b8ec6314",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_0VKOEC0E3LVU1ZASQ246ZNZQAM"
    }
  ],
  "list_metadata": {
    "before": "om_KQYKVZXTTWEMXO4RX3A46MUPTP",
    "after": null
  }
}
  70. · DELETE workos request · provider traffic · /user_management/organization_memberships/om_0VKOEC0E3LVU1ZASQ246ZNZQAM · HTTP 204 · request 815adecc6adc · processing 0.93ms
  71. · POST asana request · provider traffic · /tasks · HTTP 201 · request ab2ebc8b69c2 · processing 14.72ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-last-admin-rejected: account takeover contain (contain)",
    "notes": "Alert SEC-last-admin-rejected for user 0d662ee73a from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_WI0KV9X33C0Z78DR.\nPrivileged memberships removed (restore input):\n- 81d61cee-14e3-49a6-8adb-ac66e188a262 admin (om_PIA7964R13VGQ38VZGAKKAE2IO) approval: last admin of the organization\n- ab129bfb-dd68-4678-aa48-17d4b8ec6314 admin (om_0VKOEC0E3LVU1ZASQ246ZNZQAM) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-last-admin-rejected\",\"memberships\":[{\"organizationId\":\"81d61cee-14e3-49a6-8adb-ac66e188a262\",\"role\":\"admin\"},{\"organizationId\":\"ab129bfb-dd68-4678-aa48-17d4b8ec6314\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.72ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "878",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "data": {
    "name": "SEC-last-admin-rejected: account takeover contain (contain)",
    "notes": "Alert SEC-last-admin-rejected for user 0d662ee73a from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_WI0KV9X33C0Z78DR.\nPrivileged memberships removed (restore input):\n- 81d61cee-14e3-49a6-8adb-ac66e188a262 admin (om_PIA7964R13VGQ38VZGAKKAE2IO) approval: last admin of the organization\n- ab129bfb-dd68-4678-aa48-17d4b8ec6314 admin (om_0VKOEC0E3LVU1ZASQ246ZNZQAM) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-last-admin-rejected\",\"memberships\":[{\"organizationId\":\"81d61cee-14e3-49a6-8adb-ac66e188a262\",\"role\":\"admin\"},{\"organizationId\":\"ab129bfb-dd68-4678-aa48-17d4b8ec6314\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}

    Recorded response · HTTP 201

    {
  "data": {
    "name": "SEC-last-admin-rejected: account takeover contain (contain)",
    "notes": "Alert SEC-last-admin-rejected for user 0d662ee73a from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_WI0KV9X33C0Z78DR.\nPrivileged memberships removed (restore input):\n- 81d61cee-14e3-49a6-8adb-ac66e188a262 admin (om_PIA7964R13VGQ38VZGAKKAE2IO) approval: last admin of the organization\n- ab129bfb-dd68-4678-aa48-17d4b8ec6314 admin (om_0VKOEC0E3LVU1ZASQ246ZNZQAM) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-last-admin-rejected\",\"memberships\":[{\"organizationId\":\"81d61cee-14e3-49a6-8adb-ac66e188a262\",\"role\":\"admin\"},{\"organizationId\":\"ab129bfb-dd68-4678-aa48-17d4b8ec6314\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  },
  "id": "28946808-10c6-458b-9134-a729284b36d7"
}
  72. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request 9c84d0362e58 · processing 13.59ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-last-admin-rejected (contain): contain, high risk (score 75). 2 privileged membership(s). Refunds held. 1 change(s) need approval.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 13.59ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "218",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-last-admin-rejected (contain): contain, high risk (score 75). 2 privileged membership(s). Refunds held. 1 change(s) need approval.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_f099a5c7b83d45bfb42224d36e",
    "client_msg_id": "cli_8b9971b36d324f7995c6f58a3e",
    "name": "item-505608",
    "old_name": "Sample Old",
    "parent_user_id": "par_5beb97ce71f24a519c6bf179cb",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "17OMWTOK2X.LKJAJ7"
}
  73. · POST app request /invocations · last admin rejected · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "decide",
  "runId": "last-admin-rejected-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "decision": "reject",
  "userId": "U_CISO"
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:37.042973+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "123",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "decide",
  "runId": "last-admin-rejected-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "decision": "reject",
  "userId": "U_CISO"
}

    Recorded response · HTTP 200

    {
  "runId": "last-admin-rejected-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "REJECTED",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_rejected"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "2 membership(s), 2 privileged, 0 session(s)",
      "durationMs": 587
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 275
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_WI0KV9X33C0Z78DR",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_WI0KV9X33C0Z78DR",
        "alert": "SEC-last-admin-rejected"
      },
      "attempts": 1,
      "ref": "cus_WI0KV9X33C0Z78DR",
      "appliedAt": "2026-10-22T01:44:36.066Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_PIA7964R13VGQ38VZGAKKAE2IO",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "rejected",
      "summary": {
        "user": "0d662ee73a",
        "organization": "81d61cee-14e3-49a6-8adb-ac66e188a262",
        "role": "admin",
        "why": "last admin of the organization"
      },
      "attempts": 0,
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_0VKOEC0E3LVU1ZASQ246ZNZQAM",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "0d662ee73a",
        "organization": "ab129bfb-dd68-4678-aa48-17d4b8ec6314",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_0VKOEC0E3LVU1ZASQ246ZNZQAM",
      "detail": {
        "organizationId": "ab129bfb-dd68-4678-aa48-17d4b8ec6314",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:36.404Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-last-admin-rejected",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "28946808-10c6-458b-9134-a729284b36d7",
      "appliedAt": "2026-10-22T01:44:36.560Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17OMWTOK2X.LKJAJ7",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:36.686Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 1
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:44:36.687Z",
    "decision": "reject",
    "decidedBy": "U_CISO",
    "decidedAt": "2026-10-22T01:44:36.879Z"
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 2,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:35.337Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:35.925Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:35.929Z",
      "msg": "planned 5 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:44:36.066Z",
      "msg": "stripe.hold_customer:cus_WI0KV9X33C0Z78DR: applied"
    },
    {
      "at": "2026-10-22T01:44:36.404Z",
      "msg": "workos.remove_membership:om_0VKOEC0E3LVU1ZASQ246ZNZQAM: applied"
    },
    {
      "at": "2026-10-22T01:44:36.560Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:36.686Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:36.687Z",
      "msg": "awaiting approval"
    },
    {
      "at": "2026-10-22T01:44:36.879Z",
      "msg": "rejected by U_CISO"
    }
  ],
  "createdAt": "2026-10-22T01:44:35.337Z",
  "updatedAt": "2026-10-22T01:44:36.879Z",
  "result": "recorded"
}
  74. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/last_admin_rejected/runs · last admin rejected · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/last_admin_rejected/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:37.366132+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "last-admin-rejected-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "REJECTED",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "last_admin_rejected"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "2 membership(s), 2 privileged, 0 session(s)",
          "durationMs": 587
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 275
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_WI0KV9X33C0Z78DR",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_WI0KV9X33C0Z78DR",
            "alert": "SEC-last-admin-rejected"
          },
          "attempts": 1,
          "ref": "cus_WI0KV9X33C0Z78DR",
          "appliedAt": "2026-10-22T01:44:36.066Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_PIA7964R13VGQ38VZGAKKAE2IO",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "approval",
          "status": "rejected",
          "summary": {
            "user": "0d662ee73a",
            "organization": "81d61cee-14e3-49a6-8adb-ac66e188a262",
            "role": "admin",
            "why": "last admin of the organization"
          },
          "attempts": 0,
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_0VKOEC0E3LVU1ZASQ246ZNZQAM",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "0d662ee73a",
            "organization": "ab129bfb-dd68-4678-aa48-17d4b8ec6314",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_0VKOEC0E3LVU1ZASQ246ZNZQAM",
          "detail": {
            "organizationId": "ab129bfb-dd68-4678-aa48-17d4b8ec6314",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:36.404Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-last-admin-rejected",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "28946808-10c6-458b-9134-a729284b36d7",
          "appliedAt": "2026-10-22T01:44:36.560Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17OMWTOK2X.LKJAJ7",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:36.686Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 1
      },
      "approval": {
        "approvers": [
          "U_CISO"
        ],
        "expiresAt": "2026-10-23T01:44:36.687Z",
        "decision": "reject",
        "decidedBy": "U_CISO",
        "decidedAt": "2026-10-22T01:44:36.879Z"
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 2,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:35.337Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:35.925Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:35.929Z",
          "msg": "planned 5 action(s): 1 need approval"
        },
        {
          "at": "2026-10-22T01:44:36.066Z",
          "msg": "stripe.hold_customer:cus_WI0KV9X33C0Z78DR: applied"
        },
        {
          "at": "2026-10-22T01:44:36.404Z",
          "msg": "workos.remove_membership:om_0VKOEC0E3LVU1ZASQ246ZNZQAM: applied"
        },
        {
          "at": "2026-10-22T01:44:36.560Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:36.686Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:36.687Z",
          "msg": "awaiting approval"
        },
        {
          "at": "2026-10-22T01:44:36.879Z",
          "msg": "rejected by U_CISO"
        }
      ],
      "createdAt": "2026-10-22T01:44:35.337Z",
      "updatedAt": "2026-10-22T01:44:36.879Z"
    }
  ]
}
  75. · POST app request /invocations · last admin rejected · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "last-admin-rejected-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-last-admin-rejected",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_rejected"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:37.564122+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "449",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "last-admin-rejected-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-last-admin-rejected",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_rejected"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "last-admin-rejected-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "REJECTED",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_rejected"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "2 membership(s), 2 privileged, 0 session(s)",
      "durationMs": 587
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 275
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_WI0KV9X33C0Z78DR",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_WI0KV9X33C0Z78DR",
        "alert": "SEC-last-admin-rejected"
      },
      "attempts": 1,
      "ref": "cus_WI0KV9X33C0Z78DR",
      "appliedAt": "2026-10-22T01:44:36.066Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_PIA7964R13VGQ38VZGAKKAE2IO",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "rejected",
      "summary": {
        "user": "0d662ee73a",
        "organization": "81d61cee-14e3-49a6-8adb-ac66e188a262",
        "role": "admin",
        "why": "last admin of the organization"
      },
      "attempts": 0,
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_0VKOEC0E3LVU1ZASQ246ZNZQAM",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "0d662ee73a",
        "organization": "ab129bfb-dd68-4678-aa48-17d4b8ec6314",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_0VKOEC0E3LVU1ZASQ246ZNZQAM",
      "detail": {
        "organizationId": "ab129bfb-dd68-4678-aa48-17d4b8ec6314",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:36.404Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-last-admin-rejected",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "28946808-10c6-458b-9134-a729284b36d7",
      "appliedAt": "2026-10-22T01:44:36.560Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17OMWTOK2X.LKJAJ7",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:36.686Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 1
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:44:36.687Z",
    "decision": "reject",
    "decidedBy": "U_CISO",
    "decidedAt": "2026-10-22T01:44:36.879Z"
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 2,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:35.337Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:35.925Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:35.929Z",
      "msg": "planned 5 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:44:36.066Z",
      "msg": "stripe.hold_customer:cus_WI0KV9X33C0Z78DR: applied"
    },
    {
      "at": "2026-10-22T01:44:36.404Z",
      "msg": "workos.remove_membership:om_0VKOEC0E3LVU1ZASQ246ZNZQAM: applied"
    },
    {
      "at": "2026-10-22T01:44:36.560Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:36.686Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:36.687Z",
      "msg": "awaiting approval"
    },
    {
      "at": "2026-10-22T01:44:36.879Z",
      "msg": "rejected by U_CISO"
    },
    {
      "at": "2026-10-22T01:44:37.403Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:35.337Z",
  "updatedAt": "2026-10-22T01:44:37.403Z",
  "duplicate": true
}
  76. · POST app request /invocations · last admin rejected · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "decide",
  "runId": "last-admin-rejected-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "decision": "reject",
  "userId": "U_CISO"
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:37.758348+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "123",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "decide",
  "runId": "last-admin-rejected-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "decision": "reject",
  "userId": "U_CISO"
}

    Recorded response · HTTP 200

    {
  "runId": "last-admin-rejected-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "REJECTED",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "last_admin_rejected"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "2 membership(s), 2 privileged, 0 session(s)",
      "durationMs": 587
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 275
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_WI0KV9X33C0Z78DR",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_WI0KV9X33C0Z78DR",
        "alert": "SEC-last-admin-rejected"
      },
      "attempts": 1,
      "ref": "cus_WI0KV9X33C0Z78DR",
      "appliedAt": "2026-10-22T01:44:36.066Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_PIA7964R13VGQ38VZGAKKAE2IO",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "rejected",
      "summary": {
        "user": "0d662ee73a",
        "organization": "81d61cee-14e3-49a6-8adb-ac66e188a262",
        "role": "admin",
        "why": "last admin of the organization"
      },
      "attempts": 0,
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_0VKOEC0E3LVU1ZASQ246ZNZQAM",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "0d662ee73a",
        "organization": "ab129bfb-dd68-4678-aa48-17d4b8ec6314",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_0VKOEC0E3LVU1ZASQ246ZNZQAM",
      "detail": {
        "organizationId": "ab129bfb-dd68-4678-aa48-17d4b8ec6314",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:36.404Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-last-admin-rejected",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "28946808-10c6-458b-9134-a729284b36d7",
      "appliedAt": "2026-10-22T01:44:36.560Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17OMWTOK2X.LKJAJ7",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:36.686Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 1
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:44:36.687Z",
    "decision": "reject",
    "decidedBy": "U_CISO",
    "decidedAt": "2026-10-22T01:44:36.879Z"
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 2,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:35.337Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:35.925Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:35.929Z",
      "msg": "planned 5 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:44:36.066Z",
      "msg": "stripe.hold_customer:cus_WI0KV9X33C0Z78DR: applied"
    },
    {
      "at": "2026-10-22T01:44:36.404Z",
      "msg": "workos.remove_membership:om_0VKOEC0E3LVU1ZASQ246ZNZQAM: applied"
    },
    {
      "at": "2026-10-22T01:44:36.560Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:36.686Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:36.687Z",
      "msg": "awaiting approval"
    },
    {
      "at": "2026-10-22T01:44:36.879Z",
      "msg": "rejected by U_CISO"
    },
    {
      "at": "2026-10-22T01:44:37.403Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:35.337Z",
  "updatedAt": "2026-10-22T01:44:37.597Z",
  "result": "already_decided"
}
  77. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/last_admin_rejected/runs · last admin rejected · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/last_admin_rejected/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:38.053026+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "last-admin-rejected-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "REJECTED",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "last_admin_rejected"
      },
      "duplicateStarts": 1,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "2 membership(s), 2 privileged, 0 session(s)",
          "durationMs": 587
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 275
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_WI0KV9X33C0Z78DR",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_WI0KV9X33C0Z78DR",
            "alert": "SEC-last-admin-rejected"
          },
          "attempts": 1,
          "ref": "cus_WI0KV9X33C0Z78DR",
          "appliedAt": "2026-10-22T01:44:36.066Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_PIA7964R13VGQ38VZGAKKAE2IO",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "approval",
          "status": "rejected",
          "summary": {
            "user": "0d662ee73a",
            "organization": "81d61cee-14e3-49a6-8adb-ac66e188a262",
            "role": "admin",
            "why": "last admin of the organization"
          },
          "attempts": 0,
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_0VKOEC0E3LVU1ZASQ246ZNZQAM",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "0d662ee73a",
            "organization": "ab129bfb-dd68-4678-aa48-17d4b8ec6314",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_0VKOEC0E3LVU1ZASQ246ZNZQAM",
          "detail": {
            "organizationId": "ab129bfb-dd68-4678-aa48-17d4b8ec6314",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:36.404Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-last-admin-rejected",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "28946808-10c6-458b-9134-a729284b36d7",
          "appliedAt": "2026-10-22T01:44:36.560Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17OMWTOK2X.LKJAJ7",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:36.686Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 1
      },
      "approval": {
        "approvers": [
          "U_CISO"
        ],
        "expiresAt": "2026-10-23T01:44:36.687Z",
        "decision": "reject",
        "decidedBy": "U_CISO",
        "decidedAt": "2026-10-22T01:44:36.879Z"
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 2,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:35.337Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:35.925Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:35.929Z",
          "msg": "planned 5 action(s): 1 need approval"
        },
        {
          "at": "2026-10-22T01:44:36.066Z",
          "msg": "stripe.hold_customer:cus_WI0KV9X33C0Z78DR: applied"
        },
        {
          "at": "2026-10-22T01:44:36.404Z",
          "msg": "workos.remove_membership:om_0VKOEC0E3LVU1ZASQ246ZNZQAM: applied"
        },
        {
          "at": "2026-10-22T01:44:36.560Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:36.686Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:36.687Z",
          "msg": "awaiting approval"
        },
        {
          "at": "2026-10-22T01:44:36.879Z",
          "msg": "rejected by U_CISO"
        },
        {
          "at": "2026-10-22T01:44:37.403Z",
          "msg": "duplicate start ignored"
        }
      ],
      "createdAt": "2026-10-22T01:44:35.337Z",
      "updatedAt": "2026-10-22T01:44:37.597Z"
    }
  ]
}
  78. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/approve_by_stranger_refused/runs · approve by stranger refused · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/approve_by_stranger_refused/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:38.260682+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  79. · POST app request /invocations · approve by stranger refused · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "approve-by-stranger-refused-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-approve-by-stranger-refused",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "approve_by_stranger_refused"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:39.370527+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "481",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "approve-by-stranger-refused-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-approve-by-stranger-refused",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "approve_by_stranger_refused"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "approve-by-stranger-refused-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "AWAITING_APPROVAL",
  "closed": false,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "approve_by_stranger_refused"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 506
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 289
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_15G4PTUK62CMVXI7",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_15G4PTUK62CMVXI7",
        "alert": "SEC-approve-by-stranger-refused"
      },
      "attempts": 1,
      "ref": "cus_15G4PTUK62CMVXI7",
      "appliedAt": "2026-10-22T01:44:38.969Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_OUOLI4AEQ62VL8RN85LDSYIHD4",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "pending_approval",
      "summary": {
        "user": "988a28071f",
        "organization": "4c9b33c0-1f21-4230-a4d8-4595f74549b1",
        "role": "admin",
        "why": "last admin of the organization"
      },
      "attempts": 0,
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-approve-by-stranger-refused",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "bfacd042-eb88-4713-989a-0b48a5d39988",
      "appliedAt": "2026-10-22T01:44:39.099Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "179CC4PNEJ.QE6TI7",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:39.215Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 3,
    "failed": 0,
    "pendingApproval": 1,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:44:39.216Z"
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 0,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:38.323Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:38.831Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:38.834Z",
      "msg": "planned 4 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:44:38.969Z",
      "msg": "stripe.hold_customer:cus_15G4PTUK62CMVXI7: applied"
    },
    {
      "at": "2026-10-22T01:44:39.099Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:39.215Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:39.216Z",
      "msg": "awaiting approval"
    }
  ],
  "createdAt": "2026-10-22T01:44:38.323Z",
  "updatedAt": "2026-10-22T01:44:39.216Z",
  "duplicate": false
}
  80. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request f403c3c0261b · processing 14.79ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.79ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_15G4PTUK62CMVXI7",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 56,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  81. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request 5636269ae6f6 · processing 1.85ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.85ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "60149a54-67af-42b2-8941-727333426941",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/55b1a926",
      "email_verified": true,
      "external_id": "ext_9c874f645c994c78870a95b05a",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  82. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request d1b89ec6f4b1 · processing 0.56ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.56ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "60149a54-67af-42b2-8941-727333426941",
      "organization_id": "4c9b33c0-1f21-4230-a4d8-4595f74549b1",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_OUOLI4AEQ62VL8RN85LDSYIHD4"
    }
  ],
  "list_metadata": {
    "before": "om_OUOLI4AEQ62VL8RN85LDSYIHD4",
    "after": null
  }
}
  83. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request 42f5b8d2e72e · processing 5.49ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 5.49ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  84. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 347a39fe9d9d · processing 0.55ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.55ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "60149a54-67af-42b2-8941-727333426941",
      "organization_id": "4c9b33c0-1f21-4230-a4d8-4595f74549b1",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_OUOLI4AEQ62VL8RN85LDSYIHD4"
    }
  ],
  "list_metadata": {
    "before": "om_OUOLI4AEQ62VL8RN85LDSYIHD4",
    "after": null
  }
}
  85. · GET workos request · provider traffic · /user_management/users/60149a54-67af-42b2-8941-727333426941/sessions · HTTP 200 · request 52f90c1f866a · processing 1.41ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/60149a54-67af-42b2-8941-727333426941/sessions' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.41ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "items": [
    {
      "session_id": "[redacted]",
      "name": "Sample Session 1",
      "id": "65028467-bd15-479d-b741-4630a662fd42"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 2",
      "id": "b0b28c4e-bdc3-4ed9-9483-fdd724aeb3ef"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 3",
      "id": "ab7c709c-c32d-4aa0-911b-52c680ee248f"
    }
  ]
}
  86. · POST stripe request · provider traffic · /v1/customers/cus_15G4PTUK62CMVXI7 · HTTP 200 · request 230ccae25965 · processing 13.11ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_15G4PTUK62CMVXI7' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-raw '{
  "metadata": {
    "acme_ato_hold": "SEC-approve-by-stranger-refused",
    "acme_ato_hold_at": "2026-10-22T01:44:38.323Z"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 13.11ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "119",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/x-www-form-urlencoded"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "metadata": {
    "acme_ato_hold": "SEC-approve-by-stranger-refused",
    "acme_ato_hold_at": "2026-10-22T01:44:38.323Z"
  }
}

    Recorded response · HTTP 200

    {
  "email": "[email protected]",
  "name": "Robin Customer",
  "id": "cus_15G4PTUK62CMVXI7",
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 56,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "SEC-approve-by-stranger-refused",
    "acme_ato_hold_at": "2026-10-22T01:44:38.323Z"
  }
}
  87. · POST asana request · provider traffic · /tasks · HTTP 201 · request 5e99a4b1d498 · processing 14.74ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-approve-by-stranger-refused: account takeover contain (contain)",
    "notes": "Alert SEC-approve-by-stranger-refused for user 988a28071f from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_15G4PTUK62CMVXI7.\nPrivileged memberships removed (restore input):\n- 4c9b33c0-1f21-4230-a4d8-4595f74549b1 admin (om_OUOLI4AEQ62VL8RN85LDSYIHD4) approval: last admin of the organization\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-approve-by-stranger-refused\",\"memberships\":[{\"organizationId\":\"4c9b33c0-1f21-4230-a4d8-4595f74549b1\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.74ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "727",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "data": {
    "name": "SEC-approve-by-stranger-refused: account takeover contain (contain)",
    "notes": "Alert SEC-approve-by-stranger-refused for user 988a28071f from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_15G4PTUK62CMVXI7.\nPrivileged memberships removed (restore input):\n- 4c9b33c0-1f21-4230-a4d8-4595f74549b1 admin (om_OUOLI4AEQ62VL8RN85LDSYIHD4) approval: last admin of the organization\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-approve-by-stranger-refused\",\"memberships\":[{\"organizationId\":\"4c9b33c0-1f21-4230-a4d8-4595f74549b1\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}

    Recorded response · HTTP 201

    {
  "data": {
    "name": "SEC-approve-by-stranger-refused: account takeover contain (contain)",
    "notes": "Alert SEC-approve-by-stranger-refused for user 988a28071f from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_15G4PTUK62CMVXI7.\nPrivileged memberships removed (restore input):\n- 4c9b33c0-1f21-4230-a4d8-4595f74549b1 admin (om_OUOLI4AEQ62VL8RN85LDSYIHD4) approval: last admin of the organization\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-approve-by-stranger-refused\",\"memberships\":[{\"organizationId\":\"4c9b33c0-1f21-4230-a4d8-4595f74549b1\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  },
  "id": "bfacd042-eb88-4713-989a-0b48a5d39988"
}
  88. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request db4b080dc0af · processing 13.67ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-approve-by-stranger-refused (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held. 1 change(s) need approval.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 13.67ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "226",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-approve-by-stranger-refused (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held. 1 change(s) need approval.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_69a4a5c21d4642988766b14613",
    "client_msg_id": "cli_4d50348081224a6aa1b6b40d11",
    "name": "item-fcb7a8",
    "old_name": "Sample Old",
    "parent_user_id": "par_ea6396b3b6974c1ab500a0b143",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "179CC4PNEJ.QE6TI7"
}
  89. · POST app request /invocations · approve by stranger refused · HTTP 403
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "decide",
  "runId": "approve-by-stranger-refused-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "decision": "approve",
  "userId": "U_HELPDESK"
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:39.588261+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "136",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "decide",
  "runId": "approve-by-stranger-refused-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "decision": "approve",
  "userId": "U_HELPDESK"
}

    Recorded response · HTTP 403

    {
  "runId": "approve-by-stranger-refused-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "AWAITING_APPROVAL",
  "closed": false,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "approve_by_stranger_refused"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 506
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 289
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_15G4PTUK62CMVXI7",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_15G4PTUK62CMVXI7",
        "alert": "SEC-approve-by-stranger-refused"
      },
      "attempts": 1,
      "ref": "cus_15G4PTUK62CMVXI7",
      "appliedAt": "2026-10-22T01:44:38.969Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_OUOLI4AEQ62VL8RN85LDSYIHD4",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "pending_approval",
      "summary": {
        "user": "988a28071f",
        "organization": "4c9b33c0-1f21-4230-a4d8-4595f74549b1",
        "role": "admin",
        "why": "last admin of the organization"
      },
      "attempts": 0,
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-approve-by-stranger-refused",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "bfacd042-eb88-4713-989a-0b48a5d39988",
      "appliedAt": "2026-10-22T01:44:39.099Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "179CC4PNEJ.QE6TI7",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:39.215Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 3,
    "failed": 0,
    "pendingApproval": 1,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:44:39.216Z"
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 0,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:38.323Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:38.831Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:38.834Z",
      "msg": "planned 4 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:44:38.969Z",
      "msg": "stripe.hold_customer:cus_15G4PTUK62CMVXI7: applied"
    },
    {
      "at": "2026-10-22T01:44:39.099Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:39.215Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:39.216Z",
      "msg": "awaiting approval"
    },
    {
      "at": "2026-10-22T01:44:39.430Z",
      "msg": "decision by U_HELPDESK refused: not an approver"
    }
  ],
  "createdAt": "2026-10-22T01:44:38.323Z",
  "updatedAt": "2026-10-22T01:44:39.430Z",
  "result": "forbidden"
}
  90. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/approve_by_stranger_refused/runs · approve by stranger refused · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/approve_by_stranger_refused/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:39.901619+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "approve-by-stranger-refused-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "AWAITING_APPROVAL",
      "closed": false,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "approve_by_stranger_refused"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 506
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 289
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_15G4PTUK62CMVXI7",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_15G4PTUK62CMVXI7",
            "alert": "SEC-approve-by-stranger-refused"
          },
          "attempts": 1,
          "ref": "cus_15G4PTUK62CMVXI7",
          "appliedAt": "2026-10-22T01:44:38.969Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_OUOLI4AEQ62VL8RN85LDSYIHD4",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "approval",
          "status": "pending_approval",
          "summary": {
            "user": "988a28071f",
            "organization": "4c9b33c0-1f21-4230-a4d8-4595f74549b1",
            "role": "admin",
            "why": "last admin of the organization"
          },
          "attempts": 0,
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-approve-by-stranger-refused",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "bfacd042-eb88-4713-989a-0b48a5d39988",
          "appliedAt": "2026-10-22T01:44:39.099Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "179CC4PNEJ.QE6TI7",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:39.215Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 3,
        "failed": 0,
        "pendingApproval": 1,
        "skipped": 0,
        "rejected": 0
      },
      "approval": {
        "approvers": [
          "U_CISO"
        ],
        "expiresAt": "2026-10-23T01:44:39.216Z"
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 0,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:38.323Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:38.831Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:38.834Z",
          "msg": "planned 4 action(s): 1 need approval"
        },
        {
          "at": "2026-10-22T01:44:38.969Z",
          "msg": "stripe.hold_customer:cus_15G4PTUK62CMVXI7: applied"
        },
        {
          "at": "2026-10-22T01:44:39.099Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:39.215Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:39.216Z",
          "msg": "awaiting approval"
        },
        {
          "at": "2026-10-22T01:44:39.430Z",
          "msg": "decision by U_HELPDESK refused: not an approver"
        }
      ],
      "createdAt": "2026-10-22T01:44:38.323Z",
      "updatedAt": "2026-10-22T01:44:39.430Z"
    }
  ]
}
  91. · POST app request /invocations · approve by stranger refused · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "approve-by-stranger-refused-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-approve-by-stranger-refused",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "approve_by_stranger_refused"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:40.107224+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "481",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "approve-by-stranger-refused-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-approve-by-stranger-refused",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "approve_by_stranger_refused"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "approve-by-stranger-refused-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "AWAITING_APPROVAL",
  "closed": false,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "approve_by_stranger_refused"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 506
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 289
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_15G4PTUK62CMVXI7",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_15G4PTUK62CMVXI7",
        "alert": "SEC-approve-by-stranger-refused"
      },
      "attempts": 1,
      "ref": "cus_15G4PTUK62CMVXI7",
      "appliedAt": "2026-10-22T01:44:38.969Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_OUOLI4AEQ62VL8RN85LDSYIHD4",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "pending_approval",
      "summary": {
        "user": "988a28071f",
        "organization": "4c9b33c0-1f21-4230-a4d8-4595f74549b1",
        "role": "admin",
        "why": "last admin of the organization"
      },
      "attempts": 0,
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-approve-by-stranger-refused",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "bfacd042-eb88-4713-989a-0b48a5d39988",
      "appliedAt": "2026-10-22T01:44:39.099Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "179CC4PNEJ.QE6TI7",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:39.215Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 3,
    "failed": 0,
    "pendingApproval": 1,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:44:39.216Z"
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 0,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:38.323Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:38.831Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:38.834Z",
      "msg": "planned 4 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:44:38.969Z",
      "msg": "stripe.hold_customer:cus_15G4PTUK62CMVXI7: applied"
    },
    {
      "at": "2026-10-22T01:44:39.099Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:39.215Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:39.216Z",
      "msg": "awaiting approval"
    },
    {
      "at": "2026-10-22T01:44:39.430Z",
      "msg": "decision by U_HELPDESK refused: not an approver"
    },
    {
      "at": "2026-10-22T01:44:39.948Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:38.323Z",
  "updatedAt": "2026-10-22T01:44:39.948Z",
  "duplicate": true
}
  92. · POST app request /invocations · approve by stranger refused · HTTP 403
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "decide",
  "runId": "approve-by-stranger-refused-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "decision": "approve",
  "userId": "U_HELPDESK"
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:40.334537+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "136",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "decide",
  "runId": "approve-by-stranger-refused-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "decision": "approve",
  "userId": "U_HELPDESK"
}

    Recorded response · HTTP 403

    {
  "runId": "approve-by-stranger-refused-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "AWAITING_APPROVAL",
  "closed": false,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "approve_by_stranger_refused"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 506
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 289
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_15G4PTUK62CMVXI7",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_15G4PTUK62CMVXI7",
        "alert": "SEC-approve-by-stranger-refused"
      },
      "attempts": 1,
      "ref": "cus_15G4PTUK62CMVXI7",
      "appliedAt": "2026-10-22T01:44:38.969Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_OUOLI4AEQ62VL8RN85LDSYIHD4",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "pending_approval",
      "summary": {
        "user": "988a28071f",
        "organization": "4c9b33c0-1f21-4230-a4d8-4595f74549b1",
        "role": "admin",
        "why": "last admin of the organization"
      },
      "attempts": 0,
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-approve-by-stranger-refused",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "bfacd042-eb88-4713-989a-0b48a5d39988",
      "appliedAt": "2026-10-22T01:44:39.099Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "179CC4PNEJ.QE6TI7",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:39.215Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 3,
    "failed": 0,
    "pendingApproval": 1,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:44:39.216Z"
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 0,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:38.323Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:38.831Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:38.834Z",
      "msg": "planned 4 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:44:38.969Z",
      "msg": "stripe.hold_customer:cus_15G4PTUK62CMVXI7: applied"
    },
    {
      "at": "2026-10-22T01:44:39.099Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:39.215Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:39.216Z",
      "msg": "awaiting approval"
    },
    {
      "at": "2026-10-22T01:44:39.430Z",
      "msg": "decision by U_HELPDESK refused: not an approver"
    },
    {
      "at": "2026-10-22T01:44:39.948Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:40.171Z",
      "msg": "decision by U_HELPDESK refused: not an approver"
    }
  ],
  "createdAt": "2026-10-22T01:44:38.323Z",
  "updatedAt": "2026-10-22T01:44:40.171Z",
  "result": "forbidden"
}
  93. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/approve_by_stranger_refused/runs · approve by stranger refused · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/approve_by_stranger_refused/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:40.646337+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "approve-by-stranger-refused-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "AWAITING_APPROVAL",
      "closed": false,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "approve_by_stranger_refused"
      },
      "duplicateStarts": 1,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 506
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 289
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_15G4PTUK62CMVXI7",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_15G4PTUK62CMVXI7",
            "alert": "SEC-approve-by-stranger-refused"
          },
          "attempts": 1,
          "ref": "cus_15G4PTUK62CMVXI7",
          "appliedAt": "2026-10-22T01:44:38.969Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_OUOLI4AEQ62VL8RN85LDSYIHD4",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "approval",
          "status": "pending_approval",
          "summary": {
            "user": "988a28071f",
            "organization": "4c9b33c0-1f21-4230-a4d8-4595f74549b1",
            "role": "admin",
            "why": "last admin of the organization"
          },
          "attempts": 0,
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-approve-by-stranger-refused",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "bfacd042-eb88-4713-989a-0b48a5d39988",
          "appliedAt": "2026-10-22T01:44:39.099Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "179CC4PNEJ.QE6TI7",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:39.215Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 3,
        "failed": 0,
        "pendingApproval": 1,
        "skipped": 0,
        "rejected": 0
      },
      "approval": {
        "approvers": [
          "U_CISO"
        ],
        "expiresAt": "2026-10-23T01:44:39.216Z"
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 0,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:38.323Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:38.831Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:38.834Z",
          "msg": "planned 4 action(s): 1 need approval"
        },
        {
          "at": "2026-10-22T01:44:38.969Z",
          "msg": "stripe.hold_customer:cus_15G4PTUK62CMVXI7: applied"
        },
        {
          "at": "2026-10-22T01:44:39.099Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:39.215Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:39.216Z",
          "msg": "awaiting approval"
        },
        {
          "at": "2026-10-22T01:44:39.430Z",
          "msg": "decision by U_HELPDESK refused: not an approver"
        },
        {
          "at": "2026-10-22T01:44:39.948Z",
          "msg": "duplicate start ignored"
        },
        {
          "at": "2026-10-22T01:44:40.171Z",
          "msg": "decision by U_HELPDESK refused: not an approver"
        }
      ],
      "createdAt": "2026-10-22T01:44:38.323Z",
      "updatedAt": "2026-10-22T01:44:40.171Z"
    }
  ]
}
  94. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/medium_risk_asks_first/runs · medium risk asks first · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/medium_risk_asks_first/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:40.848293+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  95. · POST app request /invocations · medium risk asks first · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "medium-risk-asks-first-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-medium-risk-asks-first",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "new_device"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "medium_risk_asks_first"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:42.017099+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "453",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "medium-risk-asks-first-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-medium-risk-asks-first",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "new_device"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "medium_risk_asks_first"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "medium-risk-asks-first-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "AWAITING_APPROVAL",
  "closed": false,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "medium_risk_asks_first"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 524
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 280
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: medium risk (score 45)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_9E3DUYR8666377LA",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_9E3DUYR8666377LA",
        "alert": "SEC-medium-risk-asks-first"
      },
      "attempts": 1,
      "ref": "cus_9E3DUYR8666377LA",
      "appliedAt": "2026-10-22T01:44:41.572Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_8GAX8UB5HQEME4274FT085NION",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "pending_approval",
      "summary": {
        "user": "a5cc7b7cb6",
        "organization": "925b687a-96dd-44ad-82f5-bad6f2d6e501",
        "role": "admin",
        "why": "risk medium"
      },
      "attempts": 0,
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-medium-risk-asks-first",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "ef9f74a1-e4fe-40dc-9860-29314398dd21",
      "appliedAt": "2026-10-22T01:44:41.704Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17WY25VRZI.OQO06Y",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:41.855Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 3,
    "failed": 0,
    "pendingApproval": 1,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:44:41.856Z"
  },
  "output": {
    "mode": "contain",
    "reason": "medium risk (score 45)",
    "score": 45,
    "level": "medium",
    "removals": 1,
    "removalsAuto": 0,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:40.907Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:41.433Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:41.436Z",
      "msg": "planned 4 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:44:41.573Z",
      "msg": "stripe.hold_customer:cus_9E3DUYR8666377LA: applied"
    },
    {
      "at": "2026-10-22T01:44:41.704Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:41.855Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:41.856Z",
      "msg": "awaiting approval"
    }
  ],
  "createdAt": "2026-10-22T01:44:40.907Z",
  "updatedAt": "2026-10-22T01:44:41.856Z",
  "duplicate": false
}
  96. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request dfd9ccb6e301 · processing 1.7ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.7ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "e53b852b-2a90-4428-9262-14035e751ec3",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/56e82d8d",
      "email_verified": true,
      "external_id": "ext_b92ee947c3a04e6eb3b9695516",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  97. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request 7741c6215969 · processing 14.76ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.76ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_9E3DUYR8666377LA",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 64,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  98. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request f106dc444f33 · processing 0.65ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.65ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "e53b852b-2a90-4428-9262-14035e751ec3",
      "organization_id": "925b687a-96dd-44ad-82f5-bad6f2d6e501",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_8GAX8UB5HQEME4274FT085NION"
    }
  ],
  "list_metadata": {
    "before": "om_8GAX8UB5HQEME4274FT085NION",
    "after": null
  }
}
  99. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request b84345154663 · processing 5.57ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 5.57ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  100. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 908487dc6665 · processing 0.57ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.57ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "579751f1-0ab2-4ae2-b158-e0b72e34bc84",
      "organization_id": "925b687a-96dd-44ad-82f5-bad6f2d6e501",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_O27IXZ603VSN0NI2L1LAD8D87I"
    },
    {
      "object": "organization_membership",
      "user_id": "e53b852b-2a90-4428-9262-14035e751ec3",
      "organization_id": "925b687a-96dd-44ad-82f5-bad6f2d6e501",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_8GAX8UB5HQEME4274FT085NION"
    }
  ],
  "list_metadata": {
    "before": "om_O27IXZ603VSN0NI2L1LAD8D87I",
    "after": null
  }
}
  101. · GET workos request · provider traffic · /user_management/users/e53b852b-2a90-4428-9262-14035e751ec3/sessions · HTTP 200 · request 10f5177675ee · processing 1.5ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/e53b852b-2a90-4428-9262-14035e751ec3/sessions' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.5ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "items": [
    {
      "session_id": "[redacted]",
      "name": "Sample Session 1",
      "id": "65028467-bd15-479d-b741-4630a662fd42"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 2",
      "id": "b0b28c4e-bdc3-4ed9-9483-fdd724aeb3ef"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 3",
      "id": "ab7c709c-c32d-4aa0-911b-52c680ee248f"
    }
  ]
}
  102. · POST stripe request · provider traffic · /v1/customers/cus_9E3DUYR8666377LA · HTTP 200 · request 689e74e0e077 · processing 14.64ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_9E3DUYR8666377LA' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-raw '{
  "metadata": {
    "acme_ato_hold": "SEC-medium-risk-asks-first",
    "acme_ato_hold_at": "2026-10-22T01:44:40.907Z"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.64ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "114",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/x-www-form-urlencoded"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "metadata": {
    "acme_ato_hold": "SEC-medium-risk-asks-first",
    "acme_ato_hold_at": "2026-10-22T01:44:40.907Z"
  }
}

    Recorded response · HTTP 200

    {
  "email": "[email protected]",
  "name": "Robin Customer",
  "id": "cus_9E3DUYR8666377LA",
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 64,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "SEC-medium-risk-asks-first",
    "acme_ato_hold_at": "2026-10-22T01:44:40.907Z"
  }
}
  103. · POST asana request · provider traffic · /tasks · HTTP 201 · request f20153b6c02b · processing 14.93ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-medium-risk-asks-first: account takeover contain (contain)",
    "notes": "Alert SEC-medium-risk-asks-first for user a5cc7b7cb6 from idp-risk: mfa_reset, new_device.\nDecision: contain (medium risk (score 45)).\nScore 45 (medium): mfa_reset +35; new_device +10.\nStripe refund hold on cus_9E3DUYR8666377LA.\nPrivileged memberships removed (restore input):\n- 925b687a-96dd-44ad-82f5-bad6f2d6e501 admin (om_8GAX8UB5HQEME4274FT085NION) approval: risk medium\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-medium-risk-asks-first\",\"memberships\":[{\"organizationId\":\"925b687a-96dd-44ad-82f5-bad6f2d6e501\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.93ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "681",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "data": {
    "name": "SEC-medium-risk-asks-first: account takeover contain (contain)",
    "notes": "Alert SEC-medium-risk-asks-first for user a5cc7b7cb6 from idp-risk: mfa_reset, new_device.\nDecision: contain (medium risk (score 45)).\nScore 45 (medium): mfa_reset +35; new_device +10.\nStripe refund hold on cus_9E3DUYR8666377LA.\nPrivileged memberships removed (restore input):\n- 925b687a-96dd-44ad-82f5-bad6f2d6e501 admin (om_8GAX8UB5HQEME4274FT085NION) approval: risk medium\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-medium-risk-asks-first\",\"memberships\":[{\"organizationId\":\"925b687a-96dd-44ad-82f5-bad6f2d6e501\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}

    Recorded response · HTTP 201

    {
  "data": {
    "name": "SEC-medium-risk-asks-first: account takeover contain (contain)",
    "notes": "Alert SEC-medium-risk-asks-first for user a5cc7b7cb6 from idp-risk: mfa_reset, new_device.\nDecision: contain (medium risk (score 45)).\nScore 45 (medium): mfa_reset +35; new_device +10.\nStripe refund hold on cus_9E3DUYR8666377LA.\nPrivileged memberships removed (restore input):\n- 925b687a-96dd-44ad-82f5-bad6f2d6e501 admin (om_8GAX8UB5HQEME4274FT085NION) approval: risk medium\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-medium-risk-asks-first\",\"memberships\":[{\"organizationId\":\"925b687a-96dd-44ad-82f5-bad6f2d6e501\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  },
  "id": "ef9f74a1-e4fe-40dc-9860-29314398dd21"
}
  104. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request 3fc6fa63cbc1 · processing 13.62ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-medium-risk-asks-first (contain): contain, medium risk (score 45). 1 privileged membership(s). Refunds held. 1 change(s) need approval.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 13.62ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "223",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-medium-risk-asks-first (contain): contain, medium risk (score 45). 1 privileged membership(s). Refunds held. 1 change(s) need approval.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_fc288e22d8874e46a70afd3c17",
    "client_msg_id": "cli_fa321c7ced4c4045ace4b67f0b",
    "name": "item-ea0e05",
    "old_name": "Sample Old",
    "parent_user_id": "par_67150eac22ef4405bc91ce97be",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "17WY25VRZI.OQO06Y"
}
  105. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/medium_risk_asks_first/runs · medium risk asks first · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/medium_risk_asks_first/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:42.328204+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "medium-risk-asks-first-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "AWAITING_APPROVAL",
      "closed": false,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "medium_risk_asks_first"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 524
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 280
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: medium risk (score 45)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_9E3DUYR8666377LA",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_9E3DUYR8666377LA",
            "alert": "SEC-medium-risk-asks-first"
          },
          "attempts": 1,
          "ref": "cus_9E3DUYR8666377LA",
          "appliedAt": "2026-10-22T01:44:41.572Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_8GAX8UB5HQEME4274FT085NION",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "approval",
          "status": "pending_approval",
          "summary": {
            "user": "a5cc7b7cb6",
            "organization": "925b687a-96dd-44ad-82f5-bad6f2d6e501",
            "role": "admin",
            "why": "risk medium"
          },
          "attempts": 0,
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-medium-risk-asks-first",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "ef9f74a1-e4fe-40dc-9860-29314398dd21",
          "appliedAt": "2026-10-22T01:44:41.704Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17WY25VRZI.OQO06Y",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:41.855Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 3,
        "failed": 0,
        "pendingApproval": 1,
        "skipped": 0,
        "rejected": 0
      },
      "approval": {
        "approvers": [
          "U_CISO"
        ],
        "expiresAt": "2026-10-23T01:44:41.856Z"
      },
      "output": {
        "mode": "contain",
        "reason": "medium risk (score 45)",
        "score": 45,
        "level": "medium",
        "removals": 1,
        "removalsAuto": 0,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:40.907Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:41.433Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:41.436Z",
          "msg": "planned 4 action(s): 1 need approval"
        },
        {
          "at": "2026-10-22T01:44:41.573Z",
          "msg": "stripe.hold_customer:cus_9E3DUYR8666377LA: applied"
        },
        {
          "at": "2026-10-22T01:44:41.704Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:41.855Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:41.856Z",
          "msg": "awaiting approval"
        }
      ],
      "createdAt": "2026-10-22T01:44:40.907Z",
      "updatedAt": "2026-10-22T01:44:41.856Z"
    }
  ]
}
  106. · POST app request /invocations · medium risk asks first · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "medium-risk-asks-first-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-medium-risk-asks-first",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "new_device"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "medium_risk_asks_first"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:42.541002+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "453",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "medium-risk-asks-first-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-medium-risk-asks-first",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "new_device"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "medium_risk_asks_first"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "medium-risk-asks-first-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "AWAITING_APPROVAL",
  "closed": false,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "medium_risk_asks_first"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 524
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 280
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: medium risk (score 45)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_9E3DUYR8666377LA",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_9E3DUYR8666377LA",
        "alert": "SEC-medium-risk-asks-first"
      },
      "attempts": 1,
      "ref": "cus_9E3DUYR8666377LA",
      "appliedAt": "2026-10-22T01:44:41.572Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_8GAX8UB5HQEME4274FT085NION",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "pending_approval",
      "summary": {
        "user": "a5cc7b7cb6",
        "organization": "925b687a-96dd-44ad-82f5-bad6f2d6e501",
        "role": "admin",
        "why": "risk medium"
      },
      "attempts": 0,
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-medium-risk-asks-first",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "ef9f74a1-e4fe-40dc-9860-29314398dd21",
      "appliedAt": "2026-10-22T01:44:41.704Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17WY25VRZI.OQO06Y",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:41.855Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 3,
    "failed": 0,
    "pendingApproval": 1,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:44:41.856Z"
  },
  "output": {
    "mode": "contain",
    "reason": "medium risk (score 45)",
    "score": 45,
    "level": "medium",
    "removals": 1,
    "removalsAuto": 0,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:40.907Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:41.433Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:41.436Z",
      "msg": "planned 4 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:44:41.573Z",
      "msg": "stripe.hold_customer:cus_9E3DUYR8666377LA: applied"
    },
    {
      "at": "2026-10-22T01:44:41.704Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:41.855Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:41.856Z",
      "msg": "awaiting approval"
    },
    {
      "at": "2026-10-22T01:44:42.374Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:40.907Z",
  "updatedAt": "2026-10-22T01:44:42.374Z",
  "duplicate": true
}
  107. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/medium_risk_asks_first/runs · medium risk asks first · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/medium_risk_asks_first/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:42.847023+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "medium-risk-asks-first-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "AWAITING_APPROVAL",
      "closed": false,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "medium_risk_asks_first"
      },
      "duplicateStarts": 1,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 524
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 280
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: medium risk (score 45)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_9E3DUYR8666377LA",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_9E3DUYR8666377LA",
            "alert": "SEC-medium-risk-asks-first"
          },
          "attempts": 1,
          "ref": "cus_9E3DUYR8666377LA",
          "appliedAt": "2026-10-22T01:44:41.572Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_8GAX8UB5HQEME4274FT085NION",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "approval",
          "status": "pending_approval",
          "summary": {
            "user": "a5cc7b7cb6",
            "organization": "925b687a-96dd-44ad-82f5-bad6f2d6e501",
            "role": "admin",
            "why": "risk medium"
          },
          "attempts": 0,
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-medium-risk-asks-first",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "ef9f74a1-e4fe-40dc-9860-29314398dd21",
          "appliedAt": "2026-10-22T01:44:41.704Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17WY25VRZI.OQO06Y",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:41.855Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 3,
        "failed": 0,
        "pendingApproval": 1,
        "skipped": 0,
        "rejected": 0
      },
      "approval": {
        "approvers": [
          "U_CISO"
        ],
        "expiresAt": "2026-10-23T01:44:41.856Z"
      },
      "output": {
        "mode": "contain",
        "reason": "medium risk (score 45)",
        "score": 45,
        "level": "medium",
        "removals": 1,
        "removalsAuto": 0,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:40.907Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:41.433Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:41.436Z",
          "msg": "planned 4 action(s): 1 need approval"
        },
        {
          "at": "2026-10-22T01:44:41.573Z",
          "msg": "stripe.hold_customer:cus_9E3DUYR8666377LA: applied"
        },
        {
          "at": "2026-10-22T01:44:41.704Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:41.855Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:41.856Z",
          "msg": "awaiting approval"
        },
        {
          "at": "2026-10-22T01:44:42.374Z",
          "msg": "duplicate start ignored"
        }
      ],
      "createdAt": "2026-10-22T01:44:40.907Z",
      "updatedAt": "2026-10-22T01:44:42.374Z"
    }
  ]
}
  108. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/low_risk_monitors/runs · low risk monitors · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/low_risk_monitors/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:43.055596+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  109. · POST app request /invocations · low risk monitors · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "low-risk-monitors-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-low-risk-monitors",
    "email": "[email protected]",
    "signals": [
      "new_device"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "low_risk_monitors"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:43.886556+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "421",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "low-risk-monitors-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-low-risk-monitors",
    "email": "[email protected]",
    "signals": [
      "new_device"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "low_risk_monitors"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "low-risk-monitors-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "low_risk_monitors"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 493
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 330
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "monitor: score 10 below 40",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "monitor"
      },
      "attempts": 1,
      "ref": "17TU55FWRC.W8JEZ2",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:43.731Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 1,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "monitor",
    "reason": "score 10 below 40",
    "score": 10,
    "level": "low",
    "removals": 0,
    "removalsAuto": 0,
    "holds": 0,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:43.103Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:43.597Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:43.599Z",
      "msg": "planned 1 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:43.731Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:43.732Z",
      "msg": "done (ok)"
    }
  ],
  "createdAt": "2026-10-22T01:44:43.103Z",
  "updatedAt": "2026-10-22T01:44:43.732Z",
  "duplicate": false
}
  110. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request 899c2980402a · processing 15.25ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 15.25ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_3QK1FRACSRE21KGO",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 56,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  111. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request 4e282872ea40 · processing 1.83ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.83ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "be2f6e90-61ee-4a3c-b27b-278bd7568391",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/71c45c91",
      "email_verified": true,
      "external_id": "ext_defd49f68dc0488591fc5efa71",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  112. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 264d9feaeb89 · processing 1.23ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.23ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "be2f6e90-61ee-4a3c-b27b-278bd7568391",
      "organization_id": "de237b61-98a7-44f7-b544-333bebf0f6fa",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_PFDQ6MF2BTC3R1ELZ8E4DIRZQR"
    }
  ],
  "list_metadata": {
    "before": "om_PFDQ6MF2BTC3R1ELZ8E4DIRZQR",
    "after": null
  }
}
  113. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request 8fe70133d2fe · processing 9.15ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 9.15ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  114. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request c314135696b7 · processing 0.68ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.68ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "be2f6e90-61ee-4a3c-b27b-278bd7568391",
      "organization_id": "de237b61-98a7-44f7-b544-333bebf0f6fa",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_PFDQ6MF2BTC3R1ELZ8E4DIRZQR"
    },
    {
      "object": "organization_membership",
      "user_id": "5986ff9b-3f92-4325-9dd3-59e387787b3e",
      "organization_id": "de237b61-98a7-44f7-b544-333bebf0f6fa",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_6LH7XOOL2CJA8KUJVIDFTBVRDD"
    }
  ],
  "list_metadata": {
    "before": "om_PFDQ6MF2BTC3R1ELZ8E4DIRZQR",
    "after": null
  }
}
  115. · GET workos request · provider traffic · /user_management/users/be2f6e90-61ee-4a3c-b27b-278bd7568391/sessions · HTTP 200 · request 1394c116227f · processing 2.36ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/be2f6e90-61ee-4a3c-b27b-278bd7568391/sessions' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 2.36ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "items": [
    {
      "session_id": "[redacted]",
      "name": "Sample Session 1",
      "id": "65028467-bd15-479d-b741-4630a662fd42"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 2",
      "id": "b0b28c4e-bdc3-4ed9-9483-fdd724aeb3ef"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 3",
      "id": "ab7c709c-c32d-4aa0-911b-52c680ee248f"
    }
  ]
}
  116. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request a4c48932faf1 · processing 13.88ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":eyes: SEC-low-risk-monitors (contain): monitor, score 10 below 40.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 13.88ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "144",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":eyes: SEC-low-risk-monitors (contain): monitor, score 10 below 40.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_4bd6a96570cf4009921ae11976",
    "client_msg_id": "cli_e51f31012dcb41be83e809e563",
    "name": "item-09c21d",
    "old_name": "Sample Old",
    "parent_user_id": "par_887f03aaf53540268e6ad9f267",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "17TU55FWRC.W8JEZ2"
}
  117. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/low_risk_monitors/runs · low risk monitors · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/low_risk_monitors/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:44.196060+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "low-risk-monitors-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "low_risk_monitors"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 493
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 330
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "monitor: score 10 below 40",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "monitor"
          },
          "attempts": 1,
          "ref": "17TU55FWRC.W8JEZ2",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:43.731Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 1,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "monitor",
        "reason": "score 10 below 40",
        "score": 10,
        "level": "low",
        "removals": 0,
        "removalsAuto": 0,
        "holds": 0,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:43.103Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:43.597Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:43.599Z",
          "msg": "planned 1 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:44:43.731Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:43.732Z",
          "msg": "done (ok)"
        }
      ],
      "createdAt": "2026-10-22T01:44:43.103Z",
      "updatedAt": "2026-10-22T01:44:43.732Z"
    }
  ]
}
  118. · POST app request /invocations · low risk monitors · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "low-risk-monitors-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-low-risk-monitors",
    "email": "[email protected]",
    "signals": [
      "new_device"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "low_risk_monitors"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:44.398869+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "421",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "low-risk-monitors-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-low-risk-monitors",
    "email": "[email protected]",
    "signals": [
      "new_device"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "low_risk_monitors"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "low-risk-monitors-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "low_risk_monitors"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 493
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 330
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "monitor: score 10 below 40",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "monitor"
      },
      "attempts": 1,
      "ref": "17TU55FWRC.W8JEZ2",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:43.731Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 1,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "monitor",
    "reason": "score 10 below 40",
    "score": 10,
    "level": "low",
    "removals": 0,
    "removalsAuto": 0,
    "holds": 0,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:43.103Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:43.597Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:43.599Z",
      "msg": "planned 1 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:43.731Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:43.732Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:44:44.243Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:43.103Z",
  "updatedAt": "2026-10-22T01:44:44.243Z",
  "duplicate": true
}
  119. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/low_risk_monitors/runs · low risk monitors · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/low_risk_monitors/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:44.705774+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "low-risk-monitors-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "low_risk_monitors"
      },
      "duplicateStarts": 1,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 493
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 330
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "monitor: score 10 below 40",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "monitor"
          },
          "attempts": 1,
          "ref": "17TU55FWRC.W8JEZ2",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:43.731Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 1,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "monitor",
        "reason": "score 10 below 40",
        "score": 10,
        "level": "low",
        "removals": 0,
        "removalsAuto": 0,
        "holds": 0,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:43.103Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:43.597Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:43.599Z",
          "msg": "planned 1 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:44:43.731Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:43.732Z",
          "msg": "done (ok)"
        },
        {
          "at": "2026-10-22T01:44:44.243Z",
          "msg": "duplicate start ignored"
        }
      ],
      "createdAt": "2026-10-22T01:44:43.103Z",
      "updatedAt": "2026-10-22T01:44:44.243Z"
    }
  ]
}
  120. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/refund_spike_escalates/runs · refund spike escalates · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/refund_spike_escalates/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:44.912882+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  121. · POST app request /invocations · refund spike escalates · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "refund-spike-escalates-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-refund-spike-escalates",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "new_device"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "refund_spike_escalates"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:46.868125+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "453",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "refund-spike-escalates-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-refund-spike-escalates",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "new_device"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "refund_spike_escalates"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "refund-spike-escalates-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "refund_spike_escalates"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 906
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 1 refund(s) in 24 h",
      "durationMs": 873
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 70)",
      "durationMs": 36
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_X2STEJTPT9VU68WG",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_X2STEJTPT9VU68WG",
        "alert": "SEC-refund-spike-escalates"
      },
      "attempts": 1,
      "ref": "cus_X2STEJTPT9VU68WG",
      "appliedAt": "2026-10-22T01:44:46.034Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_55IOL1RSMQC6H8ECOU0388Q2I4",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "073e939554",
        "organization": "1b339f7a-8c7b-4d95-a94b-5076c5d85c1e",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_55IOL1RSMQC6H8ECOU0388Q2I4",
      "detail": {
        "organizationId": "1b339f7a-8c7b-4d95-a94b-5076c5d85c1e",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:46.389Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-refund-spike-escalates",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "c9e1df7a-1c86-46a6-92f1-2ce0d2c9b064",
      "appliedAt": "2026-10-22T01:44:46.574Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17GW4VM2DQ.JK7EN6",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:46.709Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 70)",
    "score": 70,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:44.950Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:45.858Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:45.896Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:46.034Z",
      "msg": "stripe.hold_customer:cus_X2STEJTPT9VU68WG: applied"
    },
    {
      "at": "2026-10-22T01:44:46.389Z",
      "msg": "workos.remove_membership:om_55IOL1RSMQC6H8ECOU0388Q2I4: applied"
    },
    {
      "at": "2026-10-22T01:44:46.575Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:46.709Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:46.710Z",
      "msg": "done (ok)"
    }
  ],
  "createdAt": "2026-10-22T01:44:44.950Z",
  "updatedAt": "2026-10-22T01:44:46.710Z",
  "duplicate": false
}
  122. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request 68ee0b2a864e · processing 21.28ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 21.28ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_X2STEJTPT9VU68WG",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 35,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  123. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request f3ed3be3969e · processing 1.91ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.91ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "f3c1fd51-fba8-423f-a2e4-01fb47cce656",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/c0758373",
      "email_verified": true,
      "external_id": "ext_940cc9f9c4484ec48b0cd87557",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  124. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request f4d8876310c7 · processing 0.55ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.55ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "f3c1fd51-fba8-423f-a2e4-01fb47cce656",
      "organization_id": "1b339f7a-8c7b-4d95-a94b-5076c5d85c1e",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_55IOL1RSMQC6H8ECOU0388Q2I4"
    }
  ],
  "list_metadata": {
    "before": "om_55IOL1RSMQC6H8ECOU0388Q2I4",
    "after": null
  }
}
  125. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request 40d5434bcfcd · processing 452.42ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 452.42ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "amount": 60000,
      "currency": "usd",
      "customer": "cus_X2STEJTPT9VU68WG",
      "payment_method": "pm_CVQWPWP4V0B0GYJ89AI14N9A",
      "object": "payment_intent",
      "status": "succeeded",
      "amount_capturable": 0,
      "amount_received": 60000,
      "latest_charge": "ch_X1YKVUQIH215AVJRNYFZDUN2",
      "next_action": null,
      "last_payment_error": null,
      "canceled_at": null,
      "cancellation_reason": null,
      "capture_method": "automatic_async",
      "confirmation_method": "automatic",
      "payment_method_types": [
        "card"
      ],
      "livemode": false,
      "created": 1792633372,
      "metadata": {},
      "description": null,
      "receipt_email": null,
      "id": "pi_BF98R3BU4DUZMIWWLUCMO7HM",
      "application": null,
      "application_fee_amount": null,
      "automatic_payment_methods": null,
      "client_secret": "[redacted]",
      "customer_account": null,
      "excluded_payment_method_types": null,
      "on_behalf_of": null,
      "payment_method_configuration_details": null,
      "payment_method_options": null,
      "processing": null,
      "review": null,
      "setup_future_usage": "off_session",
      "shipping": null,
      "statement_descriptor": null,
      "statement_descriptor_suffix": null,
      "transfer_data": null,
      "transfer_group": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  126. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request a6bee9a8c69d · processing 0.57ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.57ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "e30e1ab7-6fc3-4648-82fb-77bf39285e8e",
      "organization_id": "1b339f7a-8c7b-4d95-a94b-5076c5d85c1e",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_KXCN2A653Y3GV8SJQFAMLSMVGB"
    },
    {
      "object": "organization_membership",
      "user_id": "f3c1fd51-fba8-423f-a2e4-01fb47cce656",
      "organization_id": "1b339f7a-8c7b-4d95-a94b-5076c5d85c1e",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_55IOL1RSMQC6H8ECOU0388Q2I4"
    }
  ],
  "list_metadata": {
    "before": "om_KXCN2A653Y3GV8SJQFAMLSMVGB",
    "after": null
  }
}
  127. · GET stripe request · provider traffic · /v1/refunds · HTTP 200 · request 54a1067ea753 · processing 4.46ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/refunds' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 4.46ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "payment_intent": "pi_BF98R3BU4DUZMIWWLUCMO7HM",
      "amount": 60000,
      "object": "refund",
      "status": "succeeded",
      "currency": "usd",
      "charge": "ch_X1YKVUQIH215AVJRNYFZDUN2",
      "customer": "cus_X2STEJTPT9VU68WG",
      "created": 1792633372,
      "metadata": {},
      "reason": null,
      "receipt_number": null,
      "source_transfer_reversal": null,
      "transfer_reversal": null,
      "balance_transaction": null,
      "id": "re_GJPGYJOYQE2TFVWY639I6F68"
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/refunds"
}
  128. · GET workos request · provider traffic · /user_management/users/f3c1fd51-fba8-423f-a2e4-01fb47cce656/sessions · HTTP 200 · request a32573cf9e5b · processing 1.46ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/f3c1fd51-fba8-423f-a2e4-01fb47cce656/sessions' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.46ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "items": [
    {
      "session_id": "[redacted]",
      "name": "Sample Session 1",
      "id": "65028467-bd15-479d-b741-4630a662fd42"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 2",
      "id": "b0b28c4e-bdc3-4ed9-9483-fdd724aeb3ef"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 3",
      "id": "ab7c709c-c32d-4aa0-911b-52c680ee248f"
    }
  ]
}
  129. · POST stripe request · provider traffic · /v1/customers/cus_X2STEJTPT9VU68WG · HTTP 200 · request 5aa105f3872f · processing 16.23ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_X2STEJTPT9VU68WG' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-raw '{
  "metadata": {
    "acme_ato_hold": "SEC-refund-spike-escalates",
    "acme_ato_hold_at": "2026-10-22T01:44:44.950Z"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 16.23ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "114",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/x-www-form-urlencoded"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "metadata": {
    "acme_ato_hold": "SEC-refund-spike-escalates",
    "acme_ato_hold_at": "2026-10-22T01:44:44.950Z"
  }
}

    Recorded response · HTTP 200

    {
  "email": "[email protected]",
  "name": "Robin Customer",
  "id": "cus_X2STEJTPT9VU68WG",
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 35,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "SEC-refund-spike-escalates",
    "acme_ato_hold_at": "2026-10-22T01:44:44.950Z"
  }
}
  130. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 6ee20473ff30 · processing 0.56ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.56ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "f3c1fd51-fba8-423f-a2e4-01fb47cce656",
      "organization_id": "1b339f7a-8c7b-4d95-a94b-5076c5d85c1e",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_55IOL1RSMQC6H8ECOU0388Q2I4"
    }
  ],
  "list_metadata": {
    "before": "om_55IOL1RSMQC6H8ECOU0388Q2I4",
    "after": null
  }
}
  131. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 0cf5eaf350dd · processing 0.64ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.64ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "e30e1ab7-6fc3-4648-82fb-77bf39285e8e",
      "organization_id": "1b339f7a-8c7b-4d95-a94b-5076c5d85c1e",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_KXCN2A653Y3GV8SJQFAMLSMVGB"
    },
    {
      "object": "organization_membership",
      "user_id": "f3c1fd51-fba8-423f-a2e4-01fb47cce656",
      "organization_id": "1b339f7a-8c7b-4d95-a94b-5076c5d85c1e",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_55IOL1RSMQC6H8ECOU0388Q2I4"
    }
  ],
  "list_metadata": {
    "before": "om_KXCN2A653Y3GV8SJQFAMLSMVGB",
    "after": null
  }
}
  132. · DELETE workos request · provider traffic · /user_management/organization_memberships/om_55IOL1RSMQC6H8ECOU0388Q2I4 · HTTP 204 · request 20249a4e6deb · processing 0.81ms
  133. · POST asana request · provider traffic · /tasks · HTTP 201 · request ea4908cc6116 · processing 14.85ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-refund-spike-escalates: account takeover contain (contain)",
    "notes": "Alert SEC-refund-spike-escalates for user 073e939554 from idp-risk: mfa_reset, new_device.\nDecision: contain (high risk (score 70)).\nScore 70 (high): mfa_reset +35; new_device +10; refund spike (1 refunds, $600.00 in 24 h) +25.\nStripe refund hold on cus_X2STEJTPT9VU68WG.\nPrivileged memberships removed (restore input):\n- 1b339f7a-8c7b-4d95-a94b-5076c5d85c1e admin (om_55IOL1RSMQC6H8ECOU0388Q2I4) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-refund-spike-escalates\",\"memberships\":[{\"organizationId\":\"1b339f7a-8c7b-4d95-a94b-5076c5d85c1e\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.85ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "718",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "data": {
    "name": "SEC-refund-spike-escalates: account takeover contain (contain)",
    "notes": "Alert SEC-refund-spike-escalates for user 073e939554 from idp-risk: mfa_reset, new_device.\nDecision: contain (high risk (score 70)).\nScore 70 (high): mfa_reset +35; new_device +10; refund spike (1 refunds, $600.00 in 24 h) +25.\nStripe refund hold on cus_X2STEJTPT9VU68WG.\nPrivileged memberships removed (restore input):\n- 1b339f7a-8c7b-4d95-a94b-5076c5d85c1e admin (om_55IOL1RSMQC6H8ECOU0388Q2I4) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-refund-spike-escalates\",\"memberships\":[{\"organizationId\":\"1b339f7a-8c7b-4d95-a94b-5076c5d85c1e\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}

    Recorded response · HTTP 201

    {
  "data": {
    "name": "SEC-refund-spike-escalates: account takeover contain (contain)",
    "notes": "Alert SEC-refund-spike-escalates for user 073e939554 from idp-risk: mfa_reset, new_device.\nDecision: contain (high risk (score 70)).\nScore 70 (high): mfa_reset +35; new_device +10; refund spike (1 refunds, $600.00 in 24 h) +25.\nStripe refund hold on cus_X2STEJTPT9VU68WG.\nPrivileged memberships removed (restore input):\n- 1b339f7a-8c7b-4d95-a94b-5076c5d85c1e admin (om_55IOL1RSMQC6H8ECOU0388Q2I4) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-refund-spike-escalates\",\"memberships\":[{\"organizationId\":\"1b339f7a-8c7b-4d95-a94b-5076c5d85c1e\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  },
  "id": "c9e1df7a-1c86-46a6-92f1-2ce0d2c9b064"
}
  134. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request 12ed5722cae2 · processing 14.01ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-refund-spike-escalates (contain): contain, high risk (score 70). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.01ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "194",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-refund-spike-escalates (contain): contain, high risk (score 70). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_c624358ded674957a90b33164a",
    "client_msg_id": "cli_7044098f67ee4179ad8a9e95ff",
    "name": "item-34e84f",
    "old_name": "Sample Old",
    "parent_user_id": "par_2e0b1e1a743f405ca4eb6acdf9",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "17GW4VM2DQ.JK7EN6"
}
  135. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/refund_spike_escalates/runs · refund spike escalates · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/refund_spike_escalates/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:47.285607+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "refund-spike-escalates-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "refund_spike_escalates"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 906
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 1 refund(s) in 24 h",
          "durationMs": 873
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 70)",
          "durationMs": 36
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_X2STEJTPT9VU68WG",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_X2STEJTPT9VU68WG",
            "alert": "SEC-refund-spike-escalates"
          },
          "attempts": 1,
          "ref": "cus_X2STEJTPT9VU68WG",
          "appliedAt": "2026-10-22T01:44:46.034Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_55IOL1RSMQC6H8ECOU0388Q2I4",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "073e939554",
            "organization": "1b339f7a-8c7b-4d95-a94b-5076c5d85c1e",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_55IOL1RSMQC6H8ECOU0388Q2I4",
          "detail": {
            "organizationId": "1b339f7a-8c7b-4d95-a94b-5076c5d85c1e",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:46.389Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-refund-spike-escalates",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "c9e1df7a-1c86-46a6-92f1-2ce0d2c9b064",
          "appliedAt": "2026-10-22T01:44:46.574Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17GW4VM2DQ.JK7EN6",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:46.709Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 70)",
        "score": 70,
        "level": "high",
        "removals": 1,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:44.950Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:45.858Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:45.896Z",
          "msg": "planned 4 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:44:46.034Z",
          "msg": "stripe.hold_customer:cus_X2STEJTPT9VU68WG: applied"
        },
        {
          "at": "2026-10-22T01:44:46.389Z",
          "msg": "workos.remove_membership:om_55IOL1RSMQC6H8ECOU0388Q2I4: applied"
        },
        {
          "at": "2026-10-22T01:44:46.575Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:46.709Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:46.710Z",
          "msg": "done (ok)"
        }
      ],
      "createdAt": "2026-10-22T01:44:44.950Z",
      "updatedAt": "2026-10-22T01:44:46.710Z"
    }
  ]
}
  136. · POST app request /invocations · refund spike escalates · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "refund-spike-escalates-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-refund-spike-escalates",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "new_device"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "refund_spike_escalates"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:47.488072+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "453",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "refund-spike-escalates-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-refund-spike-escalates",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "new_device"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "refund_spike_escalates"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "refund-spike-escalates-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "refund_spike_escalates"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 906
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 1 refund(s) in 24 h",
      "durationMs": 873
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 70)",
      "durationMs": 36
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_X2STEJTPT9VU68WG",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_X2STEJTPT9VU68WG",
        "alert": "SEC-refund-spike-escalates"
      },
      "attempts": 1,
      "ref": "cus_X2STEJTPT9VU68WG",
      "appliedAt": "2026-10-22T01:44:46.034Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_55IOL1RSMQC6H8ECOU0388Q2I4",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "073e939554",
        "organization": "1b339f7a-8c7b-4d95-a94b-5076c5d85c1e",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_55IOL1RSMQC6H8ECOU0388Q2I4",
      "detail": {
        "organizationId": "1b339f7a-8c7b-4d95-a94b-5076c5d85c1e",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:46.389Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-refund-spike-escalates",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "c9e1df7a-1c86-46a6-92f1-2ce0d2c9b064",
      "appliedAt": "2026-10-22T01:44:46.574Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17GW4VM2DQ.JK7EN6",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:46.709Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 70)",
    "score": 70,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:44.950Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:45.858Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:45.896Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:46.034Z",
      "msg": "stripe.hold_customer:cus_X2STEJTPT9VU68WG: applied"
    },
    {
      "at": "2026-10-22T01:44:46.389Z",
      "msg": "workos.remove_membership:om_55IOL1RSMQC6H8ECOU0388Q2I4: applied"
    },
    {
      "at": "2026-10-22T01:44:46.575Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:46.709Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:46.710Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:44:47.317Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:44.950Z",
  "updatedAt": "2026-10-22T01:44:47.317Z",
  "duplicate": true
}
  137. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/refund_spike_escalates/runs · refund spike escalates · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/refund_spike_escalates/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:47.829001+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "refund-spike-escalates-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "refund_spike_escalates"
      },
      "duplicateStarts": 1,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 906
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 1 refund(s) in 24 h",
          "durationMs": 873
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 70)",
          "durationMs": 36
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_X2STEJTPT9VU68WG",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_X2STEJTPT9VU68WG",
            "alert": "SEC-refund-spike-escalates"
          },
          "attempts": 1,
          "ref": "cus_X2STEJTPT9VU68WG",
          "appliedAt": "2026-10-22T01:44:46.034Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_55IOL1RSMQC6H8ECOU0388Q2I4",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "073e939554",
            "organization": "1b339f7a-8c7b-4d95-a94b-5076c5d85c1e",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_55IOL1RSMQC6H8ECOU0388Q2I4",
          "detail": {
            "organizationId": "1b339f7a-8c7b-4d95-a94b-5076c5d85c1e",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:46.389Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-refund-spike-escalates",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "c9e1df7a-1c86-46a6-92f1-2ce0d2c9b064",
          "appliedAt": "2026-10-22T01:44:46.574Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17GW4VM2DQ.JK7EN6",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:46.709Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 70)",
        "score": 70,
        "level": "high",
        "removals": 1,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:44.950Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:45.858Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:45.896Z",
          "msg": "planned 4 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:44:46.034Z",
          "msg": "stripe.hold_customer:cus_X2STEJTPT9VU68WG: applied"
        },
        {
          "at": "2026-10-22T01:44:46.389Z",
          "msg": "workos.remove_membership:om_55IOL1RSMQC6H8ECOU0388Q2I4: applied"
        },
        {
          "at": "2026-10-22T01:44:46.575Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:46.709Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:46.710Z",
          "msg": "done (ok)"
        },
        {
          "at": "2026-10-22T01:44:47.317Z",
          "msg": "duplicate start ignored"
        }
      ],
      "createdAt": "2026-10-22T01:44:44.950Z",
      "updatedAt": "2026-10-22T01:44:47.317Z"
    }
  ]
}
  138. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/rerun_finds_contained/runs · rerun finds contained · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/rerun_finds_contained/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:48.033743+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  139. · POST app request /invocations · rerun finds contained · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "rerun-finds-contained-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-rerun-finds-contained",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "rerun_finds_contained"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:49.410249+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "457",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "rerun-finds-contained-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-rerun-finds-contained",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "rerun_finds_contained"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "rerun-finds-contained-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "rerun_finds_contained"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "2 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 452
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 316
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_T2S0QBDBM7VGXR8I",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_T2S0QBDBM7VGXR8I",
        "alert": "SEC-rerun-finds-contained"
      },
      "attempts": 1,
      "ref": "cus_T2S0QBDBM7VGXR8I",
      "appliedAt": "2026-10-22T01:44:48.675Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_JJ927XXYTYZ86W2XP4YBJDQEBV",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "725a48f83a",
        "organization": "9f8e7720-56e1-4bf0-97c4-211d3b4fbdf0",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_JJ927XXYTYZ86W2XP4YBJDQEBV",
      "detail": {
        "organizationId": "9f8e7720-56e1-4bf0-97c4-211d3b4fbdf0",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:49.004Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-rerun-finds-contained",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "670d3a93-f178-45bc-9ebf-48a9d3ad9d97",
      "appliedAt": "2026-10-22T01:44:49.126Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17N0OCL6AZ.VCSKNT",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:49.252Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:48.076Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:48.531Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:48.533Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:48.676Z",
      "msg": "stripe.hold_customer:cus_T2S0QBDBM7VGXR8I: applied"
    },
    {
      "at": "2026-10-22T01:44:49.004Z",
      "msg": "workos.remove_membership:om_JJ927XXYTYZ86W2XP4YBJDQEBV: applied"
    },
    {
      "at": "2026-10-22T01:44:49.126Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:49.252Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:49.253Z",
      "msg": "done (ok)"
    }
  ],
  "createdAt": "2026-10-22T01:44:48.076Z",
  "updatedAt": "2026-10-22T01:44:49.253Z",
  "duplicate": false
}
  140. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request c180e1173015 · processing 1.72ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.72ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "de67efdb-ba3f-4f0a-a78a-0974c100cee9",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/69d8f3d4",
      "email_verified": true,
      "external_id": "ext_3f1d1e01c1784d388ed0376fe2",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  141. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request 2d9354ec1aa7 · processing 15.3ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 15.3ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_T2S0QBDBM7VGXR8I",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 57,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  142. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 99907cf9a9c1 · processing 0.58ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.58ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "de67efdb-ba3f-4f0a-a78a-0974c100cee9",
      "organization_id": "96b8d7a4-d86b-4765-a311-84bad0404211",
      "status": "active",
      "role": {
        "slug": "member"
      },
      "roles": [
        {
          "slug": "member"
        }
      ],
      "id": "om_KVCQFHPXG839VXHTQH613GV5TE"
    },
    {
      "object": "organization_membership",
      "user_id": "de67efdb-ba3f-4f0a-a78a-0974c100cee9",
      "organization_id": "9f8e7720-56e1-4bf0-97c4-211d3b4fbdf0",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_JJ927XXYTYZ86W2XP4YBJDQEBV"
    }
  ],
  "list_metadata": {
    "before": "om_KVCQFHPXG839VXHTQH613GV5TE",
    "after": null
  }
}
  143. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request 7e44bbe375b3 · processing 5.5ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 5.5ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  144. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 455d19b13bcb · processing 0.58ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.58ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "9025b7e8-dea1-447e-9b63-0cab81f347aa",
      "organization_id": "9f8e7720-56e1-4bf0-97c4-211d3b4fbdf0",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_R9HSR5XU19GIXJQIOPJALZ3R2J"
    },
    {
      "object": "organization_membership",
      "user_id": "de67efdb-ba3f-4f0a-a78a-0974c100cee9",
      "organization_id": "9f8e7720-56e1-4bf0-97c4-211d3b4fbdf0",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_JJ927XXYTYZ86W2XP4YBJDQEBV"
    }
  ],
  "list_metadata": {
    "before": "om_R9HSR5XU19GIXJQIOPJALZ3R2J",
    "after": null
  }
}
  145. · GET workos request · provider traffic · /user_management/users/de67efdb-ba3f-4f0a-a78a-0974c100cee9/sessions · HTTP 200 · request a65fc41a1f42 · processing 1.44ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/de67efdb-ba3f-4f0a-a78a-0974c100cee9/sessions' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.44ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "items": [
    {
      "session_id": "[redacted]",
      "name": "Sample Session 1",
      "id": "65028467-bd15-479d-b741-4630a662fd42"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 2",
      "id": "b0b28c4e-bdc3-4ed9-9483-fdd724aeb3ef"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 3",
      "id": "ab7c709c-c32d-4aa0-911b-52c680ee248f"
    }
  ]
}
  146. · POST stripe request · provider traffic · /v1/customers/cus_T2S0QBDBM7VGXR8I · HTTP 200 · request 42a4de4b78bd · processing 16.01ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_T2S0QBDBM7VGXR8I' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-raw '{
  "metadata": {
    "acme_ato_hold": "SEC-rerun-finds-contained",
    "acme_ato_hold_at": "2026-10-22T01:44:48.076Z"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 16.01ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "113",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/x-www-form-urlencoded"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "metadata": {
    "acme_ato_hold": "SEC-rerun-finds-contained",
    "acme_ato_hold_at": "2026-10-22T01:44:48.076Z"
  }
}

    Recorded response · HTTP 200

    {
  "email": "[email protected]",
  "name": "Robin Customer",
  "id": "cus_T2S0QBDBM7VGXR8I",
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 57,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "SEC-rerun-finds-contained",
    "acme_ato_hold_at": "2026-10-22T01:44:48.076Z"
  }
}
  147. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request f7cbce663d0b · processing 0.57ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.57ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "de67efdb-ba3f-4f0a-a78a-0974c100cee9",
      "organization_id": "96b8d7a4-d86b-4765-a311-84bad0404211",
      "status": "active",
      "role": {
        "slug": "member"
      },
      "roles": [
        {
          "slug": "member"
        }
      ],
      "id": "om_KVCQFHPXG839VXHTQH613GV5TE"
    },
    {
      "object": "organization_membership",
      "user_id": "de67efdb-ba3f-4f0a-a78a-0974c100cee9",
      "organization_id": "9f8e7720-56e1-4bf0-97c4-211d3b4fbdf0",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_JJ927XXYTYZ86W2XP4YBJDQEBV"
    }
  ],
  "list_metadata": {
    "before": "om_KVCQFHPXG839VXHTQH613GV5TE",
    "after": null
  }
}
  148. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 70a520e48872 · processing 0.64ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.64ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "9025b7e8-dea1-447e-9b63-0cab81f347aa",
      "organization_id": "9f8e7720-56e1-4bf0-97c4-211d3b4fbdf0",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_R9HSR5XU19GIXJQIOPJALZ3R2J"
    },
    {
      "object": "organization_membership",
      "user_id": "de67efdb-ba3f-4f0a-a78a-0974c100cee9",
      "organization_id": "9f8e7720-56e1-4bf0-97c4-211d3b4fbdf0",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_JJ927XXYTYZ86W2XP4YBJDQEBV"
    }
  ],
  "list_metadata": {
    "before": "om_R9HSR5XU19GIXJQIOPJALZ3R2J",
    "after": null
  }
}
  149. · DELETE workos request · provider traffic · /user_management/organization_memberships/om_JJ927XXYTYZ86W2XP4YBJDQEBV · HTTP 204 · request 64f370b27f62 · processing 0.86ms
  150. · POST asana request · provider traffic · /tasks · HTTP 201 · request e68713ac0ab4 · processing 14.64ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-rerun-finds-contained: account takeover contain (contain)",
    "notes": "Alert SEC-rerun-finds-contained for user 725a48f83a from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_T2S0QBDBM7VGXR8I.\nPrivileged memberships removed (restore input):\n- 9f8e7720-56e1-4bf0-97c4-211d3b4fbdf0 admin (om_JJ927XXYTYZ86W2XP4YBJDQEBV) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-rerun-finds-contained\",\"memberships\":[{\"organizationId\":\"9f8e7720-56e1-4bf0-97c4-211d3b4fbdf0\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.64ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "684",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "data": {
    "name": "SEC-rerun-finds-contained: account takeover contain (contain)",
    "notes": "Alert SEC-rerun-finds-contained for user 725a48f83a from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_T2S0QBDBM7VGXR8I.\nPrivileged memberships removed (restore input):\n- 9f8e7720-56e1-4bf0-97c4-211d3b4fbdf0 admin (om_JJ927XXYTYZ86W2XP4YBJDQEBV) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-rerun-finds-contained\",\"memberships\":[{\"organizationId\":\"9f8e7720-56e1-4bf0-97c4-211d3b4fbdf0\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}

    Recorded response · HTTP 201

    {
  "data": {
    "name": "SEC-rerun-finds-contained: account takeover contain (contain)",
    "notes": "Alert SEC-rerun-finds-contained for user 725a48f83a from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_T2S0QBDBM7VGXR8I.\nPrivileged memberships removed (restore input):\n- 9f8e7720-56e1-4bf0-97c4-211d3b4fbdf0 admin (om_JJ927XXYTYZ86W2XP4YBJDQEBV) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-rerun-finds-contained\",\"memberships\":[{\"organizationId\":\"9f8e7720-56e1-4bf0-97c4-211d3b4fbdf0\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  },
  "id": "670d3a93-f178-45bc-9ebf-48a9d3ad9d97"
}
  151. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request 9ce4a5d3bd23 · processing 14.02ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-rerun-finds-contained (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.02ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "193",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-rerun-finds-contained (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_dcd8d26bf3464a07a9237fc91a",
    "client_msg_id": "cli_63042318e5ef44f4ba706b0ceb",
    "name": "item-612162",
    "old_name": "Sample Old",
    "parent_user_id": "par_c1bc9534a0f04a42ac381ac1f0",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "17N0OCL6AZ.VCSKNT"
}
  152. · POST app request /invocations · rerun finds contained · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "rerun-b-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-rerun-finds-contained",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "rerun_finds_contained"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:50.146712+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "443",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "rerun-b-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-rerun-finds-contained",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "rerun_finds_contained"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "rerun-b-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "rerun_finds_contained"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 0 privileged, 0 session(s)",
      "durationMs": 359
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 277
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "nothing: already contained",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "nothing"
      },
      "attempts": 1,
      "ref": "17NDYMT9DM.SGGA5Z",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:49.993Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 1,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "nothing",
    "reason": "already contained",
    "score": 75,
    "level": "high",
    "removals": 0,
    "removalsAuto": 0,
    "holds": 0,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:49.476Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:49.837Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:49.840Z",
      "msg": "planned 1 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:49.993Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:49.993Z",
      "msg": "done (ok)"
    }
  ],
  "createdAt": "2026-10-22T01:44:49.476Z",
  "updatedAt": "2026-10-22T01:44:49.993Z",
  "duplicate": false
}
  153. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request 3fca2545628e · processing 1.95ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.95ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "de67efdb-ba3f-4f0a-a78a-0974c100cee9",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/69d8f3d4",
      "email_verified": true,
      "external_id": "ext_3f1d1e01c1784d388ed0376fe2",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  154. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request 3e85ecfe0bd4 · processing 15.68ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 15.68ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_T2S0QBDBM7VGXR8I",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 57,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null,
      "metadata": {
        "acme_ato_hold": "SEC-rerun-finds-contained",
        "acme_ato_hold_at": "2026-10-22T01:44:48.076Z"
      }
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  155. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 335a131cbd3f · processing 0.66ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.66ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "de67efdb-ba3f-4f0a-a78a-0974c100cee9",
      "organization_id": "96b8d7a4-d86b-4765-a311-84bad0404211",
      "status": "active",
      "role": {
        "slug": "member"
      },
      "roles": [
        {
          "slug": "member"
        }
      ],
      "id": "om_KVCQFHPXG839VXHTQH613GV5TE"
    }
  ],
  "list_metadata": {
    "before": "om_KVCQFHPXG839VXHTQH613GV5TE",
    "after": null
  }
}
  156. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request 7fd4a39440d2 · processing 6.36ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 6.36ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  157. · GET workos request · provider traffic · /user_management/users/de67efdb-ba3f-4f0a-a78a-0974c100cee9/sessions · HTTP 200 · request b62bdfb3fbcb · processing 1.49ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/de67efdb-ba3f-4f0a-a78a-0974c100cee9/sessions' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.49ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "items": [
    {
      "session_id": "[redacted]",
      "name": "Sample Session 1",
      "id": "65028467-bd15-479d-b741-4630a662fd42"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 2",
      "id": "b0b28c4e-bdc3-4ed9-9483-fdd724aeb3ef"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 3",
      "id": "ab7c709c-c32d-4aa0-911b-52c680ee248f"
    }
  ]
}
  158. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request f7bbf53ede5f · processing 14.14ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":eyes: SEC-rerun-finds-contained (contain): nothing, already contained.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.14ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "148",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":eyes: SEC-rerun-finds-contained (contain): nothing, already contained.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_a2998c113e6e48f796380d38f4",
    "client_msg_id": "cli_5da8734006b248bfb863262e5a",
    "name": "item-69e90a",
    "old_name": "Sample Old",
    "parent_user_id": "par_9e15275d79cc4de5b8f180380c",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "17NDYMT9DM.SGGA5Z"
}
  159. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/rerun_finds_contained/runs · rerun finds contained · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/rerun_finds_contained/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:50.452246+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "rerun-finds-contained-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "rerun_finds_contained"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "2 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 452
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 316
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_T2S0QBDBM7VGXR8I",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_T2S0QBDBM7VGXR8I",
            "alert": "SEC-rerun-finds-contained"
          },
          "attempts": 1,
          "ref": "cus_T2S0QBDBM7VGXR8I",
          "appliedAt": "2026-10-22T01:44:48.675Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_JJ927XXYTYZ86W2XP4YBJDQEBV",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "725a48f83a",
            "organization": "9f8e7720-56e1-4bf0-97c4-211d3b4fbdf0",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_JJ927XXYTYZ86W2XP4YBJDQEBV",
          "detail": {
            "organizationId": "9f8e7720-56e1-4bf0-97c4-211d3b4fbdf0",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:49.004Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-rerun-finds-contained",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "670d3a93-f178-45bc-9ebf-48a9d3ad9d97",
          "appliedAt": "2026-10-22T01:44:49.126Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17N0OCL6AZ.VCSKNT",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:49.252Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:48.076Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:48.531Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:48.533Z",
          "msg": "planned 4 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:44:48.676Z",
          "msg": "stripe.hold_customer:cus_T2S0QBDBM7VGXR8I: applied"
        },
        {
          "at": "2026-10-22T01:44:49.004Z",
          "msg": "workos.remove_membership:om_JJ927XXYTYZ86W2XP4YBJDQEBV: applied"
        },
        {
          "at": "2026-10-22T01:44:49.126Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:49.252Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:49.253Z",
          "msg": "done (ok)"
        }
      ],
      "createdAt": "2026-10-22T01:44:48.076Z",
      "updatedAt": "2026-10-22T01:44:49.253Z"
    },
    {
      "runId": "rerun-b-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "rerun_finds_contained"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 0 privileged, 0 session(s)",
          "durationMs": 359
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 277
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "nothing: already contained",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "nothing"
          },
          "attempts": 1,
          "ref": "17NDYMT9DM.SGGA5Z",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:49.993Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 1,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "nothing",
        "reason": "already contained",
        "score": 75,
        "level": "high",
        "removals": 0,
        "removalsAuto": 0,
        "holds": 0,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:49.476Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:49.837Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:49.840Z",
          "msg": "planned 1 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:44:49.993Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:49.993Z",
          "msg": "done (ok)"
        }
      ],
      "createdAt": "2026-10-22T01:44:49.476Z",
      "updatedAt": "2026-10-22T01:44:49.993Z"
    }
  ]
}
  160. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/duplicate_start/runs · duplicate start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/duplicate_start/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:50.661464+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  161. · POST app request /invocations · duplicate start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "duplicate-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-duplicate-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "duplicate_start"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:52.061588+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "433",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "duplicate-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-duplicate-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "duplicate_start"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "duplicate-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "duplicate_start"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 454
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 279
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_75U6ZQHMW2HE7X0P",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_75U6ZQHMW2HE7X0P",
        "alert": "SEC-duplicate-start"
      },
      "attempts": 1,
      "ref": "cus_75U6ZQHMW2HE7X0P",
      "appliedAt": "2026-10-22T01:44:51.293Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_QWLBQWEGY6P9VHPYOLCFPXTP0F",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "1a1dac64fe",
        "organization": "53b49388-aa00-4cab-87f0-f2ee763f91ba",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_QWLBQWEGY6P9VHPYOLCFPXTP0F",
      "detail": {
        "organizationId": "53b49388-aa00-4cab-87f0-f2ee763f91ba",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:51.622Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-duplicate-start",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "1ae1bba1-50c2-463c-a094-0a79c712b06e",
      "appliedAt": "2026-10-22T01:44:51.780Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17HK5ZYQD4.Z3JS0C",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:51.904Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:50.702Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:51.158Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:51.160Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:51.293Z",
      "msg": "stripe.hold_customer:cus_75U6ZQHMW2HE7X0P: applied"
    },
    {
      "at": "2026-10-22T01:44:51.622Z",
      "msg": "workos.remove_membership:om_QWLBQWEGY6P9VHPYOLCFPXTP0F: applied"
    },
    {
      "at": "2026-10-22T01:44:51.780Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:51.905Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:51.906Z",
      "msg": "done (ok)"
    }
  ],
  "createdAt": "2026-10-22T01:44:50.702Z",
  "updatedAt": "2026-10-22T01:44:51.906Z",
  "duplicate": false
}
  162. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request 4d17ebd01135 · processing 1.78ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.78ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "bc9b3358-b564-4b8e-a6db-a6ed247d7a88",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/290ea963",
      "email_verified": true,
      "external_id": "ext_6b143ed2bb74428a9de1da2edc",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  163. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request 12da523694bd · processing 15.4ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 15.4ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_75U6ZQHMW2HE7X0P",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 44,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  164. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 90996b2de575 · processing 0.57ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.57ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "bc9b3358-b564-4b8e-a6db-a6ed247d7a88",
      "organization_id": "53b49388-aa00-4cab-87f0-f2ee763f91ba",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_QWLBQWEGY6P9VHPYOLCFPXTP0F"
    }
  ],
  "list_metadata": {
    "before": "om_QWLBQWEGY6P9VHPYOLCFPXTP0F",
    "after": null
  }
}
  165. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request f8b189201917 · processing 5.69ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 5.69ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  166. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request abb237840671 · processing 0.63ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.63ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "bc9b3358-b564-4b8e-a6db-a6ed247d7a88",
      "organization_id": "53b49388-aa00-4cab-87f0-f2ee763f91ba",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_QWLBQWEGY6P9VHPYOLCFPXTP0F"
    },
    {
      "object": "organization_membership",
      "user_id": "57e90e0a-e183-4a12-ab00-3f54b15e7e42",
      "organization_id": "53b49388-aa00-4cab-87f0-f2ee763f91ba",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_NLMCSWP44VVGTQF00M19CKJ9WA"
    }
  ],
  "list_metadata": {
    "before": "om_QWLBQWEGY6P9VHPYOLCFPXTP0F",
    "after": null
  }
}
  167. · GET workos request · provider traffic · /user_management/users/bc9b3358-b564-4b8e-a6db-a6ed247d7a88/sessions · HTTP 200 · request 92af4d15e5f9 · processing 1.55ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/bc9b3358-b564-4b8e-a6db-a6ed247d7a88/sessions' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.55ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "items": [
    {
      "session_id": "[redacted]",
      "name": "Sample Session 1",
      "id": "65028467-bd15-479d-b741-4630a662fd42"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 2",
      "id": "b0b28c4e-bdc3-4ed9-9483-fdd724aeb3ef"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 3",
      "id": "ab7c709c-c32d-4aa0-911b-52c680ee248f"
    }
  ]
}
  168. · POST stripe request · provider traffic · /v1/customers/cus_75U6ZQHMW2HE7X0P · HTTP 200 · request 58ba62b25f37 · processing 17.47ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_75U6ZQHMW2HE7X0P' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-raw '{
  "metadata": {
    "acme_ato_hold": "SEC-duplicate-start",
    "acme_ato_hold_at": "2026-10-22T01:44:50.702Z"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 17.47ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "107",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/x-www-form-urlencoded"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "metadata": {
    "acme_ato_hold": "SEC-duplicate-start",
    "acme_ato_hold_at": "2026-10-22T01:44:50.702Z"
  }
}

    Recorded response · HTTP 200

    {
  "email": "[email protected]",
  "name": "Robin Customer",
  "id": "cus_75U6ZQHMW2HE7X0P",
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 44,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "SEC-duplicate-start",
    "acme_ato_hold_at": "2026-10-22T01:44:50.702Z"
  }
}
  169. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request fe659504fd08 · processing 0.54ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.54ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "bc9b3358-b564-4b8e-a6db-a6ed247d7a88",
      "organization_id": "53b49388-aa00-4cab-87f0-f2ee763f91ba",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_QWLBQWEGY6P9VHPYOLCFPXTP0F"
    }
  ],
  "list_metadata": {
    "before": "om_QWLBQWEGY6P9VHPYOLCFPXTP0F",
    "after": null
  }
}
  170. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request e86567a0da0f · processing 0.58ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.58ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "bc9b3358-b564-4b8e-a6db-a6ed247d7a88",
      "organization_id": "53b49388-aa00-4cab-87f0-f2ee763f91ba",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_QWLBQWEGY6P9VHPYOLCFPXTP0F"
    },
    {
      "object": "organization_membership",
      "user_id": "57e90e0a-e183-4a12-ab00-3f54b15e7e42",
      "organization_id": "53b49388-aa00-4cab-87f0-f2ee763f91ba",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_NLMCSWP44VVGTQF00M19CKJ9WA"
    }
  ],
  "list_metadata": {
    "before": "om_QWLBQWEGY6P9VHPYOLCFPXTP0F",
    "after": null
  }
}
  171. · DELETE workos request · provider traffic · /user_management/organization_memberships/om_QWLBQWEGY6P9VHPYOLCFPXTP0F · HTTP 204 · request 1b753dfdff0d · processing 0.78ms
  172. · POST asana request · provider traffic · /tasks · HTTP 201 · request 092f2c8269e7 · processing 14.76ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-duplicate-start: account takeover contain (contain)",
    "notes": "Alert SEC-duplicate-start for user 1a1dac64fe from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_75U6ZQHMW2HE7X0P.\nPrivileged memberships removed (restore input):\n- 53b49388-aa00-4cab-87f0-f2ee763f91ba admin (om_QWLBQWEGY6P9VHPYOLCFPXTP0F) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-duplicate-start\",\"memberships\":[{\"organizationId\":\"53b49388-aa00-4cab-87f0-f2ee763f91ba\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.76ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "666",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "data": {
    "name": "SEC-duplicate-start: account takeover contain (contain)",
    "notes": "Alert SEC-duplicate-start for user 1a1dac64fe from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_75U6ZQHMW2HE7X0P.\nPrivileged memberships removed (restore input):\n- 53b49388-aa00-4cab-87f0-f2ee763f91ba admin (om_QWLBQWEGY6P9VHPYOLCFPXTP0F) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-duplicate-start\",\"memberships\":[{\"organizationId\":\"53b49388-aa00-4cab-87f0-f2ee763f91ba\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}

    Recorded response · HTTP 201

    {
  "data": {
    "name": "SEC-duplicate-start: account takeover contain (contain)",
    "notes": "Alert SEC-duplicate-start for user 1a1dac64fe from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_75U6ZQHMW2HE7X0P.\nPrivileged memberships removed (restore input):\n- 53b49388-aa00-4cab-87f0-f2ee763f91ba admin (om_QWLBQWEGY6P9VHPYOLCFPXTP0F) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-duplicate-start\",\"memberships\":[{\"organizationId\":\"53b49388-aa00-4cab-87f0-f2ee763f91ba\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  },
  "id": "1ae1bba1-50c2-463c-a094-0a79c712b06e"
}
  173. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request bd4250d2fbab · processing 14.11ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-duplicate-start (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.11ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "187",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-duplicate-start (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_046a2f6d4bfc493d8c9a5d70f0",
    "client_msg_id": "cli_d642a5ffd4f8440b8c51e7611e",
    "name": "item-741c2a",
    "old_name": "Sample Old",
    "parent_user_id": "par_c82d0c94f08142ed9e5402454f",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "17HK5ZYQD4.Z3JS0C"
}
  174. · POST app request /invocations · duplicate start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "duplicate-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-duplicate-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "duplicate_start"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:52.271713+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "433",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "duplicate-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-duplicate-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "duplicate_start"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "duplicate-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "duplicate_start"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 454
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 279
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_75U6ZQHMW2HE7X0P",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_75U6ZQHMW2HE7X0P",
        "alert": "SEC-duplicate-start"
      },
      "attempts": 1,
      "ref": "cus_75U6ZQHMW2HE7X0P",
      "appliedAt": "2026-10-22T01:44:51.293Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_QWLBQWEGY6P9VHPYOLCFPXTP0F",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "1a1dac64fe",
        "organization": "53b49388-aa00-4cab-87f0-f2ee763f91ba",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_QWLBQWEGY6P9VHPYOLCFPXTP0F",
      "detail": {
        "organizationId": "53b49388-aa00-4cab-87f0-f2ee763f91ba",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:51.622Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-duplicate-start",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "1ae1bba1-50c2-463c-a094-0a79c712b06e",
      "appliedAt": "2026-10-22T01:44:51.780Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17HK5ZYQD4.Z3JS0C",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:51.904Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:50.702Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:51.158Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:51.160Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:51.293Z",
      "msg": "stripe.hold_customer:cus_75U6ZQHMW2HE7X0P: applied"
    },
    {
      "at": "2026-10-22T01:44:51.622Z",
      "msg": "workos.remove_membership:om_QWLBQWEGY6P9VHPYOLCFPXTP0F: applied"
    },
    {
      "at": "2026-10-22T01:44:51.780Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:51.905Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:51.906Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:44:52.109Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:50.702Z",
  "updatedAt": "2026-10-22T01:44:52.109Z",
  "duplicate": true
}
  175. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/duplicate_start/runs · duplicate start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/duplicate_start/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:52.576551+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "duplicate-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "duplicate_start"
      },
      "duplicateStarts": 1,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 454
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 279
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_75U6ZQHMW2HE7X0P",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_75U6ZQHMW2HE7X0P",
            "alert": "SEC-duplicate-start"
          },
          "attempts": 1,
          "ref": "cus_75U6ZQHMW2HE7X0P",
          "appliedAt": "2026-10-22T01:44:51.293Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_QWLBQWEGY6P9VHPYOLCFPXTP0F",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "1a1dac64fe",
            "organization": "53b49388-aa00-4cab-87f0-f2ee763f91ba",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_QWLBQWEGY6P9VHPYOLCFPXTP0F",
          "detail": {
            "organizationId": "53b49388-aa00-4cab-87f0-f2ee763f91ba",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:51.622Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-duplicate-start",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "1ae1bba1-50c2-463c-a094-0a79c712b06e",
          "appliedAt": "2026-10-22T01:44:51.780Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17HK5ZYQD4.Z3JS0C",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:51.904Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:50.702Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:51.158Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:51.160Z",
          "msg": "planned 4 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:44:51.293Z",
          "msg": "stripe.hold_customer:cus_75U6ZQHMW2HE7X0P: applied"
        },
        {
          "at": "2026-10-22T01:44:51.622Z",
          "msg": "workos.remove_membership:om_QWLBQWEGY6P9VHPYOLCFPXTP0F: applied"
        },
        {
          "at": "2026-10-22T01:44:51.780Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:51.905Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:51.906Z",
          "msg": "done (ok)"
        },
        {
          "at": "2026-10-22T01:44:52.109Z",
          "msg": "duplicate start ignored"
        }
      ],
      "createdAt": "2026-10-22T01:44:50.702Z",
      "updatedAt": "2026-10-22T01:44:52.109Z"
    }
  ]
}
  176. · POST app request /invocations · duplicate start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "duplicate-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-duplicate-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "duplicate_start"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:52.783248+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "433",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "duplicate-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-duplicate-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "duplicate_start"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "duplicate-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "duplicate_start"
  },
  "duplicateStarts": 2,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 454
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 279
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_75U6ZQHMW2HE7X0P",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_75U6ZQHMW2HE7X0P",
        "alert": "SEC-duplicate-start"
      },
      "attempts": 1,
      "ref": "cus_75U6ZQHMW2HE7X0P",
      "appliedAt": "2026-10-22T01:44:51.293Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_QWLBQWEGY6P9VHPYOLCFPXTP0F",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "1a1dac64fe",
        "organization": "53b49388-aa00-4cab-87f0-f2ee763f91ba",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_QWLBQWEGY6P9VHPYOLCFPXTP0F",
      "detail": {
        "organizationId": "53b49388-aa00-4cab-87f0-f2ee763f91ba",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:51.622Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-duplicate-start",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "1ae1bba1-50c2-463c-a094-0a79c712b06e",
      "appliedAt": "2026-10-22T01:44:51.780Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17HK5ZYQD4.Z3JS0C",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:51.904Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:50.702Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:51.158Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:51.160Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:51.293Z",
      "msg": "stripe.hold_customer:cus_75U6ZQHMW2HE7X0P: applied"
    },
    {
      "at": "2026-10-22T01:44:51.622Z",
      "msg": "workos.remove_membership:om_QWLBQWEGY6P9VHPYOLCFPXTP0F: applied"
    },
    {
      "at": "2026-10-22T01:44:51.780Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:51.905Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:51.906Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:44:52.109Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:52.622Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:50.702Z",
  "updatedAt": "2026-10-22T01:44:52.622Z",
  "duplicate": true
}
  177. · POST app request /invocations · duplicate start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "duplicate-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-duplicate-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "duplicate_start"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:52.985429+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "433",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "duplicate-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-duplicate-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "duplicate_start"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "duplicate-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "duplicate_start"
  },
  "duplicateStarts": 3,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 454
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 279
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_75U6ZQHMW2HE7X0P",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_75U6ZQHMW2HE7X0P",
        "alert": "SEC-duplicate-start"
      },
      "attempts": 1,
      "ref": "cus_75U6ZQHMW2HE7X0P",
      "appliedAt": "2026-10-22T01:44:51.293Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_QWLBQWEGY6P9VHPYOLCFPXTP0F",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "1a1dac64fe",
        "organization": "53b49388-aa00-4cab-87f0-f2ee763f91ba",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_QWLBQWEGY6P9VHPYOLCFPXTP0F",
      "detail": {
        "organizationId": "53b49388-aa00-4cab-87f0-f2ee763f91ba",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:51.622Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-duplicate-start",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "1ae1bba1-50c2-463c-a094-0a79c712b06e",
      "appliedAt": "2026-10-22T01:44:51.780Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17HK5ZYQD4.Z3JS0C",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:51.904Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:50.702Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:51.158Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:51.160Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:51.293Z",
      "msg": "stripe.hold_customer:cus_75U6ZQHMW2HE7X0P: applied"
    },
    {
      "at": "2026-10-22T01:44:51.622Z",
      "msg": "workos.remove_membership:om_QWLBQWEGY6P9VHPYOLCFPXTP0F: applied"
    },
    {
      "at": "2026-10-22T01:44:51.780Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:51.905Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:51.906Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:44:52.109Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:52.622Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:52.826Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:50.702Z",
  "updatedAt": "2026-10-22T01:44:52.826Z",
  "duplicate": true
}
  178. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/duplicate_start/runs · duplicate start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/duplicate_start/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:53.287942+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "duplicate-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "duplicate_start"
      },
      "duplicateStarts": 3,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 454
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 279
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_75U6ZQHMW2HE7X0P",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_75U6ZQHMW2HE7X0P",
            "alert": "SEC-duplicate-start"
          },
          "attempts": 1,
          "ref": "cus_75U6ZQHMW2HE7X0P",
          "appliedAt": "2026-10-22T01:44:51.293Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_QWLBQWEGY6P9VHPYOLCFPXTP0F",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "1a1dac64fe",
            "organization": "53b49388-aa00-4cab-87f0-f2ee763f91ba",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_QWLBQWEGY6P9VHPYOLCFPXTP0F",
          "detail": {
            "organizationId": "53b49388-aa00-4cab-87f0-f2ee763f91ba",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:51.622Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-duplicate-start",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "1ae1bba1-50c2-463c-a094-0a79c712b06e",
          "appliedAt": "2026-10-22T01:44:51.780Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17HK5ZYQD4.Z3JS0C",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:51.904Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:50.702Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:51.158Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:51.160Z",
          "msg": "planned 4 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:44:51.293Z",
          "msg": "stripe.hold_customer:cus_75U6ZQHMW2HE7X0P: applied"
        },
        {
          "at": "2026-10-22T01:44:51.622Z",
          "msg": "workos.remove_membership:om_QWLBQWEGY6P9VHPYOLCFPXTP0F: applied"
        },
        {
          "at": "2026-10-22T01:44:51.780Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:51.905Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:51.906Z",
          "msg": "done (ok)"
        },
        {
          "at": "2026-10-22T01:44:52.109Z",
          "msg": "duplicate start ignored"
        },
        {
          "at": "2026-10-22T01:44:52.622Z",
          "msg": "duplicate start ignored"
        },
        {
          "at": "2026-10-22T01:44:52.826Z",
          "msg": "duplicate start ignored"
        }
      ],
      "createdAt": "2026-10-22T01:44:50.702Z",
      "updatedAt": "2026-10-22T01:44:52.826Z"
    }
  ]
}
  179. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/concurrent_start/runs · concurrent start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/concurrent_start/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:53.496841+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  180. · POST app request /invocations · concurrent start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:55.070879+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "437",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 592
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 338
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_PM1JAEL0FI3ZUOG7",
        "alert": "SEC-concurrent-start"
      },
      "attempts": 1,
      "ref": "cus_PM1JAEL0FI3ZUOG7",
      "appliedAt": "2026-10-22T01:44:54.268Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "a64181f9f2",
        "organization": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_81V7IM9FI707L6ABVA0O45QW58",
      "detail": {
        "organizationId": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:54.641Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-concurrent-start",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "693c7728-25f1-4b3d-a4bd-a546c06e8dfb",
      "appliedAt": "2026-10-22T01:44:54.774Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17M6A3722X.CNN7FH",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:54.906Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:53.534Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:54.128Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:54.130Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:54.268Z",
      "msg": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7: applied"
    },
    {
      "at": "2026-10-22T01:44:54.641Z",
      "msg": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58: applied"
    },
    {
      "at": "2026-10-22T01:44:54.774Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:54.907Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:54.908Z",
      "msg": "done (ok)"
    }
  ],
  "createdAt": "2026-10-22T01:44:53.534Z",
  "updatedAt": "2026-10-22T01:44:54.908Z",
  "duplicate": false
}
  181. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request 2a103f6e9f0c · processing 3.59ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 3.59ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "cae9ea08-c8ed-42a1-a30a-06a7971e8dd5",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/4e41fdc1",
      "email_verified": true,
      "external_id": "ext_28b497dbf57d4f139617d0e7b9",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  182. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request 365dfe2a72f1 · processing 27.21ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 27.21ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_PM1JAEL0FI3ZUOG7",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 48,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  183. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request 7bb11837377a · processing 6.33ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 6.33ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  184. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 29bf5d3a9502 · processing 1.12ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.12ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "cae9ea08-c8ed-42a1-a30a-06a7971e8dd5",
      "organization_id": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_81V7IM9FI707L6ABVA0O45QW58"
    }
  ],
  "list_metadata": {
    "before": "om_81V7IM9FI707L6ABVA0O45QW58",
    "after": null
  }
}
  185. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request af99ad8faa5f · processing 0.61ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.61ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "fdd662c0-c35f-40fc-8947-b48cf37bdab3",
      "organization_id": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_MZP50K94IGEHD3BAR7YSD4XT1U"
    },
    {
      "object": "organization_membership",
      "user_id": "cae9ea08-c8ed-42a1-a30a-06a7971e8dd5",
      "organization_id": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_81V7IM9FI707L6ABVA0O45QW58"
    }
  ],
  "list_metadata": {
    "before": "om_MZP50K94IGEHD3BAR7YSD4XT1U",
    "after": null
  }
}
  186. · GET workos request · provider traffic · /user_management/users/cae9ea08-c8ed-42a1-a30a-06a7971e8dd5/sessions · HTTP 200 · request 555c501c6804 · processing 1.49ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/cae9ea08-c8ed-42a1-a30a-06a7971e8dd5/sessions' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.49ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "items": [
    {
      "session_id": "[redacted]",
      "name": "Sample Session 1",
      "id": "65028467-bd15-479d-b741-4630a662fd42"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 2",
      "id": "b0b28c4e-bdc3-4ed9-9483-fdd724aeb3ef"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 3",
      "id": "ab7c709c-c32d-4aa0-911b-52c680ee248f"
    }
  ]
}
  187. · POST stripe request · provider traffic · /v1/customers/cus_PM1JAEL0FI3ZUOG7 · HTTP 200 · request c071cdb073aa · processing 15.71ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_PM1JAEL0FI3ZUOG7' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-raw '{
  "metadata": {
    "acme_ato_hold": "SEC-concurrent-start",
    "acme_ato_hold_at": "2026-10-22T01:44:53.534Z"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 15.71ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "108",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/x-www-form-urlencoded"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "metadata": {
    "acme_ato_hold": "SEC-concurrent-start",
    "acme_ato_hold_at": "2026-10-22T01:44:53.534Z"
  }
}

    Recorded response · HTTP 200

    {
  "email": "[email protected]",
  "name": "Robin Customer",
  "id": "cus_PM1JAEL0FI3ZUOG7",
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 48,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "SEC-concurrent-start",
    "acme_ato_hold_at": "2026-10-22T01:44:53.534Z"
  }
}
  188. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request e5d3a9206196 · processing 0.57ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.57ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "cae9ea08-c8ed-42a1-a30a-06a7971e8dd5",
      "organization_id": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_81V7IM9FI707L6ABVA0O45QW58"
    }
  ],
  "list_metadata": {
    "before": "om_81V7IM9FI707L6ABVA0O45QW58",
    "after": null
  }
}
  189. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request f2eefef216a0 · processing 0.83ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.83ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "fdd662c0-c35f-40fc-8947-b48cf37bdab3",
      "organization_id": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_MZP50K94IGEHD3BAR7YSD4XT1U"
    },
    {
      "object": "organization_membership",
      "user_id": "cae9ea08-c8ed-42a1-a30a-06a7971e8dd5",
      "organization_id": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_81V7IM9FI707L6ABVA0O45QW58"
    }
  ],
  "list_metadata": {
    "before": "om_MZP50K94IGEHD3BAR7YSD4XT1U",
    "after": null
  }
}
  190. · DELETE workos request · provider traffic · /user_management/organization_memberships/om_81V7IM9FI707L6ABVA0O45QW58 · HTTP 204 · request 0d9e25bf255b · processing 0.86ms
  191. · POST asana request · provider traffic · /tasks · HTTP 201 · request 2bc6421437fd · processing 14.79ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-concurrent-start: account takeover contain (contain)",
    "notes": "Alert SEC-concurrent-start for user a64181f9f2 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_PM1JAEL0FI3ZUOG7.\nPrivileged memberships removed (restore input):\n- 42c956fe-be5d-4fab-8773-07ebe0c9d92a admin (om_81V7IM9FI707L6ABVA0O45QW58) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-concurrent-start\",\"memberships\":[{\"organizationId\":\"42c956fe-be5d-4fab-8773-07ebe0c9d92a\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.79ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "669",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "data": {
    "name": "SEC-concurrent-start: account takeover contain (contain)",
    "notes": "Alert SEC-concurrent-start for user a64181f9f2 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_PM1JAEL0FI3ZUOG7.\nPrivileged memberships removed (restore input):\n- 42c956fe-be5d-4fab-8773-07ebe0c9d92a admin (om_81V7IM9FI707L6ABVA0O45QW58) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-concurrent-start\",\"memberships\":[{\"organizationId\":\"42c956fe-be5d-4fab-8773-07ebe0c9d92a\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}

    Recorded response · HTTP 201

    {
  "data": {
    "name": "SEC-concurrent-start: account takeover contain (contain)",
    "notes": "Alert SEC-concurrent-start for user a64181f9f2 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_PM1JAEL0FI3ZUOG7.\nPrivileged memberships removed (restore input):\n- 42c956fe-be5d-4fab-8773-07ebe0c9d92a admin (om_81V7IM9FI707L6ABVA0O45QW58) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-concurrent-start\",\"memberships\":[{\"organizationId\":\"42c956fe-be5d-4fab-8773-07ebe0c9d92a\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  },
  "id": "693c7728-25f1-4b3d-a4bd-a546c06e8dfb"
}
  192. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request 1068be19aae6 · processing 13.81ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-concurrent-start (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 13.81ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "188",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-concurrent-start (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_fe19d7006c7f4d3583737ca9b2",
    "client_msg_id": "cli_2538541aa5724b74a0614a8283",
    "name": "item-e36eea",
    "old_name": "Sample Old",
    "parent_user_id": "par_fa2bcfa5217a4572860e9503f3",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "17M6A3722X.CNN7FH"
}
  193. · POST app request /invocations · concurrent start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:55.618386+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "437",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  },
  "duplicateStarts": 3,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 592
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 338
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_PM1JAEL0FI3ZUOG7",
        "alert": "SEC-concurrent-start"
      },
      "attempts": 1,
      "ref": "cus_PM1JAEL0FI3ZUOG7",
      "appliedAt": "2026-10-22T01:44:54.268Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "a64181f9f2",
        "organization": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_81V7IM9FI707L6ABVA0O45QW58",
      "detail": {
        "organizationId": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:54.641Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-concurrent-start",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "693c7728-25f1-4b3d-a4bd-a546c06e8dfb",
      "appliedAt": "2026-10-22T01:44:54.774Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17M6A3722X.CNN7FH",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:54.906Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:53.534Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:54.128Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:54.130Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:54.268Z",
      "msg": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7: applied"
    },
    {
      "at": "2026-10-22T01:44:54.641Z",
      "msg": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58: applied"
    },
    {
      "at": "2026-10-22T01:44:54.774Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:54.907Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:54.908Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:44:55.162Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.302Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.449Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:53.534Z",
  "updatedAt": "2026-10-22T01:44:55.449Z",
  "duplicate": true
}
  194. · POST app request /invocations · concurrent start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:55.545857+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "437",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  },
  "duplicateStarts": 2,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 592
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 338
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_PM1JAEL0FI3ZUOG7",
        "alert": "SEC-concurrent-start"
      },
      "attempts": 1,
      "ref": "cus_PM1JAEL0FI3ZUOG7",
      "appliedAt": "2026-10-22T01:44:54.268Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "a64181f9f2",
        "organization": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_81V7IM9FI707L6ABVA0O45QW58",
      "detail": {
        "organizationId": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:54.641Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-concurrent-start",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "693c7728-25f1-4b3d-a4bd-a546c06e8dfb",
      "appliedAt": "2026-10-22T01:44:54.774Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17M6A3722X.CNN7FH",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:54.906Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:53.534Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:54.128Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:54.130Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:54.268Z",
      "msg": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7: applied"
    },
    {
      "at": "2026-10-22T01:44:54.641Z",
      "msg": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58: applied"
    },
    {
      "at": "2026-10-22T01:44:54.774Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:54.907Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:54.908Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:44:55.162Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.302Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:53.534Z",
  "updatedAt": "2026-10-22T01:44:55.302Z",
  "duplicate": true
}
  195. · POST app request /invocations · concurrent start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:55.744953+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "437",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  },
  "duplicateStarts": 4,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 592
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 338
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_PM1JAEL0FI3ZUOG7",
        "alert": "SEC-concurrent-start"
      },
      "attempts": 1,
      "ref": "cus_PM1JAEL0FI3ZUOG7",
      "appliedAt": "2026-10-22T01:44:54.268Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "a64181f9f2",
        "organization": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_81V7IM9FI707L6ABVA0O45QW58",
      "detail": {
        "organizationId": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:54.641Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-concurrent-start",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "693c7728-25f1-4b3d-a4bd-a546c06e8dfb",
      "appliedAt": "2026-10-22T01:44:54.774Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17M6A3722X.CNN7FH",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:54.906Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:53.534Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:54.128Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:54.130Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:54.268Z",
      "msg": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7: applied"
    },
    {
      "at": "2026-10-22T01:44:54.641Z",
      "msg": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58: applied"
    },
    {
      "at": "2026-10-22T01:44:54.774Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:54.907Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:54.908Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:44:55.162Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.302Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.449Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.568Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:53.534Z",
  "updatedAt": "2026-10-22T01:44:55.568Z",
  "duplicate": true
}
  196. · POST app request /invocations · concurrent start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:55.360632+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "437",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 592
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 338
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_PM1JAEL0FI3ZUOG7",
        "alert": "SEC-concurrent-start"
      },
      "attempts": 1,
      "ref": "cus_PM1JAEL0FI3ZUOG7",
      "appliedAt": "2026-10-22T01:44:54.268Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "a64181f9f2",
        "organization": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_81V7IM9FI707L6ABVA0O45QW58",
      "detail": {
        "organizationId": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:54.641Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-concurrent-start",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "693c7728-25f1-4b3d-a4bd-a546c06e8dfb",
      "appliedAt": "2026-10-22T01:44:54.774Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17M6A3722X.CNN7FH",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:54.906Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:53.534Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:54.128Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:54.130Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:54.268Z",
      "msg": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7: applied"
    },
    {
      "at": "2026-10-22T01:44:54.641Z",
      "msg": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58: applied"
    },
    {
      "at": "2026-10-22T01:44:54.774Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:54.907Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:54.908Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:44:55.162Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:53.534Z",
  "updatedAt": "2026-10-22T01:44:55.162Z",
  "duplicate": true
}
  197. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/concurrent_start/runs · concurrent start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/concurrent_start/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:56.052846+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "concurrent_start"
      },
      "duplicateStarts": 4,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 592
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 338
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_PM1JAEL0FI3ZUOG7",
            "alert": "SEC-concurrent-start"
          },
          "attempts": 1,
          "ref": "cus_PM1JAEL0FI3ZUOG7",
          "appliedAt": "2026-10-22T01:44:54.268Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "a64181f9f2",
            "organization": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_81V7IM9FI707L6ABVA0O45QW58",
          "detail": {
            "organizationId": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:54.641Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-concurrent-start",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "693c7728-25f1-4b3d-a4bd-a546c06e8dfb",
          "appliedAt": "2026-10-22T01:44:54.774Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17M6A3722X.CNN7FH",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:54.906Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:53.534Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:54.128Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:54.130Z",
          "msg": "planned 4 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:44:54.268Z",
          "msg": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7: applied"
        },
        {
          "at": "2026-10-22T01:44:54.641Z",
          "msg": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58: applied"
        },
        {
          "at": "2026-10-22T01:44:54.774Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:54.907Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:54.908Z",
          "msg": "done (ok)"
        },
        {
          "at": "2026-10-22T01:44:55.162Z",
          "msg": "duplicate start ignored"
        },
        {
          "at": "2026-10-22T01:44:55.302Z",
          "msg": "duplicate start ignored"
        },
        {
          "at": "2026-10-22T01:44:55.449Z",
          "msg": "duplicate start ignored"
        },
        {
          "at": "2026-10-22T01:44:55.568Z",
          "msg": "duplicate start ignored"
        }
      ],
      "createdAt": "2026-10-22T01:44:53.534Z",
      "updatedAt": "2026-10-22T01:44:55.568Z"
    }
  ]
}
  198. · POST app request /invocations · concurrent start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:56.275031+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "437",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  },
  "duplicateStarts": 5,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 592
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 338
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_PM1JAEL0FI3ZUOG7",
        "alert": "SEC-concurrent-start"
      },
      "attempts": 1,
      "ref": "cus_PM1JAEL0FI3ZUOG7",
      "appliedAt": "2026-10-22T01:44:54.268Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "a64181f9f2",
        "organization": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_81V7IM9FI707L6ABVA0O45QW58",
      "detail": {
        "organizationId": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:54.641Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-concurrent-start",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "693c7728-25f1-4b3d-a4bd-a546c06e8dfb",
      "appliedAt": "2026-10-22T01:44:54.774Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17M6A3722X.CNN7FH",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:54.906Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:53.534Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:54.128Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:54.130Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:54.268Z",
      "msg": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7: applied"
    },
    {
      "at": "2026-10-22T01:44:54.641Z",
      "msg": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58: applied"
    },
    {
      "at": "2026-10-22T01:44:54.774Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:54.907Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:54.908Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:44:55.162Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.302Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.449Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.568Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:56.115Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:53.534Z",
  "updatedAt": "2026-10-22T01:44:56.115Z",
  "duplicate": true
}
  199. · POST app request /invocations · concurrent start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:56.905719+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "437",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  },
  "duplicateStarts": 9,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 592
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 338
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_PM1JAEL0FI3ZUOG7",
        "alert": "SEC-concurrent-start"
      },
      "attempts": 1,
      "ref": "cus_PM1JAEL0FI3ZUOG7",
      "appliedAt": "2026-10-22T01:44:54.268Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "a64181f9f2",
        "organization": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_81V7IM9FI707L6ABVA0O45QW58",
      "detail": {
        "organizationId": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:54.641Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-concurrent-start",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "693c7728-25f1-4b3d-a4bd-a546c06e8dfb",
      "appliedAt": "2026-10-22T01:44:54.774Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17M6A3722X.CNN7FH",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:54.906Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:53.534Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:54.128Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:54.130Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:54.268Z",
      "msg": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7: applied"
    },
    {
      "at": "2026-10-22T01:44:54.641Z",
      "msg": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58: applied"
    },
    {
      "at": "2026-10-22T01:44:54.774Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:54.907Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:54.908Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:44:55.162Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.302Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.449Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.568Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:56.115Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:56.369Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:56.498Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:56.617Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:56.737Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:53.534Z",
  "updatedAt": "2026-10-22T01:44:56.737Z",
  "duplicate": true
}
  200. · POST app request /invocations · concurrent start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:56.534883+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "437",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  },
  "duplicateStarts": 6,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 592
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 338
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_PM1JAEL0FI3ZUOG7",
        "alert": "SEC-concurrent-start"
      },
      "attempts": 1,
      "ref": "cus_PM1JAEL0FI3ZUOG7",
      "appliedAt": "2026-10-22T01:44:54.268Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "a64181f9f2",
        "organization": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_81V7IM9FI707L6ABVA0O45QW58",
      "detail": {
        "organizationId": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:54.641Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-concurrent-start",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "693c7728-25f1-4b3d-a4bd-a546c06e8dfb",
      "appliedAt": "2026-10-22T01:44:54.774Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17M6A3722X.CNN7FH",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:54.906Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:53.534Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:54.128Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:54.130Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:54.268Z",
      "msg": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7: applied"
    },
    {
      "at": "2026-10-22T01:44:54.641Z",
      "msg": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58: applied"
    },
    {
      "at": "2026-10-22T01:44:54.774Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:54.907Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:54.908Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:44:55.162Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.302Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.449Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.568Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:56.115Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:56.369Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:53.534Z",
  "updatedAt": "2026-10-22T01:44:56.369Z",
  "duplicate": true
}
  201. · POST app request /invocations · concurrent start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:56.790919+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "437",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  },
  "duplicateStarts": 8,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 592
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 338
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_PM1JAEL0FI3ZUOG7",
        "alert": "SEC-concurrent-start"
      },
      "attempts": 1,
      "ref": "cus_PM1JAEL0FI3ZUOG7",
      "appliedAt": "2026-10-22T01:44:54.268Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "a64181f9f2",
        "organization": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_81V7IM9FI707L6ABVA0O45QW58",
      "detail": {
        "organizationId": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:54.641Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-concurrent-start",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "693c7728-25f1-4b3d-a4bd-a546c06e8dfb",
      "appliedAt": "2026-10-22T01:44:54.774Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17M6A3722X.CNN7FH",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:54.906Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:53.534Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:54.128Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:54.130Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:54.268Z",
      "msg": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7: applied"
    },
    {
      "at": "2026-10-22T01:44:54.641Z",
      "msg": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58: applied"
    },
    {
      "at": "2026-10-22T01:44:54.774Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:54.907Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:54.908Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:44:55.162Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.302Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.449Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.568Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:56.115Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:56.369Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:56.498Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:56.617Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:53.534Z",
  "updatedAt": "2026-10-22T01:44:56.617Z",
  "duplicate": true
}
  202. · POST app request /invocations · concurrent start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:56.662951+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "437",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-concurrent-start",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "concurrent_start"
  },
  "duplicateStarts": 7,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 592
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 338
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_PM1JAEL0FI3ZUOG7",
        "alert": "SEC-concurrent-start"
      },
      "attempts": 1,
      "ref": "cus_PM1JAEL0FI3ZUOG7",
      "appliedAt": "2026-10-22T01:44:54.268Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "a64181f9f2",
        "organization": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_81V7IM9FI707L6ABVA0O45QW58",
      "detail": {
        "organizationId": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:44:54.641Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-concurrent-start",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "693c7728-25f1-4b3d-a4bd-a546c06e8dfb",
      "appliedAt": "2026-10-22T01:44:54.774Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17M6A3722X.CNN7FH",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:54.906Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:53.534Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:54.128Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:54.130Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:54.268Z",
      "msg": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7: applied"
    },
    {
      "at": "2026-10-22T01:44:54.641Z",
      "msg": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58: applied"
    },
    {
      "at": "2026-10-22T01:44:54.774Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:44:54.907Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:54.908Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:44:55.162Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.302Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.449Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:55.568Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:56.115Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:56.369Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:44:56.498Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:53.534Z",
  "updatedAt": "2026-10-22T01:44:56.498Z",
  "duplicate": true
}
  203. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/concurrent_start/runs · concurrent start · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/concurrent_start/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:57.203040+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "concurrent-start-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "concurrent_start"
      },
      "duplicateStarts": 9,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 592
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 338
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_PM1JAEL0FI3ZUOG7",
            "alert": "SEC-concurrent-start"
          },
          "attempts": 1,
          "ref": "cus_PM1JAEL0FI3ZUOG7",
          "appliedAt": "2026-10-22T01:44:54.268Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "a64181f9f2",
            "organization": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_81V7IM9FI707L6ABVA0O45QW58",
          "detail": {
            "organizationId": "42c956fe-be5d-4fab-8773-07ebe0c9d92a",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:44:54.641Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-concurrent-start",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "693c7728-25f1-4b3d-a4bd-a546c06e8dfb",
          "appliedAt": "2026-10-22T01:44:54.774Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17M6A3722X.CNN7FH",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:54.906Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:53.534Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:54.128Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:54.130Z",
          "msg": "planned 4 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:44:54.268Z",
          "msg": "stripe.hold_customer:cus_PM1JAEL0FI3ZUOG7: applied"
        },
        {
          "at": "2026-10-22T01:44:54.641Z",
          "msg": "workos.remove_membership:om_81V7IM9FI707L6ABVA0O45QW58: applied"
        },
        {
          "at": "2026-10-22T01:44:54.774Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:44:54.907Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:54.908Z",
          "msg": "done (ok)"
        },
        {
          "at": "2026-10-22T01:44:55.162Z",
          "msg": "duplicate start ignored"
        },
        {
          "at": "2026-10-22T01:44:55.302Z",
          "msg": "duplicate start ignored"
        },
        {
          "at": "2026-10-22T01:44:55.449Z",
          "msg": "duplicate start ignored"
        },
        {
          "at": "2026-10-22T01:44:55.568Z",
          "msg": "duplicate start ignored"
        },
        {
          "at": "2026-10-22T01:44:56.115Z",
          "msg": "duplicate start ignored"
        },
        {
          "at": "2026-10-22T01:44:56.369Z",
          "msg": "duplicate start ignored"
        },
        {
          "at": "2026-10-22T01:44:56.498Z",
          "msg": "duplicate start ignored"
        },
        {
          "at": "2026-10-22T01:44:56.617Z",
          "msg": "duplicate start ignored"
        },
        {
          "at": "2026-10-22T01:44:56.737Z",
          "msg": "duplicate start ignored"
        }
      ],
      "createdAt": "2026-10-22T01:44:53.534Z",
      "updatedAt": "2026-10-22T01:44:56.737Z"
    }
  ]
}
  204. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/unknown_account_nothing/runs · unknown account nothing · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/unknown_account_nothing/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:57.408570+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  205. · POST app request /invocations · unknown account nothing · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "unknown-account-nothing-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-unknown-account-nothing",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "unknown_account_nothing"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:57.889815+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "465",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "unknown-account-nothing-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-unknown-account-nothing",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "unknown_account_nothing"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "unknown-account-nothing-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "unknown_account_nothing"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "no WorkOS user",
      "durationMs": 123
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "0 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 159
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "nothing: no such user and no billing account",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "nothing"
      },
      "attempts": 1,
      "ref": "17LKRBC8XA.6IF091",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:57.734Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 1,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "nothing",
    "reason": "no such user and no billing account",
    "score": 75,
    "level": "high",
    "removals": 0,
    "removalsAuto": 0,
    "holds": 0,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:57.445Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:57.606Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:57.608Z",
      "msg": "planned 1 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:57.734Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:57.735Z",
      "msg": "done (ok)"
    }
  ],
  "createdAt": "2026-10-22T01:44:57.445Z",
  "updatedAt": "2026-10-22T01:44:57.735Z",
  "duplicate": false
}
  206. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request f94d452bea56 · processing 1.77ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.77ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  207. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request ba8599eb509b · processing 4.19ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 4.19ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  208. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request 9c91b5ac60d5 · processing 13.61ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":eyes: SEC-unknown-account-nothing (contain): nothing, no such user and no billing account.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 13.61ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "168",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":eyes: SEC-unknown-account-nothing (contain): nothing, no such user and no billing account.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_39141a4053ed40679eafe3ef7e",
    "client_msg_id": "cli_eb8f50db64594dc49a55b0ccd1",
    "name": "item-1353d1",
    "old_name": "Sample Old",
    "parent_user_id": "par_6d51eaed00234865b449257b2f",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "17LKRBC8XA.6IF091"
}
  209. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/unknown_account_nothing/runs · unknown account nothing · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/unknown_account_nothing/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:44:59.674106+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "unknown-account-nothing-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "unknown_account_nothing"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "no WorkOS user",
          "durationMs": 123
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "0 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 159
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "nothing: no such user and no billing account",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "nothing"
          },
          "attempts": 1,
          "ref": "17LKRBC8XA.6IF091",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:57.734Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 1,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "nothing",
        "reason": "no such user and no billing account",
        "score": 75,
        "level": "high",
        "removals": 0,
        "removalsAuto": 0,
        "holds": 0,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:57.445Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:57.606Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:57.608Z",
          "msg": "planned 1 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:44:57.734Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:57.735Z",
          "msg": "done (ok)"
        }
      ],
      "createdAt": "2026-10-22T01:44:57.445Z",
      "updatedAt": "2026-10-22T01:44:57.735Z"
    }
  ]
}
  210. · POST app request /invocations · unknown account nothing · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "unknown-account-nothing-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-unknown-account-nothing",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "unknown_account_nothing"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:03.838050+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "465",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "unknown-account-nothing-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-unknown-account-nothing",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "unknown_account_nothing"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "unknown-account-nothing-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "unknown_account_nothing"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "no WorkOS user",
      "durationMs": 123
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "0 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 159
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "nothing: no such user and no billing account",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "nothing"
      },
      "attempts": 1,
      "ref": "17LKRBC8XA.6IF091",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:44:57.734Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 1,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "nothing",
    "reason": "no such user and no billing account",
    "score": 75,
    "level": "high",
    "removals": 0,
    "removalsAuto": 0,
    "holds": 0,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:44:57.445Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:44:57.606Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:44:57.608Z",
      "msg": "planned 1 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:44:57.734Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:44:57.735Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:45:00.427Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:44:57.445Z",
  "updatedAt": "2026-10-22T01:45:00.427Z",
  "duplicate": true
}
  211. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/unknown_account_nothing/runs · unknown account nothing · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/unknown_account_nothing/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:04.183865+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "unknown-account-nothing-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "unknown_account_nothing"
      },
      "duplicateStarts": 1,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "no WorkOS user",
          "durationMs": 123
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "0 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 159
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "nothing: no such user and no billing account",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "nothing"
          },
          "attempts": 1,
          "ref": "17LKRBC8XA.6IF091",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:44:57.734Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 1,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "nothing",
        "reason": "no such user and no billing account",
        "score": 75,
        "level": "high",
        "removals": 0,
        "removalsAuto": 0,
        "holds": 0,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:44:57.445Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:44:57.606Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:44:57.608Z",
          "msg": "planned 1 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:44:57.734Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:44:57.735Z",
          "msg": "done (ok)"
        },
        {
          "at": "2026-10-22T01:45:00.427Z",
          "msg": "duplicate start ignored"
        }
      ],
      "createdAt": "2026-10-22T01:44:57.445Z",
      "updatedAt": "2026-10-22T01:45:00.427Z"
    }
  ]
}
  212. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/restore_with_approval/runs · restore with approval · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/restore_with_approval/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:04.417029+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  213. · POST app request /invocations · restore with approval · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "restore-with-approval-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-restore-with-approval",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restore_with_approval"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:06.611120+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "457",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "restore-with-approval-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-restore-with-approval",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restore_with_approval"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "restore-with-approval-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restore_with_approval"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "2 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 664
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 467
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_OK9ZI7JVYP1CEXOX",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_OK9ZI7JVYP1CEXOX",
        "alert": "SEC-restore-with-approval"
      },
      "attempts": 1,
      "ref": "cus_OK9ZI7JVYP1CEXOX",
      "appliedAt": "2026-10-22T01:45:05.288Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_IE1HVZN3CNMLDZZMD6V66MISBE",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "3ba93e46c0",
        "organization": "c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_IE1HVZN3CNMLDZZMD6V66MISBE",
      "detail": {
        "organizationId": "c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:45:05.870Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-restore-with-approval",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "03f77336-dbcf-4762-8178-85875ed3b907",
      "appliedAt": "2026-10-22T01:45:06.021Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17LYFY4DC5.TMH9M1",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:45:06.194Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:45:04.471Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:45:05.136Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:45:05.139Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:45:05.288Z",
      "msg": "stripe.hold_customer:cus_OK9ZI7JVYP1CEXOX: applied"
    },
    {
      "at": "2026-10-22T01:45:05.870Z",
      "msg": "workos.remove_membership:om_IE1HVZN3CNMLDZZMD6V66MISBE: applied"
    },
    {
      "at": "2026-10-22T01:45:06.022Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:45:06.195Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:45:06.196Z",
      "msg": "done (ok)"
    }
  ],
  "createdAt": "2026-10-22T01:45:04.471Z",
  "updatedAt": "2026-10-22T01:45:06.196Z",
  "duplicate": false
}
  214. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request 64d7f51e7760 · processing 1.78ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.78ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "43b2c095-d883-433c-8774-f54864fbeedd",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/dbd06f0e",
      "email_verified": true,
      "external_id": "ext_e7ee8424451544d7b244c92e33",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  215. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request 5315e512f8a1 · processing 15.68ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 15.68ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_OK9ZI7JVYP1CEXOX",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 43,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  216. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 1611dd0a0f0a · processing 0.58ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.58ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "43b2c095-d883-433c-8774-f54864fbeedd",
      "organization_id": "cdf9fc56-eac7-4ca1-a419-bfff6ce24cf2",
      "status": "active",
      "role": {
        "slug": "member"
      },
      "roles": [
        {
          "slug": "member"
        }
      ],
      "id": "om_KGFP2QAQ5SLX64Q98T68KHN457"
    },
    {
      "object": "organization_membership",
      "user_id": "43b2c095-d883-433c-8774-f54864fbeedd",
      "organization_id": "c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_IE1HVZN3CNMLDZZMD6V66MISBE"
    }
  ],
  "list_metadata": {
    "before": "om_KGFP2QAQ5SLX64Q98T68KHN457",
    "after": null
  }
}
  217. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request 6f529e8423f4 · processing 5.93ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 5.93ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  218. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 959c68112d4a · processing 0.68ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.68ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "d5412ea5-8a63-49d0-90af-0d6b4086f474",
      "organization_id": "c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_QWQ7AMJBS62N3F3TSB7M4VB0J9"
    },
    {
      "object": "organization_membership",
      "user_id": "43b2c095-d883-433c-8774-f54864fbeedd",
      "organization_id": "c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_IE1HVZN3CNMLDZZMD6V66MISBE"
    }
  ],
  "list_metadata": {
    "before": "om_QWQ7AMJBS62N3F3TSB7M4VB0J9",
    "after": null
  }
}
  219. · GET workos request · provider traffic · /user_management/users/43b2c095-d883-433c-8774-f54864fbeedd/sessions · HTTP 200 · request 4589fd02aba1 · processing 1.78ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/43b2c095-d883-433c-8774-f54864fbeedd/sessions' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.78ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "items": [
    {
      "session_id": "[redacted]",
      "name": "Sample Session 1",
      "id": "65028467-bd15-479d-b741-4630a662fd42"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 2",
      "id": "b0b28c4e-bdc3-4ed9-9483-fdd724aeb3ef"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 3",
      "id": "ab7c709c-c32d-4aa0-911b-52c680ee248f"
    }
  ]
}
  220. · POST stripe request · provider traffic · /v1/customers/cus_OK9ZI7JVYP1CEXOX · HTTP 200 · request 932bd4fdb756 · processing 15.98ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_OK9ZI7JVYP1CEXOX' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-raw '{
  "metadata": {
    "acme_ato_hold": "SEC-restore-with-approval",
    "acme_ato_hold_at": "2026-10-22T01:45:04.471Z"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 15.98ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "113",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/x-www-form-urlencoded"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "metadata": {
    "acme_ato_hold": "SEC-restore-with-approval",
    "acme_ato_hold_at": "2026-10-22T01:45:04.471Z"
  }
}

    Recorded response · HTTP 200

    {
  "email": "[email protected]",
  "name": "Robin Customer",
  "id": "cus_OK9ZI7JVYP1CEXOX",
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 43,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "SEC-restore-with-approval",
    "acme_ato_hold_at": "2026-10-22T01:45:04.471Z"
  }
}
  221. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 36566faf1691 · processing 0.62ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.62ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "43b2c095-d883-433c-8774-f54864fbeedd",
      "organization_id": "cdf9fc56-eac7-4ca1-a419-bfff6ce24cf2",
      "status": "active",
      "role": {
        "slug": "member"
      },
      "roles": [
        {
          "slug": "member"
        }
      ],
      "id": "om_KGFP2QAQ5SLX64Q98T68KHN457"
    },
    {
      "object": "organization_membership",
      "user_id": "43b2c095-d883-433c-8774-f54864fbeedd",
      "organization_id": "c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_IE1HVZN3CNMLDZZMD6V66MISBE"
    }
  ],
  "list_metadata": {
    "before": "om_KGFP2QAQ5SLX64Q98T68KHN457",
    "after": null
  }
}
  222. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 5e2d018dac44 · processing 0.72ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.72ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "d5412ea5-8a63-49d0-90af-0d6b4086f474",
      "organization_id": "c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_QWQ7AMJBS62N3F3TSB7M4VB0J9"
    },
    {
      "object": "organization_membership",
      "user_id": "43b2c095-d883-433c-8774-f54864fbeedd",
      "organization_id": "c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_IE1HVZN3CNMLDZZMD6V66MISBE"
    }
  ],
  "list_metadata": {
    "before": "om_QWQ7AMJBS62N3F3TSB7M4VB0J9",
    "after": null
  }
}
  223. · DELETE workos request · provider traffic · /user_management/organization_memberships/om_IE1HVZN3CNMLDZZMD6V66MISBE · HTTP 204 · request ce8914929866 · processing 1.06ms
  224. · POST asana request · provider traffic · /tasks · HTTP 201 · request cb1c8c08fb04 · processing 16.26ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-restore-with-approval: account takeover contain (contain)",
    "notes": "Alert SEC-restore-with-approval for user 3ba93e46c0 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_OK9ZI7JVYP1CEXOX.\nPrivileged memberships removed (restore input):\n- c40c7a7f-460e-4fd4-90bb-30a7c5d9e136 admin (om_IE1HVZN3CNMLDZZMD6V66MISBE) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-restore-with-approval\",\"memberships\":[{\"organizationId\":\"c40c7a7f-460e-4fd4-90bb-30a7c5d9e136\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 16.26ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "684",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "data": {
    "name": "SEC-restore-with-approval: account takeover contain (contain)",
    "notes": "Alert SEC-restore-with-approval for user 3ba93e46c0 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_OK9ZI7JVYP1CEXOX.\nPrivileged memberships removed (restore input):\n- c40c7a7f-460e-4fd4-90bb-30a7c5d9e136 admin (om_IE1HVZN3CNMLDZZMD6V66MISBE) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-restore-with-approval\",\"memberships\":[{\"organizationId\":\"c40c7a7f-460e-4fd4-90bb-30a7c5d9e136\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}

    Recorded response · HTTP 201

    {
  "data": {
    "name": "SEC-restore-with-approval: account takeover contain (contain)",
    "notes": "Alert SEC-restore-with-approval for user 3ba93e46c0 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_OK9ZI7JVYP1CEXOX.\nPrivileged memberships removed (restore input):\n- c40c7a7f-460e-4fd4-90bb-30a7c5d9e136 admin (om_IE1HVZN3CNMLDZZMD6V66MISBE) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-restore-with-approval\",\"memberships\":[{\"organizationId\":\"c40c7a7f-460e-4fd4-90bb-30a7c5d9e136\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  },
  "id": "03f77336-dbcf-4762-8178-85875ed3b907"
}
  225. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request 90a543540b56 · processing 15.98ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-restore-with-approval (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 15.98ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "193",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-restore-with-approval (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_abfb2e68e6f5437f8c26f65365",
    "client_msg_id": "cli_d7f3fe64e88e4bfbbc7474f00f",
    "name": "item-d9cfc8",
    "old_name": "Sample Old",
    "parent_user_id": "par_170ab870596041abb3e41739e2",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "17LYFY4DC5.TMH9M1"
}
  226. · POST app request /invocations · restore with approval · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "restore-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "restore",
    "alertId": "SEC-restore-with-approval",
    "email": "[email protected]",
    "memberships": [
      {
        "organizationId": "c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
        "role": "admin"
      },
      {
        "organizationId": "cdf9fc56-eac7-4ca1-a419-bfff6ce24cf2",
        "role": "member"
      }
    ],
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restore_with_approval"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:07.536856+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "541",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "restore-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "restore",
    "alertId": "SEC-restore-with-approval",
    "email": "[email protected]",
    "memberships": [
      {
        "organizationId": "c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
        "role": "admin"
      },
      {
        "organizationId": "cdf9fc56-eac7-4ca1-a419-bfff6ce24cf2",
        "role": "member"
      }
    ],
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restore_with_approval"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "restore-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "AWAITING_APPROVAL",
  "closed": false,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restore_with_approval"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 0 privileged, 0 session(s)",
      "durationMs": 234
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 405
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "restore: restore after investigation",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "workos.restore_membership:c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
      "kind": "workos.restore_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "pending_approval",
      "summary": {
        "user": "3ba93e46c0",
        "organization": "c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
        "role": "admin"
      },
      "attempts": 0,
      "reconciled": null
    },
    {
      "id": "stripe.release_hold:cus_OK9ZI7JVYP1CEXOX",
      "kind": "stripe.release_hold",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "approval",
      "status": "pending_approval",
      "summary": {
        "customer": "cus_OK9ZI7JVYP1CEXOX",
        "alert": "SEC-restore-with-approval"
      },
      "attempts": 0,
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-restore-with-approval",
        "mode": "restore"
      },
      "attempts": 1,
      "ref": "b6c700c1-12cb-4c90-accb-f59d724c98fe",
      "appliedAt": "2026-10-22T01:45:07.205Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "restore"
      },
      "attempts": 1,
      "ref": "17BRHDQ4IL.L3UDBP",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:45:07.374Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 2,
    "failed": 0,
    "pendingApproval": 2,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:45:07.376Z"
  },
  "output": {
    "mode": "restore",
    "reason": "restore after investigation",
    "score": 0,
    "level": "low",
    "removals": 0,
    "removalsAuto": 0,
    "holds": 0,
    "revokeSessions": false,
    "restores": 1,
    "releases": 1
  },
  "events": [
    {
      "at": "2026-10-22T01:45:06.657Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:45:07.066Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:45:07.069Z",
      "msg": "planned 4 action(s): 2 need approval"
    },
    {
      "at": "2026-10-22T01:45:07.205Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:45:07.374Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:45:07.376Z",
      "msg": "awaiting approval"
    }
  ],
  "createdAt": "2026-10-22T01:45:06.657Z",
  "updatedAt": "2026-10-22T01:45:07.376Z",
  "duplicate": false
}
  227. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request da649e9ce5db · processing 1.81ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.81ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "43b2c095-d883-433c-8774-f54864fbeedd",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/dbd06f0e",
      "email_verified": true,
      "external_id": "ext_e7ee8424451544d7b244c92e33",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  228. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request 64e066fed66a · processing 16.53ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 16.53ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_OK9ZI7JVYP1CEXOX",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 43,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null,
      "metadata": {
        "acme_ato_hold": "SEC-restore-with-approval",
        "acme_ato_hold_at": "2026-10-22T01:45:04.471Z"
      }
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  229. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request c022f583cb54 · processing 0.84ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.84ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "43b2c095-d883-433c-8774-f54864fbeedd",
      "organization_id": "cdf9fc56-eac7-4ca1-a419-bfff6ce24cf2",
      "status": "active",
      "role": {
        "slug": "member"
      },
      "roles": [
        {
          "slug": "member"
        }
      ],
      "id": "om_KGFP2QAQ5SLX64Q98T68KHN457"
    }
  ],
  "list_metadata": {
    "before": "om_KGFP2QAQ5SLX64Q98T68KHN457",
    "after": null
  }
}
  230. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request 8cd7a2637d2b · processing 6.42ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 6.42ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  231. · POST asana request · provider traffic · /tasks · HTTP 201 · request cb4fa6c150cd · processing 15.03ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-restore-with-approval: account takeover restore (restore)",
    "notes": "Alert SEC-restore-with-approval for user 3ba93e46c0.\nDecision: restore (restore after investigation).\n- restore c40c7a7f-460e-4fd4-90bb-30a7c5d9e136 as admin (approval)\nRelease hold on cus_OK9ZI7JVYP1CEXOX (approval).",
    "workspace": "acme-security"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 15.03ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "340",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "data": {
    "name": "SEC-restore-with-approval: account takeover restore (restore)",
    "notes": "Alert SEC-restore-with-approval for user 3ba93e46c0.\nDecision: restore (restore after investigation).\n- restore c40c7a7f-460e-4fd4-90bb-30a7c5d9e136 as admin (approval)\nRelease hold on cus_OK9ZI7JVYP1CEXOX (approval).",
    "workspace": "acme-security"
  }
}

    Recorded response · HTTP 201

    {
  "data": {
    "name": "SEC-restore-with-approval: account takeover restore (restore)",
    "notes": "Alert SEC-restore-with-approval for user 3ba93e46c0.\nDecision: restore (restore after investigation).\n- restore c40c7a7f-460e-4fd4-90bb-30a7c5d9e136 as admin (approval)\nRelease hold on cus_OK9ZI7JVYP1CEXOX (approval).",
    "workspace": "acme-security"
  },
  "id": "b6c700c1-12cb-4c90-accb-f59d724c98fe"
}
  232. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request bd50b27b9564 · processing 14.34ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":unlock: SEC-restore-with-approval (restore): restore, restore after investigation. 2 change(s) need approval.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.34ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "187",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":unlock: SEC-restore-with-approval (restore): restore, restore after investigation. 2 change(s) need approval.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_f8f05d6caad248e08da0610272",
    "client_msg_id": "cli_6aec3f3f37c543b3aa90cb188b",
    "name": "item-b9660e",
    "old_name": "Sample Old",
    "parent_user_id": "par_41a26660afa541bb948629fe4d",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "17BRHDQ4IL.L3UDBP"
}
  233. · POST app request /invocations · restore with approval · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "decide",
  "runId": "restore-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "decision": "approve",
  "userId": "U_CISO"
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:08.411969+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "112",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "decide",
  "runId": "restore-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "decision": "approve",
  "userId": "U_CISO"
}

    Recorded response · HTTP 200

    {
  "runId": "restore-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restore_with_approval"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 0 privileged, 0 session(s)",
      "durationMs": 234
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 405
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "restore: restore after investigation",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "workos.restore_membership:c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
      "kind": "workos.restore_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "applied",
      "summary": {
        "user": "3ba93e46c0",
        "organization": "c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
        "role": "admin"
      },
      "attempts": 1,
      "ref": "om_GGB9DV2JA18WKJFOLJ0XBEA38S",
      "detail": {
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:45:07.851Z",
      "reconciled": null
    },
    {
      "id": "stripe.release_hold:cus_OK9ZI7JVYP1CEXOX",
      "kind": "stripe.release_hold",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "approval",
      "status": "applied",
      "summary": {
        "customer": "cus_OK9ZI7JVYP1CEXOX",
        "alert": "SEC-restore-with-approval"
      },
      "attempts": 1,
      "ref": "cus_OK9ZI7JVYP1CEXOX",
      "appliedAt": "2026-10-22T01:45:08.248Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-restore-with-approval",
        "mode": "restore"
      },
      "attempts": 1,
      "ref": "b6c700c1-12cb-4c90-accb-f59d724c98fe",
      "appliedAt": "2026-10-22T01:45:07.205Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "restore"
      },
      "attempts": 1,
      "ref": "17BRHDQ4IL.L3UDBP",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:45:07.374Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:45:07.376Z",
    "decision": "approve",
    "decidedBy": "U_CISO",
    "decidedAt": "2026-10-22T01:45:07.587Z"
  },
  "output": {
    "mode": "restore",
    "reason": "restore after investigation",
    "score": 0,
    "level": "low",
    "removals": 0,
    "removalsAuto": 0,
    "holds": 0,
    "revokeSessions": false,
    "restores": 1,
    "releases": 1
  },
  "events": [
    {
      "at": "2026-10-22T01:45:06.657Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:45:07.066Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:45:07.069Z",
      "msg": "planned 4 action(s): 2 need approval"
    },
    {
      "at": "2026-10-22T01:45:07.205Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:45:07.374Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:45:07.376Z",
      "msg": "awaiting approval"
    },
    {
      "at": "2026-10-22T01:45:07.587Z",
      "msg": "approved by U_CISO"
    },
    {
      "at": "2026-10-22T01:45:07.852Z",
      "msg": "workos.restore_membership:c40c7a7f-460e-4fd4-90bb-30a7c5d9e136: applied"
    },
    {
      "at": "2026-10-22T01:45:08.248Z",
      "msg": "stripe.release_hold:cus_OK9ZI7JVYP1CEXOX: applied"
    },
    {
      "at": "2026-10-22T01:45:08.249Z",
      "msg": "done (ok)"
    }
  ],
  "createdAt": "2026-10-22T01:45:06.657Z",
  "updatedAt": "2026-10-22T01:45:08.249Z",
  "result": "recorded"
}
  234. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 54b86ad440a9 · processing 0.61ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.61ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "43b2c095-d883-433c-8774-f54864fbeedd",
      "organization_id": "cdf9fc56-eac7-4ca1-a419-bfff6ce24cf2",
      "status": "active",
      "role": {
        "slug": "member"
      },
      "roles": [
        {
          "slug": "member"
        }
      ],
      "id": "om_KGFP2QAQ5SLX64Q98T68KHN457"
    }
  ],
  "list_metadata": {
    "before": "om_KGFP2QAQ5SLX64Q98T68KHN457",
    "after": null
  }
}
  235. · POST workos request · provider traffic · /user_management/organization_memberships · HTTP 201 · request a323eb6f12b7 · processing 0.91ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "user_id": "43b2c095-d883-433c-8774-f54864fbeedd",
  "organization_id": "c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
  "role_slug": "admin"
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.91ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "127",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "user_id": "43b2c095-d883-433c-8774-f54864fbeedd",
  "organization_id": "c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
  "role_slug": "admin"
}

    Recorded response · HTTP 201

    {
  "object": "organization_membership",
  "user_id": "43b2c095-d883-433c-8774-f54864fbeedd",
  "organization_id": "c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
  "status": "active",
  "role": {
    "slug": "admin"
  },
  "roles": [
    {
      "slug": "admin"
    }
  ],
  "id": "om_GGB9DV2JA18WKJFOLJ0XBEA38S"
}
  236. · GET stripe request · provider traffic · /v1/customers/cus_OK9ZI7JVYP1CEXOX · HTTP 200 · request 2e2d3169c5a1 · processing 17.57ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_OK9ZI7JVYP1CEXOX' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 17.57ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 43,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "email": "[email protected]",
  "id": "cus_OK9ZI7JVYP1CEXOX",
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "name": "Robin Customer",
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "SEC-restore-with-approval",
    "acme_ato_hold_at": "2026-10-22T01:45:04.471Z"
  }
}
  237. · POST stripe request · provider traffic · /v1/customers/cus_OK9ZI7JVYP1CEXOX · HTTP 200 · request a023ec91790b · processing 16.02ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_OK9ZI7JVYP1CEXOX' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-raw '{
  "metadata": {
    "acme_ato_hold": "",
    "acme_ato_hold_at": ""
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 16.02ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "60",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/x-www-form-urlencoded"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "metadata": {
    "acme_ato_hold": "",
    "acme_ato_hold_at": ""
  }
}

    Recorded response · HTTP 200

    {
  "email": "[email protected]",
  "name": "Robin Customer",
  "id": "cus_OK9ZI7JVYP1CEXOX",
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 43,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "",
    "acme_ato_hold_at": ""
  }
}
  238. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/restore_with_approval/runs · restore with approval · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/restore_with_approval/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:08.770320+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "restore-with-approval-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "restore_with_approval"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "2 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 664
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 467
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_OK9ZI7JVYP1CEXOX",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_OK9ZI7JVYP1CEXOX",
            "alert": "SEC-restore-with-approval"
          },
          "attempts": 1,
          "ref": "cus_OK9ZI7JVYP1CEXOX",
          "appliedAt": "2026-10-22T01:45:05.288Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_IE1HVZN3CNMLDZZMD6V66MISBE",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "3ba93e46c0",
            "organization": "c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_IE1HVZN3CNMLDZZMD6V66MISBE",
          "detail": {
            "organizationId": "c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:45:05.870Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-restore-with-approval",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "03f77336-dbcf-4762-8178-85875ed3b907",
          "appliedAt": "2026-10-22T01:45:06.021Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17LYFY4DC5.TMH9M1",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:45:06.194Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:45:04.471Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:45:05.136Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:45:05.139Z",
          "msg": "planned 4 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:45:05.288Z",
          "msg": "stripe.hold_customer:cus_OK9ZI7JVYP1CEXOX: applied"
        },
        {
          "at": "2026-10-22T01:45:05.870Z",
          "msg": "workos.remove_membership:om_IE1HVZN3CNMLDZZMD6V66MISBE: applied"
        },
        {
          "at": "2026-10-22T01:45:06.022Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:45:06.195Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:45:06.196Z",
          "msg": "done (ok)"
        }
      ],
      "createdAt": "2026-10-22T01:45:04.471Z",
      "updatedAt": "2026-10-22T01:45:06.196Z"
    },
    {
      "runId": "restore-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "restore_with_approval"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 0 privileged, 0 session(s)",
          "durationMs": 234
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 405
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "restore: restore after investigation",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "workos.restore_membership:c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
          "kind": "workos.restore_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "approval",
          "status": "applied",
          "summary": {
            "user": "3ba93e46c0",
            "organization": "c40c7a7f-460e-4fd4-90bb-30a7c5d9e136",
            "role": "admin"
          },
          "attempts": 1,
          "ref": "om_GGB9DV2JA18WKJFOLJ0XBEA38S",
          "detail": {
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:45:07.851Z",
          "reconciled": null
        },
        {
          "id": "stripe.release_hold:cus_OK9ZI7JVYP1CEXOX",
          "kind": "stripe.release_hold",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "approval",
          "status": "applied",
          "summary": {
            "customer": "cus_OK9ZI7JVYP1CEXOX",
            "alert": "SEC-restore-with-approval"
          },
          "attempts": 1,
          "ref": "cus_OK9ZI7JVYP1CEXOX",
          "appliedAt": "2026-10-22T01:45:08.248Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-restore-with-approval",
            "mode": "restore"
          },
          "attempts": 1,
          "ref": "b6c700c1-12cb-4c90-accb-f59d724c98fe",
          "appliedAt": "2026-10-22T01:45:07.205Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "restore"
          },
          "attempts": 1,
          "ref": "17BRHDQ4IL.L3UDBP",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:45:07.374Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "approval": {
        "approvers": [
          "U_CISO"
        ],
        "expiresAt": "2026-10-23T01:45:07.376Z",
        "decision": "approve",
        "decidedBy": "U_CISO",
        "decidedAt": "2026-10-22T01:45:07.587Z"
      },
      "output": {
        "mode": "restore",
        "reason": "restore after investigation",
        "score": 0,
        "level": "low",
        "removals": 0,
        "removalsAuto": 0,
        "holds": 0,
        "revokeSessions": false,
        "restores": 1,
        "releases": 1
      },
      "events": [
        {
          "at": "2026-10-22T01:45:06.657Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:45:07.066Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:45:07.069Z",
          "msg": "planned 4 action(s): 2 need approval"
        },
        {
          "at": "2026-10-22T01:45:07.205Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:45:07.374Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:45:07.376Z",
          "msg": "awaiting approval"
        },
        {
          "at": "2026-10-22T01:45:07.587Z",
          "msg": "approved by U_CISO"
        },
        {
          "at": "2026-10-22T01:45:07.852Z",
          "msg": "workos.restore_membership:c40c7a7f-460e-4fd4-90bb-30a7c5d9e136: applied"
        },
        {
          "at": "2026-10-22T01:45:08.248Z",
          "msg": "stripe.release_hold:cus_OK9ZI7JVYP1CEXOX: applied"
        },
        {
          "at": "2026-10-22T01:45:08.249Z",
          "msg": "done (ok)"
        }
      ],
      "createdAt": "2026-10-22T01:45:06.657Z",
      "updatedAt": "2026-10-22T01:45:08.249Z"
    }
  ]
}
  239. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/restore_leaves_other_hold/runs · restore leaves other hold · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/restore_leaves_other_hold/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:08.987801+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  240. · POST app request /invocations · restore leaves other hold · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "restore-leaves-other-hold-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "restore",
    "alertId": "SEC-restore-leaves-other-hold",
    "email": "[email protected]",
    "memberships": [],
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restore_leaves_other_hold"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:09.855457+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "425",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "restore-leaves-other-hold-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "restore",
    "alertId": "SEC-restore-leaves-other-hold",
    "email": "[email protected]",
    "memberships": [],
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restore_leaves_other_hold"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "restore-leaves-other-hold-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restore_leaves_other_hold"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 0 privileged, 0 session(s)",
      "durationMs": 364
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 252
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "restore: restore after investigation",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-restore-leaves-other-hold",
        "mode": "restore"
      },
      "attempts": 1,
      "ref": "95c0c433-1dfc-4c31-b177-c81f98c06fe8",
      "appliedAt": "2026-10-22T01:45:09.534Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "restore"
      },
      "attempts": 1,
      "ref": "17CO1K8ZOJ.5576GA",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:45:09.697Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 2,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "restore",
    "reason": "restore after investigation",
    "score": 0,
    "level": "low",
    "removals": 0,
    "removalsAuto": 0,
    "holds": 0,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:45:09.037Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:45:09.403Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:45:09.405Z",
      "msg": "planned 2 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:45:09.535Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:45:09.697Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:45:09.698Z",
      "msg": "done (ok)"
    }
  ],
  "createdAt": "2026-10-22T01:45:09.037Z",
  "updatedAt": "2026-10-22T01:45:09.698Z",
  "duplicate": false
}
  241. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request e01a454ee738 · processing 15.92ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 15.92ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "metadata": {
        "acme_ato_hold": "SEC-OTHER-0001"
      },
      "id": "cus_UIIMWGBD3GOBJF0V",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 87,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  242. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request b741739289dd · processing 1.86ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.86ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "10743a25-ea79-4198-80c6-7d30b5a33dd0",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/2ff91ddd",
      "email_verified": true,
      "external_id": "ext_9b00155661514445aa8f50580b",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  243. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request 8fca0613257d · processing 5.85ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 5.85ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  244. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request b315b8392480 · processing 0.76ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.76ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "10743a25-ea79-4198-80c6-7d30b5a33dd0",
      "organization_id": "8322237c-3d90-4832-a501-b01c113b7c05",
      "status": "active",
      "role": {
        "slug": "member"
      },
      "roles": [
        {
          "slug": "member"
        }
      ],
      "id": "om_11KYQHUAF3HHGW5XDN8LF9V6AY"
    }
  ],
  "list_metadata": {
    "before": "om_11KYQHUAF3HHGW5XDN8LF9V6AY",
    "after": null
  }
}
  245. · POST asana request · provider traffic · /tasks · HTTP 201 · request c645836a2e52 · processing 13.23ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-restore-leaves-other-hold: account takeover restore (restore)",
    "notes": "Alert SEC-restore-leaves-other-hold for user 5457fab047.\nDecision: restore (restore after investigation).",
    "workspace": "acme-security"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 13.23ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "230",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "data": {
    "name": "SEC-restore-leaves-other-hold: account takeover restore (restore)",
    "notes": "Alert SEC-restore-leaves-other-hold for user 5457fab047.\nDecision: restore (restore after investigation).",
    "workspace": "acme-security"
  }
}

    Recorded response · HTTP 201

    {
  "data": {
    "name": "SEC-restore-leaves-other-hold: account takeover restore (restore)",
    "notes": "Alert SEC-restore-leaves-other-hold for user 5457fab047.\nDecision: restore (restore after investigation).",
    "workspace": "acme-security"
  },
  "id": "95c0c433-1dfc-4c31-b177-c81f98c06fe8"
}
  246. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request 8db05c98d9f1 · processing 14.23ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":unlock: SEC-restore-leaves-other-hold (restore): restore, restore after investigation.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.23ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "164",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":unlock: SEC-restore-leaves-other-hold (restore): restore, restore after investigation.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_5f319571e7094920bf080356a4",
    "client_msg_id": "cli_803b3c6eea904a1b97c87eb4ea",
    "name": "item-66e033",
    "old_name": "Sample Old",
    "parent_user_id": "par_bfc599c78b6b4233b32d5120ce",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "17CO1K8ZOJ.5576GA"
}
  247. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/restore_leaves_other_hold/runs · restore leaves other hold · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/restore_leaves_other_hold/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:10.163116+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "restore-leaves-other-hold-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "restore_leaves_other_hold"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 0 privileged, 0 session(s)",
          "durationMs": 364
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 252
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "restore: restore after investigation",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-restore-leaves-other-hold",
            "mode": "restore"
          },
          "attempts": 1,
          "ref": "95c0c433-1dfc-4c31-b177-c81f98c06fe8",
          "appliedAt": "2026-10-22T01:45:09.534Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "restore"
          },
          "attempts": 1,
          "ref": "17CO1K8ZOJ.5576GA",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:45:09.697Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 2,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "restore",
        "reason": "restore after investigation",
        "score": 0,
        "level": "low",
        "removals": 0,
        "removalsAuto": 0,
        "holds": 0,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:45:09.037Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:45:09.403Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:45:09.405Z",
          "msg": "planned 2 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:45:09.535Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:45:09.697Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:45:09.698Z",
          "msg": "done (ok)"
        }
      ],
      "createdAt": "2026-10-22T01:45:09.037Z",
      "updatedAt": "2026-10-22T01:45:09.698Z"
    }
  ]
}
  248. · POST app request /invocations · restore leaves other hold · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "restore-leaves-other-hold-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "restore",
    "alertId": "SEC-restore-leaves-other-hold",
    "email": "[email protected]",
    "memberships": [],
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restore_leaves_other_hold"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:10.376737+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "425",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "restore-leaves-other-hold-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "restore",
    "alertId": "SEC-restore-leaves-other-hold",
    "email": "[email protected]",
    "memberships": [],
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restore_leaves_other_hold"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "restore-leaves-other-hold-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restore_leaves_other_hold"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 0 privileged, 0 session(s)",
      "durationMs": 364
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 252
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "restore: restore after investigation",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-restore-leaves-other-hold",
        "mode": "restore"
      },
      "attempts": 1,
      "ref": "95c0c433-1dfc-4c31-b177-c81f98c06fe8",
      "appliedAt": "2026-10-22T01:45:09.534Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "restore"
      },
      "attempts": 1,
      "ref": "17CO1K8ZOJ.5576GA",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:45:09.697Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 2,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "restore",
    "reason": "restore after investigation",
    "score": 0,
    "level": "low",
    "removals": 0,
    "removalsAuto": 0,
    "holds": 0,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:45:09.037Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:45:09.403Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:45:09.405Z",
      "msg": "planned 2 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:45:09.535Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:45:09.697Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:45:09.698Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:45:10.216Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:45:09.037Z",
  "updatedAt": "2026-10-22T01:45:10.216Z",
  "duplicate": true
}
  249. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/restore_leaves_other_hold/runs · restore leaves other hold · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/restore_leaves_other_hold/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:10.675077+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "restore-leaves-other-hold-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "restore_leaves_other_hold"
      },
      "duplicateStarts": 1,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 0 privileged, 0 session(s)",
          "durationMs": 364
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 252
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "restore: restore after investigation",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-restore-leaves-other-hold",
            "mode": "restore"
          },
          "attempts": 1,
          "ref": "95c0c433-1dfc-4c31-b177-c81f98c06fe8",
          "appliedAt": "2026-10-22T01:45:09.534Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "restore"
          },
          "attempts": 1,
          "ref": "17CO1K8ZOJ.5576GA",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:45:09.697Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 2,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "restore",
        "reason": "restore after investigation",
        "score": 0,
        "level": "low",
        "removals": 0,
        "removalsAuto": 0,
        "holds": 0,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:45:09.037Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:45:09.403Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:45:09.405Z",
          "msg": "planned 2 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:45:09.535Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:45:09.697Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:45:09.698Z",
          "msg": "done (ok)"
        },
        {
          "at": "2026-10-22T01:45:10.216Z",
          "msg": "duplicate start ignored"
        }
      ],
      "createdAt": "2026-10-22T01:45:09.037Z",
      "updatedAt": "2026-10-22T01:45:10.216Z"
    }
  ]
}
  250. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/workos_auth_failure/runs · workos auth failure · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/workos_auth_failure/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:10.885052+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  251. · POST app request /invocations · workos auth failure · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "workos-auth-failure-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-workos-auth-failure",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "workos_auth_failure"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:11.711278+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "449",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "workos-auth-failure-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-workos-auth-failure",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "workos_auth_failure"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "workos-auth-failure-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "partial",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "workos_auth_failure"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "failed",
      "error": "workos 401 unauthorized: GET /user_management/users → 401 unauthorized",
      "errorCode": "workos:unauthorized",
      "durationMs": 106
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 280
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "blocked: identity directory could not be read; contain by hand",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-workos-auth-failure",
        "mode": "blocked"
      },
      "attempts": 1,
      "ref": "9d86b94b-c08b-4abe-9b2b-73ee181a7c35",
      "appliedAt": "2026-10-22T01:45:11.362Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "blocked"
      },
      "attempts": 1,
      "ref": "17RBCB3MIE.6N8FKR",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:45:11.546Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 2,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "blocked",
    "reason": "identity directory could not be read; contain by hand",
    "score": 75,
    "level": "high",
    "removals": 0,
    "removalsAuto": 0,
    "holds": 0,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:45:10.922Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:45:11.204Z",
      "msg": "agents: identity=failed, billing=ok"
    },
    {
      "at": "2026-10-22T01:45:11.207Z",
      "msg": "planned 2 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:45:11.362Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:45:11.546Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:45:11.548Z",
      "msg": "done (partial)"
    }
  ],
  "createdAt": "2026-10-22T01:45:10.922Z",
  "updatedAt": "2026-10-22T01:45:11.548Z",
  "duplicate": false
}
  252. · GET workos request · workos auth failure · /user_management/users · HTTP 401 · processing 0.23ms
    View sanitized request and response

    Curl-style request view

    curl --request GET '<WORKOS_TWIN_BASE_URL>/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL was not recorded. Provider processing: 0.23ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 401

    {
  "errors": [
    {
      "status": "401",
      "code": "unauthorized",
      "detail": "Invalid API key or expired credentials"
    }
  ]
}
  253. · GET workos request · provider traffic · /user_management/users · HTTP 401 · request e0c6c876f52a · processing 0.23ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.23ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 401

    {
  "errors": [
    {
      "status": "401",
      "code": "unauthorized",
      "detail": "Invalid API key or expired credentials"
    }
  ]
}
  254. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request 026374633373 · processing 14.84ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.84ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_JH5GX92GJ55YDZLV",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 49,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  255. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request 40bc4d9ca8a3 · processing 5.85ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 5.85ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  256. · POST asana request · provider traffic · /tasks · HTTP 201 · request 4d13035ab154 · processing 12.33ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-workos-auth-failure: account takeover contain (blocked)",
    "notes": "Alert SEC-workos-auth-failure for user 3e0ce9f2f4 from idp-risk: mfa_reset, admin_role_granted.\nDecision: blocked (identity directory could not be read; contain by hand).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.",
    "workspace": "acme-security"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 12.33ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "346",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "data": {
    "name": "SEC-workos-auth-failure: account takeover contain (blocked)",
    "notes": "Alert SEC-workos-auth-failure for user 3e0ce9f2f4 from idp-risk: mfa_reset, admin_role_granted.\nDecision: blocked (identity directory could not be read; contain by hand).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.",
    "workspace": "acme-security"
  }
}

    Recorded response · HTTP 201

    {
  "data": {
    "name": "SEC-workos-auth-failure: account takeover contain (blocked)",
    "notes": "Alert SEC-workos-auth-failure for user 3e0ce9f2f4 from idp-risk: mfa_reset, admin_role_granted.\nDecision: blocked (identity directory could not be read; contain by hand).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.",
    "workspace": "acme-security"
  },
  "id": "9d86b94b-c08b-4abe-9b2b-73ee181a7c35"
}
  257. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request bd1efb33a60d · processing 13.85ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":rotating_light: SEC-workos-auth-failure (contain): blocked, identity directory could not be read; contain by hand.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 13.85ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "192",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":rotating_light: SEC-workos-auth-failure (contain): blocked, identity directory could not be read; contain by hand.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_ea9c7bc266dd4f25aaf27e2809",
    "client_msg_id": "cli_af6402aea1b94a07adfc502e7e",
    "name": "item-c22256",
    "old_name": "Sample Old",
    "parent_user_id": "par_62fc9c5d1116447683ba2e2671",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "17RBCB3MIE.6N8FKR"
}
  258. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/workos_auth_failure/runs · workos auth failure · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/workos_auth_failure/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:12.019488+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "workos-auth-failure-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "partial",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "workos_auth_failure"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "failed",
          "error": "workos 401 unauthorized: GET /user_management/users → 401 unauthorized",
          "errorCode": "workos:unauthorized",
          "durationMs": 106
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 280
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "blocked: identity directory could not be read; contain by hand",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-workos-auth-failure",
            "mode": "blocked"
          },
          "attempts": 1,
          "ref": "9d86b94b-c08b-4abe-9b2b-73ee181a7c35",
          "appliedAt": "2026-10-22T01:45:11.362Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "blocked"
          },
          "attempts": 1,
          "ref": "17RBCB3MIE.6N8FKR",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:45:11.546Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 2,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "blocked",
        "reason": "identity directory could not be read; contain by hand",
        "score": 75,
        "level": "high",
        "removals": 0,
        "removalsAuto": 0,
        "holds": 0,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:45:10.922Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:45:11.204Z",
          "msg": "agents: identity=failed, billing=ok"
        },
        {
          "at": "2026-10-22T01:45:11.207Z",
          "msg": "planned 2 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:45:11.362Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:45:11.546Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:45:11.548Z",
          "msg": "done (partial)"
        }
      ],
      "createdAt": "2026-10-22T01:45:10.922Z",
      "updatedAt": "2026-10-22T01:45:11.548Z"
    }
  ]
}
  259. · POST app request /invocations · workos auth failure · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "workos-auth-failure-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-workos-auth-failure",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "workos_auth_failure"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:12.217347+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "449",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "workos-auth-failure-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-workos-auth-failure",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "workos_auth_failure"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "workos-auth-failure-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "partial",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "workos_auth_failure"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "failed",
      "error": "workos 401 unauthorized: GET /user_management/users → 401 unauthorized",
      "errorCode": "workos:unauthorized",
      "durationMs": 106
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 280
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "blocked: identity directory could not be read; contain by hand",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-workos-auth-failure",
        "mode": "blocked"
      },
      "attempts": 1,
      "ref": "9d86b94b-c08b-4abe-9b2b-73ee181a7c35",
      "appliedAt": "2026-10-22T01:45:11.362Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "blocked"
      },
      "attempts": 1,
      "ref": "17RBCB3MIE.6N8FKR",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:45:11.546Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 2,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "blocked",
    "reason": "identity directory could not be read; contain by hand",
    "score": 75,
    "level": "high",
    "removals": 0,
    "removalsAuto": 0,
    "holds": 0,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:45:10.922Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:45:11.204Z",
      "msg": "agents: identity=failed, billing=ok"
    },
    {
      "at": "2026-10-22T01:45:11.207Z",
      "msg": "planned 2 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:45:11.362Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:45:11.546Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:45:11.548Z",
      "msg": "done (partial)"
    },
    {
      "at": "2026-10-22T01:45:12.056Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:45:10.922Z",
  "updatedAt": "2026-10-22T01:45:12.056Z",
  "duplicate": true
}
  260. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/workos_auth_failure/runs · workos auth failure · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/workos_auth_failure/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:12.527019+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "workos-auth-failure-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "partial",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "workos_auth_failure"
      },
      "duplicateStarts": 1,
      "agents": [
        {
          "name": "identity",
          "status": "failed",
          "error": "workos 401 unauthorized: GET /user_management/users → 401 unauthorized",
          "errorCode": "workos:unauthorized",
          "durationMs": 106
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 280
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "blocked: identity directory could not be read; contain by hand",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-workos-auth-failure",
            "mode": "blocked"
          },
          "attempts": 1,
          "ref": "9d86b94b-c08b-4abe-9b2b-73ee181a7c35",
          "appliedAt": "2026-10-22T01:45:11.362Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "blocked"
          },
          "attempts": 1,
          "ref": "17RBCB3MIE.6N8FKR",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:45:11.546Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 2,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "blocked",
        "reason": "identity directory could not be read; contain by hand",
        "score": 75,
        "level": "high",
        "removals": 0,
        "removalsAuto": 0,
        "holds": 0,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:45:10.922Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:45:11.204Z",
          "msg": "agents: identity=failed, billing=ok"
        },
        {
          "at": "2026-10-22T01:45:11.207Z",
          "msg": "planned 2 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:45:11.362Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:45:11.546Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:45:11.548Z",
          "msg": "done (partial)"
        },
        {
          "at": "2026-10-22T01:45:12.056Z",
          "msg": "duplicate start ignored"
        }
      ],
      "createdAt": "2026-10-22T01:45:10.922Z",
      "updatedAt": "2026-10-22T01:45:12.056Z"
    }
  ]
}
  261. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/stripe_rate_limited/runs · stripe rate limited · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/stripe_rate_limited/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:12.727767+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  262. · POST app request /invocations · stripe rate limited · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "stripe-rate-limited-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-stripe-rate-limited",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "stripe_rate_limited"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:14.737523+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "449",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "stripe-rate-limited-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-stripe-rate-limited",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "stripe_rate_limited"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "stripe-rate-limited-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "partial",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "stripe_rate_limited"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 566
    },
    {
      "name": "billing",
      "status": "failed",
      "error": "stripe 429 rate_limit: GET /v1/customers → 429 rate_limit",
      "errorCode": "stripe:rate_limit",
      "durationMs": 1042
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 1
    }
  ],
  "actions": [
    {
      "id": "workos.remove_membership:om_EBRABBFIE5WZQFMI3LH1YVNWDB",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "35557b1f3a",
        "organization": "0ed076b6-fe72-463c-9dc3-4ce27e02ad25",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_EBRABBFIE5WZQFMI3LH1YVNWDB",
      "detail": {
        "organizationId": "0ed076b6-fe72-463c-9dc3-4ce27e02ad25",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:45:14.169Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-stripe-rate-limited",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "aec1e1b5-afed-4da5-b428-ff4a8209af28",
      "appliedAt": "2026-10-22T01:45:14.423Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "171RWSIQJJ.PK2CDT",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:45:14.572Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 3,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 0,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:45:12.772Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:45:13.817Z",
      "msg": "agents: identity=ok, billing=failed"
    },
    {
      "at": "2026-10-22T01:45:13.820Z",
      "msg": "planned 3 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:45:14.169Z",
      "msg": "workos.remove_membership:om_EBRABBFIE5WZQFMI3LH1YVNWDB: applied"
    },
    {
      "at": "2026-10-22T01:45:14.424Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:45:14.572Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:45:14.574Z",
      "msg": "done (partial)"
    }
  ],
  "createdAt": "2026-10-22T01:45:12.772Z",
  "updatedAt": "2026-10-22T01:45:14.574Z",
  "duplicate": false
}
  263. · GET stripe request · stripe rate limited · /v1/customers · HTTP 429 · processing 0.61ms
    View sanitized request and response

    Curl-style request view

    curl --request GET '<STRIPE_TWIN_BASE_URL>/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL was not recorded. Provider processing: 0.61ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 429

    {
  "error": {
    "type": "invalid_request_error",
    "code": "rate_limit",
    "doc_url": "https://stripe.com/docs/error-codes/rate-limit",
    "message": "Too many requests hit the API too quickly. We recommend an exponential backoff of your requests."
  }
}
  264. · GET stripe request · provider traffic · /v1/customers · HTTP 429 · request 5aaff6227714 · processing 0.61ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.61ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 429

    {
  "error": {
    "type": "invalid_request_error",
    "code": "rate_limit",
    "doc_url": "https://stripe.com/docs/error-codes/rate-limit",
    "message": "Too many requests hit the API too quickly. We recommend an exponential backoff of your requests."
  }
}
  265. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request 592252157f12 · processing 1.89ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.89ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "7fe056a5-1b54-4870-8141-5161f659ff26",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/b4877464",
      "email_verified": true,
      "external_id": "ext_227fb91de02b4672876e620e59",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  266. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 18b77f5cf59f · processing 0.55ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.55ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "7fe056a5-1b54-4870-8141-5161f659ff26",
      "organization_id": "0ed076b6-fe72-463c-9dc3-4ce27e02ad25",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_EBRABBFIE5WZQFMI3LH1YVNWDB"
    }
  ],
  "list_metadata": {
    "before": "om_EBRABBFIE5WZQFMI3LH1YVNWDB",
    "after": null
  }
}
  267. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request ac59ddd7be16 · processing 0.75ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.75ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "7fe056a5-1b54-4870-8141-5161f659ff26",
      "organization_id": "0ed076b6-fe72-463c-9dc3-4ce27e02ad25",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_EBRABBFIE5WZQFMI3LH1YVNWDB"
    },
    {
      "object": "organization_membership",
      "user_id": "ee5af7ab-3b0e-4efe-9e5a-0a1aa113c6ec",
      "organization_id": "0ed076b6-fe72-463c-9dc3-4ce27e02ad25",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_77UE3WGT113FY748945II3JYNE"
    }
  ],
  "list_metadata": {
    "before": "om_EBRABBFIE5WZQFMI3LH1YVNWDB",
    "after": null
  }
}
  268. · GET stripe request · stripe rate limited · /v1/customers · HTTP 429 · processing 0.56ms
    View sanitized request and response

    Curl-style request view

    curl --request GET '<STRIPE_TWIN_BASE_URL>/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL was not recorded. Provider processing: 0.56ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 429

    {
  "error": {
    "type": "invalid_request_error",
    "code": "rate_limit",
    "doc_url": "https://stripe.com/docs/error-codes/rate-limit",
    "message": "Too many requests hit the API too quickly. We recommend an exponential backoff of your requests."
  }
}
  269. · GET stripe request · provider traffic · /v1/customers · HTTP 429 · request 91e9ef2f20c2 · processing 0.56ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.56ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 429

    {
  "error": {
    "type": "invalid_request_error",
    "code": "rate_limit",
    "doc_url": "https://stripe.com/docs/error-codes/rate-limit",
    "message": "Too many requests hit the API too quickly. We recommend an exponential backoff of your requests."
  }
}
  270. · GET workos request · provider traffic · /user_management/users/7fe056a5-1b54-4870-8141-5161f659ff26/sessions · HTTP 200 · request fb96315a7fc5 · processing 1.57ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/7fe056a5-1b54-4870-8141-5161f659ff26/sessions' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.57ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "items": [
    {
      "session_id": "[redacted]",
      "name": "Sample Session 1",
      "id": "65028467-bd15-479d-b741-4630a662fd42"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 2",
      "id": "b0b28c4e-bdc3-4ed9-9483-fdd724aeb3ef"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 3",
      "id": "ab7c709c-c32d-4aa0-911b-52c680ee248f"
    }
  ]
}
  271. · GET stripe request · stripe rate limited · /v1/customers · HTTP 429 · processing 0.62ms
    View sanitized request and response

    Curl-style request view

    curl --request GET '<STRIPE_TWIN_BASE_URL>/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL was not recorded. Provider processing: 0.62ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 429

    {
  "error": {
    "type": "invalid_request_error",
    "code": "rate_limit",
    "doc_url": "https://stripe.com/docs/error-codes/rate-limit",
    "message": "Too many requests hit the API too quickly. We recommend an exponential backoff of your requests."
  }
}
  272. · GET stripe request · provider traffic · /v1/customers · HTTP 429 · request 92c415832131 · processing 0.62ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.62ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 429

    {
  "error": {
    "type": "invalid_request_error",
    "code": "rate_limit",
    "doc_url": "https://stripe.com/docs/error-codes/rate-limit",
    "message": "Too many requests hit the API too quickly. We recommend an exponential backoff of your requests."
  }
}
  273. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 868b6812a656 · processing 0.54ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.54ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "7fe056a5-1b54-4870-8141-5161f659ff26",
      "organization_id": "0ed076b6-fe72-463c-9dc3-4ce27e02ad25",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_EBRABBFIE5WZQFMI3LH1YVNWDB"
    }
  ],
  "list_metadata": {
    "before": "om_EBRABBFIE5WZQFMI3LH1YVNWDB",
    "after": null
  }
}
  274. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request a1dbb08ff4d4 · processing 0.58ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.58ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "7fe056a5-1b54-4870-8141-5161f659ff26",
      "organization_id": "0ed076b6-fe72-463c-9dc3-4ce27e02ad25",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_EBRABBFIE5WZQFMI3LH1YVNWDB"
    },
    {
      "object": "organization_membership",
      "user_id": "ee5af7ab-3b0e-4efe-9e5a-0a1aa113c6ec",
      "organization_id": "0ed076b6-fe72-463c-9dc3-4ce27e02ad25",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_77UE3WGT113FY748945II3JYNE"
    }
  ],
  "list_metadata": {
    "before": "om_EBRABBFIE5WZQFMI3LH1YVNWDB",
    "after": null
  }
}
  275. · DELETE workos request · provider traffic · /user_management/organization_memberships/om_EBRABBFIE5WZQFMI3LH1YVNWDB · HTTP 204 · request fe3f703fa79d · processing 0.83ms
  276. · POST asana request · provider traffic · /tasks · HTTP 201 · request 97465978b02c · processing 14.83ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-stripe-rate-limited: account takeover contain (contain)",
    "notes": "Alert SEC-stripe-rate-limited for user 35557b1f3a from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40; billing unread: no refund evidence, no hold.\nPrivileged memberships removed (restore input):\n- 0ed076b6-fe72-463c-9dc3-4ce27e02ad25 admin (om_EBRABBFIE5WZQFMI3LH1YVNWDB) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-stripe-rate-limited\",\"memberships\":[{\"organizationId\":\"0ed076b6-fe72-463c-9dc3-4ce27e02ad25\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 14.83ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "678",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "data": {
    "name": "SEC-stripe-rate-limited: account takeover contain (contain)",
    "notes": "Alert SEC-stripe-rate-limited for user 35557b1f3a from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40; billing unread: no refund evidence, no hold.\nPrivileged memberships removed (restore input):\n- 0ed076b6-fe72-463c-9dc3-4ce27e02ad25 admin (om_EBRABBFIE5WZQFMI3LH1YVNWDB) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-stripe-rate-limited\",\"memberships\":[{\"organizationId\":\"0ed076b6-fe72-463c-9dc3-4ce27e02ad25\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}

    Recorded response · HTTP 201

    {
  "data": {
    "name": "SEC-stripe-rate-limited: account takeover contain (contain)",
    "notes": "Alert SEC-stripe-rate-limited for user 35557b1f3a from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40; billing unread: no refund evidence, no hold.\nPrivileged memberships removed (restore input):\n- 0ed076b6-fe72-463c-9dc3-4ce27e02ad25 admin (om_EBRABBFIE5WZQFMI3LH1YVNWDB) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-stripe-rate-limited\",\"memberships\":[{\"organizationId\":\"0ed076b6-fe72-463c-9dc3-4ce27e02ad25\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  },
  "id": "aec1e1b5-afed-4da5-b428-ff4a8209af28"
}
  277. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request 16a443ef6c25 · processing 15.81ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-stripe-rate-limited (contain): contain, high risk (score 75). 1 privileged membership(s).",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 15.81ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "177",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-stripe-rate-limited (contain): contain, high risk (score 75). 1 privileged membership(s).",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_632e46b24ca04b9f9e658c41ac",
    "client_msg_id": "cli_f690a8e81912463bbec3e50d6d",
    "name": "item-a48a78",
    "old_name": "Sample Old",
    "parent_user_id": "par_551ec253962d42f3a2fdd2ba62",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "171RWSIQJJ.PK2CDT"
}
  278. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/stripe_rate_limited/runs · stripe rate limited · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/stripe_rate_limited/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:15.045369+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "stripe-rate-limited-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "partial",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "stripe_rate_limited"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 566
        },
        {
          "name": "billing",
          "status": "failed",
          "error": "stripe 429 rate_limit: GET /v1/customers → 429 rate_limit",
          "errorCode": "stripe:rate_limit",
          "durationMs": 1042
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 1
        }
      ],
      "actions": [
        {
          "id": "workos.remove_membership:om_EBRABBFIE5WZQFMI3LH1YVNWDB",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "35557b1f3a",
            "organization": "0ed076b6-fe72-463c-9dc3-4ce27e02ad25",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_EBRABBFIE5WZQFMI3LH1YVNWDB",
          "detail": {
            "organizationId": "0ed076b6-fe72-463c-9dc3-4ce27e02ad25",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:45:14.169Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-stripe-rate-limited",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "aec1e1b5-afed-4da5-b428-ff4a8209af28",
          "appliedAt": "2026-10-22T01:45:14.423Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "171RWSIQJJ.PK2CDT",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:45:14.572Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 3,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 1,
        "holds": 0,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:45:12.772Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:45:13.817Z",
          "msg": "agents: identity=ok, billing=failed"
        },
        {
          "at": "2026-10-22T01:45:13.820Z",
          "msg": "planned 3 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:45:14.169Z",
          "msg": "workos.remove_membership:om_EBRABBFIE5WZQFMI3LH1YVNWDB: applied"
        },
        {
          "at": "2026-10-22T01:45:14.424Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:45:14.572Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:45:14.574Z",
          "msg": "done (partial)"
        }
      ],
      "createdAt": "2026-10-22T01:45:12.772Z",
      "updatedAt": "2026-10-22T01:45:14.574Z"
    }
  ]
}
  279. · POST app request /invocations · stripe rate limited · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "stripe-rate-limited-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-stripe-rate-limited",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "stripe_rate_limited"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:15.258826+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "449",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "stripe-rate-limited-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-stripe-rate-limited",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "stripe_rate_limited"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "stripe-rate-limited-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "partial",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "stripe_rate_limited"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 566
    },
    {
      "name": "billing",
      "status": "failed",
      "error": "stripe 429 rate_limit: GET /v1/customers → 429 rate_limit",
      "errorCode": "stripe:rate_limit",
      "durationMs": 1042
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 1
    }
  ],
  "actions": [
    {
      "id": "workos.remove_membership:om_EBRABBFIE5WZQFMI3LH1YVNWDB",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "35557b1f3a",
        "organization": "0ed076b6-fe72-463c-9dc3-4ce27e02ad25",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_EBRABBFIE5WZQFMI3LH1YVNWDB",
      "detail": {
        "organizationId": "0ed076b6-fe72-463c-9dc3-4ce27e02ad25",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:45:14.169Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-stripe-rate-limited",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "aec1e1b5-afed-4da5-b428-ff4a8209af28",
      "appliedAt": "2026-10-22T01:45:14.423Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "171RWSIQJJ.PK2CDT",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:45:14.572Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 3,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 0,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:45:12.772Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:45:13.817Z",
      "msg": "agents: identity=ok, billing=failed"
    },
    {
      "at": "2026-10-22T01:45:13.820Z",
      "msg": "planned 3 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:45:14.169Z",
      "msg": "workos.remove_membership:om_EBRABBFIE5WZQFMI3LH1YVNWDB: applied"
    },
    {
      "at": "2026-10-22T01:45:14.424Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:45:14.572Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:45:14.574Z",
      "msg": "done (partial)"
    },
    {
      "at": "2026-10-22T01:45:15.090Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:45:12.772Z",
  "updatedAt": "2026-10-22T01:45:15.090Z",
  "duplicate": true
}
  280. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/stripe_rate_limited/runs · stripe rate limited · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/stripe_rate_limited/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:15.553705+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "stripe-rate-limited-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "partial",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "stripe_rate_limited"
      },
      "duplicateStarts": 1,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 566
        },
        {
          "name": "billing",
          "status": "failed",
          "error": "stripe 429 rate_limit: GET /v1/customers → 429 rate_limit",
          "errorCode": "stripe:rate_limit",
          "durationMs": 1042
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 1
        }
      ],
      "actions": [
        {
          "id": "workos.remove_membership:om_EBRABBFIE5WZQFMI3LH1YVNWDB",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "35557b1f3a",
            "organization": "0ed076b6-fe72-463c-9dc3-4ce27e02ad25",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_EBRABBFIE5WZQFMI3LH1YVNWDB",
          "detail": {
            "organizationId": "0ed076b6-fe72-463c-9dc3-4ce27e02ad25",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:45:14.169Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-stripe-rate-limited",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "aec1e1b5-afed-4da5-b428-ff4a8209af28",
          "appliedAt": "2026-10-22T01:45:14.423Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "171RWSIQJJ.PK2CDT",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:45:14.572Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 3,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 1,
        "holds": 0,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:45:12.772Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:45:13.817Z",
          "msg": "agents: identity=ok, billing=failed"
        },
        {
          "at": "2026-10-22T01:45:13.820Z",
          "msg": "planned 3 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:45:14.169Z",
          "msg": "workos.remove_membership:om_EBRABBFIE5WZQFMI3LH1YVNWDB: applied"
        },
        {
          "at": "2026-10-22T01:45:14.424Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:45:14.572Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:45:14.574Z",
          "msg": "done (partial)"
        },
        {
          "at": "2026-10-22T01:45:15.090Z",
          "msg": "duplicate start ignored"
        }
      ],
      "createdAt": "2026-10-22T01:45:12.772Z",
      "updatedAt": "2026-10-22T01:45:15.090Z"
    }
  ]
}
  281. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/slack_rate_limited/runs · slack rate limited · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/slack_rate_limited/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:15.766412+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  282. · POST app request /invocations · slack rate limited · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "slack-rate-limited-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-slack-rate-limited",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "slack_rate_limited"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:25.729829+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "445",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "slack-rate-limited-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-slack-rate-limited",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "slack_rate_limited"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "slack-rate-limited-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "partial",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "slack_rate_limited"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 489
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 320
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_2A5SQZ7FXFG6FNLQ",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_2A5SQZ7FXFG6FNLQ",
        "alert": "SEC-slack-rate-limited"
      },
      "attempts": 1,
      "ref": "cus_2A5SQZ7FXFG6FNLQ",
      "appliedAt": "2026-10-22T01:45:16.439Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_JDKEGYKNHM91C20000ZHEBRR8D",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "91675decc2",
        "organization": "82a7162d-0680-43fc-8b8c-c2bc5645aa73",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_JDKEGYKNHM91C20000ZHEBRR8D",
      "detail": {
        "organizationId": "82a7162d-0680-43fc-8b8c-c2bc5645aa73",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:45:16.823Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-slack-rate-limited",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "35075277-9c6e-4f86-bdab-ce34fd307595",
      "appliedAt": "2026-10-22T01:45:16.949Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "failed",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "error": "slack 429 ratelimited: POST /api/chat.postMessage → 429 ratelimited",
      "errorCode": "slack:ratelimited",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 3,
    "failed": 1,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:45:15.815Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:45:16.307Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:45:16.310Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:45:16.439Z",
      "msg": "stripe.hold_customer:cus_2A5SQZ7FXFG6FNLQ: applied"
    },
    {
      "at": "2026-10-22T01:45:16.823Z",
      "msg": "workos.remove_membership:om_JDKEGYKNHM91C20000ZHEBRR8D: applied"
    },
    {
      "at": "2026-10-22T01:45:16.949Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:45:25.393Z",
      "msg": "slack.post_alert: failed (slack:ratelimited)"
    },
    {
      "at": "2026-10-22T01:45:25.394Z",
      "msg": "done (partial)"
    }
  ],
  "createdAt": "2026-10-22T01:45:15.815Z",
  "updatedAt": "2026-10-22T01:45:25.394Z",
  "duplicate": false
}
  283. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request e8287d203451 · processing 1.67ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.67ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "cca4421a-b665-420a-ac85-7b045b2d8948",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/6625c68d",
      "email_verified": true,
      "external_id": "ext_42298c6d94d64c1e8b77f0ea1f",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  284. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request 964de977090b · processing 15.45ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 15.45ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_2A5SQZ7FXFG6FNLQ",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 73,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  285. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 21e91f9a96f6 · processing 0.52ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.52ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "cca4421a-b665-420a-ac85-7b045b2d8948",
      "organization_id": "82a7162d-0680-43fc-8b8c-c2bc5645aa73",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_JDKEGYKNHM91C20000ZHEBRR8D"
    }
  ],
  "list_metadata": {
    "before": "om_JDKEGYKNHM91C20000ZHEBRR8D",
    "after": null
  }
}
  286. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request c47d86208564 · processing 6.02ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 6.02ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  287. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request aa7ddabde386 · processing 0.67ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.67ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "1f640782-7b8a-4627-af94-ea3b0349344c",
      "organization_id": "82a7162d-0680-43fc-8b8c-c2bc5645aa73",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_Q1E0GZ5IPED4JKCN7LY7L2O47S"
    },
    {
      "object": "organization_membership",
      "user_id": "cca4421a-b665-420a-ac85-7b045b2d8948",
      "organization_id": "82a7162d-0680-43fc-8b8c-c2bc5645aa73",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_JDKEGYKNHM91C20000ZHEBRR8D"
    }
  ],
  "list_metadata": {
    "before": "om_Q1E0GZ5IPED4JKCN7LY7L2O47S",
    "after": null
  }
}
  288. · GET workos request · provider traffic · /user_management/users/cca4421a-b665-420a-ac85-7b045b2d8948/sessions · HTTP 200 · request 64741065f863 · processing 1.41ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/cca4421a-b665-420a-ac85-7b045b2d8948/sessions' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.41ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "items": [
    {
      "session_id": "[redacted]",
      "name": "Sample Session 1",
      "id": "65028467-bd15-479d-b741-4630a662fd42"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 2",
      "id": "b0b28c4e-bdc3-4ed9-9483-fdd724aeb3ef"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 3",
      "id": "ab7c709c-c32d-4aa0-911b-52c680ee248f"
    }
  ]
}
  289. · POST stripe request · provider traffic · /v1/customers/cus_2A5SQZ7FXFG6FNLQ · HTTP 200 · request d84fb27bb7ab · processing 13.75ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_2A5SQZ7FXFG6FNLQ' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-raw '{
  "metadata": {
    "acme_ato_hold": "SEC-slack-rate-limited",
    "acme_ato_hold_at": "2026-10-22T01:45:15.815Z"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 13.75ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "110",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/x-www-form-urlencoded"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "metadata": {
    "acme_ato_hold": "SEC-slack-rate-limited",
    "acme_ato_hold_at": "2026-10-22T01:45:15.815Z"
  }
}

    Recorded response · HTTP 200

    {
  "email": "[email protected]",
  "name": "Robin Customer",
  "id": "cus_2A5SQZ7FXFG6FNLQ",
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 73,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "SEC-slack-rate-limited",
    "acme_ato_hold_at": "2026-10-22T01:45:15.815Z"
  }
}
  290. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 4961704a0f11 · processing 0.54ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.54ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "cca4421a-b665-420a-ac85-7b045b2d8948",
      "organization_id": "82a7162d-0680-43fc-8b8c-c2bc5645aa73",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_JDKEGYKNHM91C20000ZHEBRR8D"
    }
  ],
  "list_metadata": {
    "before": "om_JDKEGYKNHM91C20000ZHEBRR8D",
    "after": null
  }
}
  291. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 06fbd3683b68 · processing 0.56ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.56ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "1f640782-7b8a-4627-af94-ea3b0349344c",
      "organization_id": "82a7162d-0680-43fc-8b8c-c2bc5645aa73",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_Q1E0GZ5IPED4JKCN7LY7L2O47S"
    },
    {
      "object": "organization_membership",
      "user_id": "cca4421a-b665-420a-ac85-7b045b2d8948",
      "organization_id": "82a7162d-0680-43fc-8b8c-c2bc5645aa73",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_JDKEGYKNHM91C20000ZHEBRR8D"
    }
  ],
  "list_metadata": {
    "before": "om_Q1E0GZ5IPED4JKCN7LY7L2O47S",
    "after": null
  }
}
  292. · DELETE workos request · provider traffic · /user_management/organization_memberships/om_JDKEGYKNHM91C20000ZHEBRR8D · HTTP 204 · request 4595d4063a9e · processing 0.88ms
  293. · POST asana request · provider traffic · /tasks · HTTP 201 · request fed72d39c02a · processing 12.65ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-slack-rate-limited: account takeover contain (contain)",
    "notes": "Alert SEC-slack-rate-limited for user 91675decc2 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_2A5SQZ7FXFG6FNLQ.\nPrivileged memberships removed (restore input):\n- 82a7162d-0680-43fc-8b8c-c2bc5645aa73 admin (om_JDKEGYKNHM91C20000ZHEBRR8D) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-slack-rate-limited\",\"memberships\":[{\"organizationId\":\"82a7162d-0680-43fc-8b8c-c2bc5645aa73\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 12.65ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "675",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "data": {
    "name": "SEC-slack-rate-limited: account takeover contain (contain)",
    "notes": "Alert SEC-slack-rate-limited for user 91675decc2 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_2A5SQZ7FXFG6FNLQ.\nPrivileged memberships removed (restore input):\n- 82a7162d-0680-43fc-8b8c-c2bc5645aa73 admin (om_JDKEGYKNHM91C20000ZHEBRR8D) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-slack-rate-limited\",\"memberships\":[{\"organizationId\":\"82a7162d-0680-43fc-8b8c-c2bc5645aa73\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}

    Recorded response · HTTP 201

    {
  "data": {
    "name": "SEC-slack-rate-limited: account takeover contain (contain)",
    "notes": "Alert SEC-slack-rate-limited for user 91675decc2 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_2A5SQZ7FXFG6FNLQ.\nPrivileged memberships removed (restore input):\n- 82a7162d-0680-43fc-8b8c-c2bc5645aa73 admin (om_JDKEGYKNHM91C20000ZHEBRR8D) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-slack-rate-limited\",\"memberships\":[{\"organizationId\":\"82a7162d-0680-43fc-8b8c-c2bc5645aa73\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  },
  "id": "35075277-9c6e-4f86-bdab-ce34fd307595"
}
  294. · POST slack request · slack rate limited · /api/chat.postMessage · HTTP 429 · processing 0.87ms
    View sanitized request and response

    Curl-style request view

    curl --request POST '<SLACK_TWIN_BASE_URL>/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-slack-rate-limited (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL was not recorded. Provider processing: 0.87ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "190",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    {
  "retry-after": "30"
}

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-slack-rate-limited (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 429

    {
  "ok": false,
  "error": "ratelimited"
}
  295. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 429 · request 63196cf12798 · processing 0.87ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-slack-rate-limited (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.87ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "190",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    {
  "retry-after": "30"
}

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-slack-rate-limited (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 429

    {
  "ok": false,
  "error": "ratelimited"
}
  296. · POST slack request · slack rate limited · /api/chat.postMessage · HTTP 429 · processing 0.87ms
    View sanitized request and response

    Curl-style request view

    curl --request POST '<SLACK_TWIN_BASE_URL>/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-slack-rate-limited (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL was not recorded. Provider processing: 0.87ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "190",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    {
  "retry-after": "30"
}

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-slack-rate-limited (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 429

    {
  "ok": false,
  "error": "ratelimited"
}
  297. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 429 · request e4c465730382 · processing 0.87ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-slack-rate-limited (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.87ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "190",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    {
  "retry-after": "30"
}

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-slack-rate-limited (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 429

    {
  "ok": false,
  "error": "ratelimited"
}
  298. · POST slack request · slack rate limited · /api/chat.postMessage · HTTP 429 · processing 0.82ms
    View sanitized request and response

    Curl-style request view

    curl --request POST '<SLACK_TWIN_BASE_URL>/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-slack-rate-limited (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL was not recorded. Provider processing: 0.82ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "190",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    {
  "retry-after": "30"
}

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-slack-rate-limited (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 429

    {
  "ok": false,
  "error": "ratelimited"
}
  299. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 429 · request c7f7616d3ae7 · processing 0.82ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-slack-rate-limited (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.82ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "190",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    {
  "retry-after": "30"
}

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-slack-rate-limited (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 429

    {
  "ok": false,
  "error": "ratelimited"
}
  300. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/slack_rate_limited/runs · slack rate limited · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/slack_rate_limited/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:26.050622+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "slack-rate-limited-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "partial",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "slack_rate_limited"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 489
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 320
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_2A5SQZ7FXFG6FNLQ",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_2A5SQZ7FXFG6FNLQ",
            "alert": "SEC-slack-rate-limited"
          },
          "attempts": 1,
          "ref": "cus_2A5SQZ7FXFG6FNLQ",
          "appliedAt": "2026-10-22T01:45:16.439Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_JDKEGYKNHM91C20000ZHEBRR8D",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "91675decc2",
            "organization": "82a7162d-0680-43fc-8b8c-c2bc5645aa73",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_JDKEGYKNHM91C20000ZHEBRR8D",
          "detail": {
            "organizationId": "82a7162d-0680-43fc-8b8c-c2bc5645aa73",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:45:16.823Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-slack-rate-limited",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "35075277-9c6e-4f86-bdab-ce34fd307595",
          "appliedAt": "2026-10-22T01:45:16.949Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "failed",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "error": "slack 429 ratelimited: POST /api/chat.postMessage → 429 ratelimited",
          "errorCode": "slack:ratelimited",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 3,
        "failed": 1,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:45:15.815Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:45:16.307Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:45:16.310Z",
          "msg": "planned 4 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:45:16.439Z",
          "msg": "stripe.hold_customer:cus_2A5SQZ7FXFG6FNLQ: applied"
        },
        {
          "at": "2026-10-22T01:45:16.823Z",
          "msg": "workos.remove_membership:om_JDKEGYKNHM91C20000ZHEBRR8D: applied"
        },
        {
          "at": "2026-10-22T01:45:16.949Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:45:25.393Z",
          "msg": "slack.post_alert: failed (slack:ratelimited)"
        },
        {
          "at": "2026-10-22T01:45:25.394Z",
          "msg": "done (partial)"
        }
      ],
      "createdAt": "2026-10-22T01:45:15.815Z",
      "updatedAt": "2026-10-22T01:45:25.394Z"
    }
  ]
}
  301. · POST app request /invocations · slack rate limited · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "slack-rate-limited-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-slack-rate-limited",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "slack_rate_limited"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:26.269103+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "445",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "slack-rate-limited-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-slack-rate-limited",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "slack_rate_limited"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "slack-rate-limited-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "partial",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "slack_rate_limited"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 489
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 320
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_2A5SQZ7FXFG6FNLQ",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_2A5SQZ7FXFG6FNLQ",
        "alert": "SEC-slack-rate-limited"
      },
      "attempts": 1,
      "ref": "cus_2A5SQZ7FXFG6FNLQ",
      "appliedAt": "2026-10-22T01:45:16.439Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_JDKEGYKNHM91C20000ZHEBRR8D",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "91675decc2",
        "organization": "82a7162d-0680-43fc-8b8c-c2bc5645aa73",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_JDKEGYKNHM91C20000ZHEBRR8D",
      "detail": {
        "organizationId": "82a7162d-0680-43fc-8b8c-c2bc5645aa73",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:45:16.823Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-slack-rate-limited",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "35075277-9c6e-4f86-bdab-ce34fd307595",
      "appliedAt": "2026-10-22T01:45:16.949Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "failed",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "error": "slack 429 ratelimited: POST /api/chat.postMessage → 429 ratelimited",
      "errorCode": "slack:ratelimited",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 3,
    "failed": 1,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:45:15.815Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:45:16.307Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:45:16.310Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:45:16.439Z",
      "msg": "stripe.hold_customer:cus_2A5SQZ7FXFG6FNLQ: applied"
    },
    {
      "at": "2026-10-22T01:45:16.823Z",
      "msg": "workos.remove_membership:om_JDKEGYKNHM91C20000ZHEBRR8D: applied"
    },
    {
      "at": "2026-10-22T01:45:16.949Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:45:25.393Z",
      "msg": "slack.post_alert: failed (slack:ratelimited)"
    },
    {
      "at": "2026-10-22T01:45:25.394Z",
      "msg": "done (partial)"
    },
    {
      "at": "2026-10-22T01:45:26.096Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:45:15.815Z",
  "updatedAt": "2026-10-22T01:45:26.096Z",
  "duplicate": true
}
  302. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/slack_rate_limited/runs · slack rate limited · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/slack_rate_limited/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:26.785721+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "slack-rate-limited-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "partial",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "slack_rate_limited"
      },
      "duplicateStarts": 1,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 489
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 320
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_2A5SQZ7FXFG6FNLQ",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_2A5SQZ7FXFG6FNLQ",
            "alert": "SEC-slack-rate-limited"
          },
          "attempts": 1,
          "ref": "cus_2A5SQZ7FXFG6FNLQ",
          "appliedAt": "2026-10-22T01:45:16.439Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_JDKEGYKNHM91C20000ZHEBRR8D",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "91675decc2",
            "organization": "82a7162d-0680-43fc-8b8c-c2bc5645aa73",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_JDKEGYKNHM91C20000ZHEBRR8D",
          "detail": {
            "organizationId": "82a7162d-0680-43fc-8b8c-c2bc5645aa73",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:45:16.823Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-slack-rate-limited",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "35075277-9c6e-4f86-bdab-ce34fd307595",
          "appliedAt": "2026-10-22T01:45:16.949Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "failed",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "error": "slack 429 ratelimited: POST /api/chat.postMessage → 429 ratelimited",
          "errorCode": "slack:ratelimited",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 3,
        "failed": 1,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:45:15.815Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:45:16.307Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:45:16.310Z",
          "msg": "planned 4 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:45:16.439Z",
          "msg": "stripe.hold_customer:cus_2A5SQZ7FXFG6FNLQ: applied"
        },
        {
          "at": "2026-10-22T01:45:16.823Z",
          "msg": "workos.remove_membership:om_JDKEGYKNHM91C20000ZHEBRR8D: applied"
        },
        {
          "at": "2026-10-22T01:45:16.949Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:45:25.393Z",
          "msg": "slack.post_alert: failed (slack:ratelimited)"
        },
        {
          "at": "2026-10-22T01:45:25.394Z",
          "msg": "done (partial)"
        },
        {
          "at": "2026-10-22T01:45:26.096Z",
          "msg": "duplicate start ignored"
        }
      ],
      "createdAt": "2026-10-22T01:45:15.815Z",
      "updatedAt": "2026-10-22T01:45:26.096Z"
    }
  ]
}
  303. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/restart_while_parked/runs · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/restart_while_parked/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:26.994953+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  304. · POST app request /invocations · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "restart-while-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-restart-while-parked",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restart_while_parked"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:28.269167+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "453",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "restart-while-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-restart-while-parked",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restart_while_parked"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "restart-while-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "AWAITING_APPROVAL",
  "closed": false,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restart_while_parked"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 578
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 530
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_9K7UVZWEM25Q7L20",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_9K7UVZWEM25Q7L20",
        "alert": "SEC-restart-while-parked"
      },
      "attempts": 1,
      "ref": "cus_9K7UVZWEM25Q7L20",
      "appliedAt": "2026-10-22T01:45:27.806Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_QHIKHL2QQ7VAJMX0ZK0GM866N9",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "pending_approval",
      "summary": {
        "user": "d3dc3fe721",
        "organization": "a7edfdcf-8185-40fb-9edd-0468de2862f4",
        "role": "admin",
        "why": "last admin of the organization"
      },
      "attempts": 0,
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-restart-while-parked",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "2396adac-bdf6-40ac-be87-5e32c7826ac4",
      "appliedAt": "2026-10-22T01:45:27.962Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17D7C9KPUG.KF4UH6",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:45:28.100Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 3,
    "failed": 0,
    "pendingApproval": 1,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:45:28.101Z"
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 0,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:45:27.035Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:45:27.614Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:45:27.618Z",
      "msg": "planned 4 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:45:27.806Z",
      "msg": "stripe.hold_customer:cus_9K7UVZWEM25Q7L20: applied"
    },
    {
      "at": "2026-10-22T01:45:27.962Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:45:28.100Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:45:28.101Z",
      "msg": "awaiting approval"
    }
  ],
  "createdAt": "2026-10-22T01:45:27.035Z",
  "updatedAt": "2026-10-22T01:45:28.101Z",
  "duplicate": false
}
  305. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request c78ff537bc0c · processing 1.75ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.75ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "ccd60ba5-18f6-429c-bffd-3eef9ddb64c5",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/54b293fa",
      "email_verified": true,
      "external_id": "ext_5ba5101617cf488fb1a1a0b88d",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  306. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request b4492bcd49a9 · processing 0.55ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.55ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "ccd60ba5-18f6-429c-bffd-3eef9ddb64c5",
      "organization_id": "a7edfdcf-8185-40fb-9edd-0468de2862f4",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_QHIKHL2QQ7VAJMX0ZK0GM866N9"
    }
  ],
  "list_metadata": {
    "before": "om_QHIKHL2QQ7VAJMX0ZK0GM866N9",
    "after": null
  }
}
  307. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request 20d7c4cdea48 · processing 15.09ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 15.09ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_9K7UVZWEM25Q7L20",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 45,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  308. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 74910f3454e6 · processing 0.57ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.57ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "ccd60ba5-18f6-429c-bffd-3eef9ddb64c5",
      "organization_id": "a7edfdcf-8185-40fb-9edd-0468de2862f4",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_QHIKHL2QQ7VAJMX0ZK0GM866N9"
    }
  ],
  "list_metadata": {
    "before": "om_QHIKHL2QQ7VAJMX0ZK0GM866N9",
    "after": null
  }
}
  309. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request 5a682e9afda3 · processing 6.24ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 6.24ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  310. · GET workos request · provider traffic · /user_management/users/ccd60ba5-18f6-429c-bffd-3eef9ddb64c5/sessions · HTTP 200 · request 9f0ea9c44cbe · processing 1.55ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/ccd60ba5-18f6-429c-bffd-3eef9ddb64c5/sessions' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.55ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "items": [
    {
      "session_id": "[redacted]",
      "name": "Sample Session 1",
      "id": "65028467-bd15-479d-b741-4630a662fd42"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 2",
      "id": "b0b28c4e-bdc3-4ed9-9483-fdd724aeb3ef"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 3",
      "id": "ab7c709c-c32d-4aa0-911b-52c680ee248f"
    }
  ]
}
  311. · POST stripe request · provider traffic · /v1/customers/cus_9K7UVZWEM25Q7L20 · HTTP 200 · request 2d6f8463034b · processing 13.66ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_9K7UVZWEM25Q7L20' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-raw '{
  "metadata": {
    "acme_ato_hold": "SEC-restart-while-parked",
    "acme_ato_hold_at": "2026-10-22T01:45:27.035Z"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 13.66ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "112",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/x-www-form-urlencoded"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "metadata": {
    "acme_ato_hold": "SEC-restart-while-parked",
    "acme_ato_hold_at": "2026-10-22T01:45:27.035Z"
  }
}

    Recorded response · HTTP 200

    {
  "email": "[email protected]",
  "name": "Robin Customer",
  "id": "cus_9K7UVZWEM25Q7L20",
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 45,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "SEC-restart-while-parked",
    "acme_ato_hold_at": "2026-10-22T01:45:27.035Z"
  }
}
  312. · POST asana request · provider traffic · /tasks · HTTP 201 · request 0a158e88a6f7 · processing 12.9ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-restart-while-parked: account takeover contain (contain)",
    "notes": "Alert SEC-restart-while-parked for user d3dc3fe721 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_9K7UVZWEM25Q7L20.\nPrivileged memberships removed (restore input):\n- a7edfdcf-8185-40fb-9edd-0468de2862f4 admin (om_QHIKHL2QQ7VAJMX0ZK0GM866N9) approval: last admin of the organization\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-restart-while-parked\",\"memberships\":[{\"organizationId\":\"a7edfdcf-8185-40fb-9edd-0468de2862f4\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 12.9ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "706",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "data": {
    "name": "SEC-restart-while-parked: account takeover contain (contain)",
    "notes": "Alert SEC-restart-while-parked for user d3dc3fe721 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_9K7UVZWEM25Q7L20.\nPrivileged memberships removed (restore input):\n- a7edfdcf-8185-40fb-9edd-0468de2862f4 admin (om_QHIKHL2QQ7VAJMX0ZK0GM866N9) approval: last admin of the organization\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-restart-while-parked\",\"memberships\":[{\"organizationId\":\"a7edfdcf-8185-40fb-9edd-0468de2862f4\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}

    Recorded response · HTTP 201

    {
  "data": {
    "name": "SEC-restart-while-parked: account takeover contain (contain)",
    "notes": "Alert SEC-restart-while-parked for user d3dc3fe721 from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_9K7UVZWEM25Q7L20.\nPrivileged memberships removed (restore input):\n- a7edfdcf-8185-40fb-9edd-0468de2862f4 admin (om_QHIKHL2QQ7VAJMX0ZK0GM866N9) approval: last admin of the organization\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-restart-while-parked\",\"memberships\":[{\"organizationId\":\"a7edfdcf-8185-40fb-9edd-0468de2862f4\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  },
  "id": "2396adac-bdf6-40ac-be87-5e32c7826ac4"
}
  313. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request f34270028b7b · processing 11.92ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-restart-while-parked (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held. 1 change(s) need approval.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 11.92ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "219",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-restart-while-parked (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held. 1 change(s) need approval.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_27643f17a34046efb78e40eed8",
    "client_msg_id": "cli_d3540322433a4c38b484a68900",
    "name": "item-490ee8",
    "old_name": "Sample Old",
    "parent_user_id": "par_60aeec4c014b40f4a39d78cfdc",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "17D7C9KPUG.KF4UH6"
}
  314. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:28.472402+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  315. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:28.675056+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  316. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:29.128146+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  317. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:29.603431+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  318. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:30.130883+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  319. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:30.600396+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  320. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:31.071211+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  321. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:31.537473+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  322. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:32.010166+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  323. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:32.465165+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  324. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:32.904752+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  325. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:33.349507+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  326. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:33.795123+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  327. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:34.256430+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  328. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:34.704754+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  329. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:35.187233+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  330. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:35.635168+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  331. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:36.104454+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  332. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:36.545400+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  333. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:36.991881+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  334. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:37.439705+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  335. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:37.976340+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  336. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:38.425954+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  337. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:38.876004+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  338. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:39.329823+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  339. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:39.781547+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  340. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:40.240343+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  341. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:40.700936+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  342. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:41.156401+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  343. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:41.613151+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  344. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:42.069495+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  345. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:42.519946+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  346. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:43.020784+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  347. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:43.475712+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  348. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:43.913327+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  349. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:44.352340+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  350. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:44.797608+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  351. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:45.286151+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  352. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:45.735046+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  353. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:46.189816+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  354. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:46.642731+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "b40abab8-83a3-4958-a174-0479f560e804",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:44:24.811Z"
}
  355. · GET app request /verify/runtime · restart while parked · HTTP 502
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:47.083319+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "text/html; charset=UTF-8",
  "content-length": "6418",
  "retry-after": "60"
}

    Request body

    This request had no body.

    Recorded response · HTTP 502

    No response body was saved.

  356. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:47.524615+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  357. · POST app request /invocations · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "decide",
  "runId": "restart-while-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "decision": "approve",
  "userId": "U_CISO"
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:48.377015+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "125",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "decide",
  "runId": "restart-while-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "decision": "approve",
  "userId": "U_CISO"
}

    Recorded response · HTTP 200

    {
  "runId": "restart-while-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restart_while_parked"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 578
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 530
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_9K7UVZWEM25Q7L20",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_9K7UVZWEM25Q7L20",
        "alert": "SEC-restart-while-parked"
      },
      "attempts": 1,
      "ref": "cus_9K7UVZWEM25Q7L20",
      "appliedAt": "2026-10-22T01:45:27.806Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_QHIKHL2QQ7VAJMX0ZK0GM866N9",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "applied",
      "summary": {
        "user": "d3dc3fe721",
        "organization": "a7edfdcf-8185-40fb-9edd-0468de2862f4",
        "role": "admin",
        "why": "last admin of the organization"
      },
      "attempts": 1,
      "ref": "om_QHIKHL2QQ7VAJMX0ZK0GM866N9",
      "detail": {
        "organizationId": "a7edfdcf-8185-40fb-9edd-0468de2862f4",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:45:48.218Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-restart-while-parked",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "2396adac-bdf6-40ac-be87-5e32c7826ac4",
      "appliedAt": "2026-10-22T01:45:27.962Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17D7C9KPUG.KF4UH6",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:45:28.100Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:45:28.101Z",
    "decision": "approve",
    "decidedBy": "U_CISO",
    "decidedAt": "2026-10-22T01:45:47.562Z"
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 0,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:45:27.035Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:45:27.614Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:45:27.618Z",
      "msg": "planned 4 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:45:27.806Z",
      "msg": "stripe.hold_customer:cus_9K7UVZWEM25Q7L20: applied"
    },
    {
      "at": "2026-10-22T01:45:27.962Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:45:28.100Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:45:28.101Z",
      "msg": "awaiting approval"
    },
    {
      "at": "2026-10-22T01:45:47.562Z",
      "msg": "approved by U_CISO"
    },
    {
      "at": "2026-10-22T01:45:48.218Z",
      "msg": "workos.remove_membership:om_QHIKHL2QQ7VAJMX0ZK0GM866N9: applied"
    },
    {
      "at": "2026-10-22T01:45:48.220Z",
      "msg": "done (ok)"
    }
  ],
  "createdAt": "2026-10-22T01:45:27.035Z",
  "updatedAt": "2026-10-22T01:45:48.220Z",
  "result": "recorded"
}
  358. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 8ead321a6b47 · processing 0.54ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.54ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "ccd60ba5-18f6-429c-bffd-3eef9ddb64c5",
      "organization_id": "a7edfdcf-8185-40fb-9edd-0468de2862f4",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_QHIKHL2QQ7VAJMX0ZK0GM866N9"
    }
  ],
  "list_metadata": {
    "before": "om_QHIKHL2QQ7VAJMX0ZK0GM866N9",
    "after": null
  }
}
  359. · DELETE workos request · provider traffic · /user_management/organization_memberships/om_QHIKHL2QQ7VAJMX0ZK0GM866N9 · HTTP 204 · request ac7cb4e25775 · processing 0.83ms
  360. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/restart_while_parked/runs · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/restart_while_parked/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:48.672582+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "restart-while-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "restart_while_parked"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 578
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 530
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_9K7UVZWEM25Q7L20",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_9K7UVZWEM25Q7L20",
            "alert": "SEC-restart-while-parked"
          },
          "attempts": 1,
          "ref": "cus_9K7UVZWEM25Q7L20",
          "appliedAt": "2026-10-22T01:45:27.806Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_QHIKHL2QQ7VAJMX0ZK0GM866N9",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "approval",
          "status": "applied",
          "summary": {
            "user": "d3dc3fe721",
            "organization": "a7edfdcf-8185-40fb-9edd-0468de2862f4",
            "role": "admin",
            "why": "last admin of the organization"
          },
          "attempts": 1,
          "ref": "om_QHIKHL2QQ7VAJMX0ZK0GM866N9",
          "detail": {
            "organizationId": "a7edfdcf-8185-40fb-9edd-0468de2862f4",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:45:48.218Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-restart-while-parked",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "2396adac-bdf6-40ac-be87-5e32c7826ac4",
          "appliedAt": "2026-10-22T01:45:27.962Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17D7C9KPUG.KF4UH6",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:45:28.100Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "approval": {
        "approvers": [
          "U_CISO"
        ],
        "expiresAt": "2026-10-23T01:45:28.101Z",
        "decision": "approve",
        "decidedBy": "U_CISO",
        "decidedAt": "2026-10-22T01:45:47.562Z"
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 0,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:45:27.035Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:45:27.614Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:45:27.618Z",
          "msg": "planned 4 action(s): 1 need approval"
        },
        {
          "at": "2026-10-22T01:45:27.806Z",
          "msg": "stripe.hold_customer:cus_9K7UVZWEM25Q7L20: applied"
        },
        {
          "at": "2026-10-22T01:45:27.962Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:45:28.100Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:45:28.101Z",
          "msg": "awaiting approval"
        },
        {
          "at": "2026-10-22T01:45:47.562Z",
          "msg": "approved by U_CISO"
        },
        {
          "at": "2026-10-22T01:45:48.218Z",
          "msg": "workos.remove_membership:om_QHIKHL2QQ7VAJMX0ZK0GM866N9: applied"
        },
        {
          "at": "2026-10-22T01:45:48.220Z",
          "msg": "done (ok)"
        }
      ],
      "createdAt": "2026-10-22T01:45:27.035Z",
      "updatedAt": "2026-10-22T01:45:48.220Z"
    }
  ]
}
  361. · POST app request /invocations · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "restart-while-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-restart-while-parked",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restart_while_parked"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:48.881844+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "453",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "restart-while-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-restart-while-parked",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restart_while_parked"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "restart-while-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restart_while_parked"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 578
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 530
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_9K7UVZWEM25Q7L20",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_9K7UVZWEM25Q7L20",
        "alert": "SEC-restart-while-parked"
      },
      "attempts": 1,
      "ref": "cus_9K7UVZWEM25Q7L20",
      "appliedAt": "2026-10-22T01:45:27.806Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_QHIKHL2QQ7VAJMX0ZK0GM866N9",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "applied",
      "summary": {
        "user": "d3dc3fe721",
        "organization": "a7edfdcf-8185-40fb-9edd-0468de2862f4",
        "role": "admin",
        "why": "last admin of the organization"
      },
      "attempts": 1,
      "ref": "om_QHIKHL2QQ7VAJMX0ZK0GM866N9",
      "detail": {
        "organizationId": "a7edfdcf-8185-40fb-9edd-0468de2862f4",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:45:48.218Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-restart-while-parked",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "2396adac-bdf6-40ac-be87-5e32c7826ac4",
      "appliedAt": "2026-10-22T01:45:27.962Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17D7C9KPUG.KF4UH6",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:45:28.100Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:45:28.101Z",
    "decision": "approve",
    "decidedBy": "U_CISO",
    "decidedAt": "2026-10-22T01:45:47.562Z"
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 0,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:45:27.035Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:45:27.614Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:45:27.618Z",
      "msg": "planned 4 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:45:27.806Z",
      "msg": "stripe.hold_customer:cus_9K7UVZWEM25Q7L20: applied"
    },
    {
      "at": "2026-10-22T01:45:27.962Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:45:28.100Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:45:28.101Z",
      "msg": "awaiting approval"
    },
    {
      "at": "2026-10-22T01:45:47.562Z",
      "msg": "approved by U_CISO"
    },
    {
      "at": "2026-10-22T01:45:48.218Z",
      "msg": "workos.remove_membership:om_QHIKHL2QQ7VAJMX0ZK0GM866N9: applied"
    },
    {
      "at": "2026-10-22T01:45:48.220Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:45:48.722Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:45:27.035Z",
  "updatedAt": "2026-10-22T01:45:48.722Z",
  "duplicate": true
}
  362. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:49.076190+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  363. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:49.354017+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  364. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:49.804420+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  365. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:50.242211+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  366. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:50.689729+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  367. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:51.135331+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  368. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:51.583367+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  369. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:52.038631+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  370. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:52.483141+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  371. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:52.936489+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  372. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:53.380063+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  373. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:53.822659+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  374. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:54.273431+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  375. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:54.726494+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  376. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:55.173461+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  377. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:55.630468+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  378. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:56.070234+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  379. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:56.520414+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  380. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:56.958141+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  381. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:57.398727+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  382. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:57.859743+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  383. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:58.304502+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  384. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:58.739737+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  385. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:59.189724+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "06bed5a1-8f22-4ee4-b374-c440a3ac7fb2",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:47.023Z"
}
  386. · GET app request /verify/runtime · restart while parked · HTTP 502
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:45:59.633886+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "text/html; charset=UTF-8",
  "content-length": "6418",
  "retry-after": "60"
}

    Request body

    This request had no body.

    Recorded response · HTTP 502

    No response body was saved.

  387. · GET app request /verify/runtime · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runtime' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:46:00.237391+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "instance_id": "3f0ca9a5-f129-4d2d-bd80-93ba3c8f3fff",
  "workflow": "account-takeover-containment",
  "startedAt": "2026-10-22T01:45:59.635Z"
}
  388. · POST app request /invocations · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "decide",
  "runId": "restart-while-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "decision": "approve",
  "userId": "U_CISO"
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:46:00.485028+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "125",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "decide",
  "runId": "restart-while-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "decision": "approve",
  "userId": "U_CISO"
}

    Recorded response · HTTP 200

    {
  "runId": "restart-while-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "restart_while_parked"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 578
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 530
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_9K7UVZWEM25Q7L20",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_9K7UVZWEM25Q7L20",
        "alert": "SEC-restart-while-parked"
      },
      "attempts": 1,
      "ref": "cus_9K7UVZWEM25Q7L20",
      "appliedAt": "2026-10-22T01:45:27.806Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_QHIKHL2QQ7VAJMX0ZK0GM866N9",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "approval",
      "status": "applied",
      "summary": {
        "user": "d3dc3fe721",
        "organization": "a7edfdcf-8185-40fb-9edd-0468de2862f4",
        "role": "admin",
        "why": "last admin of the organization"
      },
      "attempts": 1,
      "ref": "om_QHIKHL2QQ7VAJMX0ZK0GM866N9",
      "detail": {
        "organizationId": "a7edfdcf-8185-40fb-9edd-0468de2862f4",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:45:48.218Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-restart-while-parked",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "2396adac-bdf6-40ac-be87-5e32c7826ac4",
      "appliedAt": "2026-10-22T01:45:27.962Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "17D7C9KPUG.KF4UH6",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:45:28.100Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "approval": {
    "approvers": [
      "U_CISO"
    ],
    "expiresAt": "2026-10-23T01:45:28.101Z",
    "decision": "approve",
    "decidedBy": "U_CISO",
    "decidedAt": "2026-10-22T01:45:47.562Z"
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 0,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:45:27.035Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:45:27.614Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:45:27.618Z",
      "msg": "planned 4 action(s): 1 need approval"
    },
    {
      "at": "2026-10-22T01:45:27.806Z",
      "msg": "stripe.hold_customer:cus_9K7UVZWEM25Q7L20: applied"
    },
    {
      "at": "2026-10-22T01:45:27.962Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:45:28.100Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:45:28.101Z",
      "msg": "awaiting approval"
    },
    {
      "at": "2026-10-22T01:45:47.562Z",
      "msg": "approved by U_CISO"
    },
    {
      "at": "2026-10-22T01:45:48.218Z",
      "msg": "workos.remove_membership:om_QHIKHL2QQ7VAJMX0ZK0GM866N9: applied"
    },
    {
      "at": "2026-10-22T01:45:48.220Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:45:48.722Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:45:27.035Z",
  "updatedAt": "2026-10-22T01:46:00.311Z",
  "result": "already_decided"
}
  389. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/restart_while_parked/runs · restart while parked · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/restart_while_parked/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:46:00.798522+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "restart-while-parked-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "restart_while_parked"
      },
      "duplicateStarts": 1,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 578
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 530
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_9K7UVZWEM25Q7L20",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_9K7UVZWEM25Q7L20",
            "alert": "SEC-restart-while-parked"
          },
          "attempts": 1,
          "ref": "cus_9K7UVZWEM25Q7L20",
          "appliedAt": "2026-10-22T01:45:27.806Z",
          "reconciled": null
        },
        {
          "id": "workos.remove_membership:om_QHIKHL2QQ7VAJMX0ZK0GM866N9",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "approval",
          "status": "applied",
          "summary": {
            "user": "d3dc3fe721",
            "organization": "a7edfdcf-8185-40fb-9edd-0468de2862f4",
            "role": "admin",
            "why": "last admin of the organization"
          },
          "attempts": 1,
          "ref": "om_QHIKHL2QQ7VAJMX0ZK0GM866N9",
          "detail": {
            "organizationId": "a7edfdcf-8185-40fb-9edd-0468de2862f4",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:45:48.218Z",
          "reconciled": null
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-restart-while-parked",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "2396adac-bdf6-40ac-be87-5e32c7826ac4",
          "appliedAt": "2026-10-22T01:45:27.962Z",
          "reconciled": null
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "17D7C9KPUG.KF4UH6",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:45:28.100Z",
          "reconciled": null
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "approval": {
        "approvers": [
          "U_CISO"
        ],
        "expiresAt": "2026-10-23T01:45:28.101Z",
        "decision": "approve",
        "decidedBy": "U_CISO",
        "decidedAt": "2026-10-22T01:45:47.562Z"
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 0,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:45:27.035Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:45:27.614Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:45:27.618Z",
          "msg": "planned 4 action(s): 1 need approval"
        },
        {
          "at": "2026-10-22T01:45:27.806Z",
          "msg": "stripe.hold_customer:cus_9K7UVZWEM25Q7L20: applied"
        },
        {
          "at": "2026-10-22T01:45:27.962Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:45:28.100Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:45:28.101Z",
          "msg": "awaiting approval"
        },
        {
          "at": "2026-10-22T01:45:47.562Z",
          "msg": "approved by U_CISO"
        },
        {
          "at": "2026-10-22T01:45:48.218Z",
          "msg": "workos.remove_membership:om_QHIKHL2QQ7VAJMX0ZK0GM866N9: applied"
        },
        {
          "at": "2026-10-22T01:45:48.220Z",
          "msg": "done (ok)"
        },
        {
          "at": "2026-10-22T01:45:48.722Z",
          "msg": "duplicate start ignored"
        }
      ],
      "createdAt": "2026-10-22T01:45:27.035Z",
      "updatedAt": "2026-10-22T01:46:00.311Z"
    }
  ]
}
  390. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/reconcile_reads_back/runs · reconcile reads back · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/reconcile_reads_back/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:46:01.014275+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  391. · POST app request /invocations · reconcile reads back · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "reconcile-reads-back-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-reconcile-reads-back",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "reconcile_reads_back"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:46:03.581905+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "453",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "reconcile-reads-back-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-reconcile-reads-back",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "reconcile_reads_back"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "reconcile-reads-back-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "reconcile_reads_back"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 828
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 514
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_QJ923NUJ417WP9A8",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_QJ923NUJ417WP9A8",
        "alert": "SEC-reconcile-reads-back"
      },
      "attempts": 1,
      "ref": "cus_QJ923NUJ417WP9A8",
      "appliedAt": "2026-10-22T01:46:02.127Z",
      "reconciled": null
    },
    {
      "id": "workos.remove_membership:om_V42D3XWTBO9P1RGHSJGBDT09WK",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "097a1ad5db",
        "organization": "bf1c23b0-88f0-450c-84fc-cbea00ef5bfc",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_V42D3XWTBO9P1RGHSJGBDT09WK",
      "detail": {
        "organizationId": "bf1c23b0-88f0-450c-84fc-cbea00ef5bfc",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:46:03.147Z",
      "reconciled": null
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-reconcile-reads-back",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "2d0fb6c0-3807-4963-9042-1b3c6ec65cdc",
      "appliedAt": "2026-10-22T01:46:03.290Z",
      "reconciled": null
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "173CTWY7GD.FKXZHN",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:46:03.421Z",
      "reconciled": null
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:46:01.050Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:46:01.880Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:46:01.888Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:46:02.128Z",
      "msg": "stripe.hold_customer:cus_QJ923NUJ417WP9A8: applied"
    },
    {
      "at": "2026-10-22T01:46:03.147Z",
      "msg": "workos.remove_membership:om_V42D3XWTBO9P1RGHSJGBDT09WK: applied"
    },
    {
      "at": "2026-10-22T01:46:03.290Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:46:03.421Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:46:03.422Z",
      "msg": "done (ok)"
    }
  ],
  "createdAt": "2026-10-22T01:46:01.050Z",
  "updatedAt": "2026-10-22T01:46:03.422Z",
  "duplicate": false
}
  392. · GET workos request · provider traffic · /user_management/users · HTTP 200 · request 651d27f08209 · processing 2.44ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 2.44ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "first_name": "Robin",
      "id": "7be96f56-ad29-47c2-9a11-7d9259efd2ea",
      "object": "user",
      "last_name": "Sample Last",
      "profile_picture_url": "https://example.com/5efa3e57",
      "email_verified": true,
      "external_id": "ext_cde0cd7da64e410f9b0381cc73",
      "last_sign_in_at": "2025-06-25T19:07:33.155Z",
      "locale": "en",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "object": "list",
  "list_metadata": {
    "before": "user_01HXYZ123456789ABCDEFGHIJ",
    "after": "user_01HXYZ987654321KJIHGFEDCBA"
  }
}
  393. · GET stripe request · provider traffic · /v1/customers · HTTP 200 · request 49620241773b · processing 39.25ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 39.25ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [
    {
      "email": "[email protected]",
      "name": "Robin Customer",
      "id": "cus_QJ923NUJ417WP9A8",
      "address": null,
      "balance": 0,
      "business_name": "Sample Business",
      "cash_balance": null,
      "created": 8,
      "currency": "USD",
      "customer_account": null,
      "default_source": null,
      "delinquent": false,
      "description": null,
      "discount": null,
      "individual_name": "Sample Individual",
      "invoice_prefix": null,
      "livemode": false,
      "object": "customer",
      "phone": "+14155550100",
      "preferred_locales": null,
      "shipping": null,
      "tax_exempt": "exempt",
      "test_clock": null
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/customers"
}
  394. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 317c758c6d4f · processing 3.18ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 3.18ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "7be96f56-ad29-47c2-9a11-7d9259efd2ea",
      "organization_id": "bf1c23b0-88f0-450c-84fc-cbea00ef5bfc",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_V42D3XWTBO9P1RGHSJGBDT09WK"
    }
  ],
  "list_metadata": {
    "before": "om_V42D3XWTBO9P1RGHSJGBDT09WK",
    "after": null
  }
}
  395. · GET stripe request · provider traffic · /v1/payment_intents · HTTP 200 · request b9b821db9f3f · processing 25.63ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/payment_intents' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 25.63ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "data": [],
  "has_more": false,
  "object": "list",
  "url": "/v1/payment_intents"
}
  396. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 1385274b39fe · processing 0.86ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.86ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "7be96f56-ad29-47c2-9a11-7d9259efd2ea",
      "organization_id": "bf1c23b0-88f0-450c-84fc-cbea00ef5bfc",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_V42D3XWTBO9P1RGHSJGBDT09WK"
    },
    {
      "object": "organization_membership",
      "user_id": "83d5f693-5a59-4996-8e36-532beec06863",
      "organization_id": "bf1c23b0-88f0-450c-84fc-cbea00ef5bfc",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_729P7RNSY8UMDOJUSKMBWQCE2R"
    }
  ],
  "list_metadata": {
    "before": "om_V42D3XWTBO9P1RGHSJGBDT09WK",
    "after": null
  }
}
  397. · GET workos request · provider traffic · /user_management/users/7be96f56-ad29-47c2-9a11-7d9259efd2ea/sessions · HTTP 200 · request f5213b93758e · processing 9.1ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/users/7be96f56-ad29-47c2-9a11-7d9259efd2ea/sessions' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 9.1ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "items": [
    {
      "session_id": "[redacted]",
      "name": "Sample Session 1",
      "id": "65028467-bd15-479d-b741-4630a662fd42"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 2",
      "id": "b0b28c4e-bdc3-4ed9-9483-fdd724aeb3ef"
    },
    {
      "session_id": "[redacted]",
      "name": "Sample Session 3",
      "id": "ab7c709c-c32d-4aa0-911b-52c680ee248f"
    }
  ]
}
  398. · POST stripe request · provider traffic · /v1/customers/cus_QJ923NUJ417WP9A8 · HTTP 200 · request 35c798263bd2 · processing 56.72ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_QJ923NUJ417WP9A8' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-raw '{
  "metadata": {
    "acme_ato_hold": "SEC-reconcile-reads-back",
    "acme_ato_hold_at": "2026-10-22T01:46:01.050Z"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 56.72ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "112",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/x-www-form-urlencoded"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "metadata": {
    "acme_ato_hold": "SEC-reconcile-reads-back",
    "acme_ato_hold_at": "2026-10-22T01:46:01.050Z"
  }
}

    Recorded response · HTTP 200

    {
  "email": "[email protected]",
  "name": "Robin Customer",
  "id": "cus_QJ923NUJ417WP9A8",
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 8,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "SEC-reconcile-reads-back",
    "acme_ato_hold_at": "2026-10-22T01:46:01.050Z"
  }
}
  399. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 7c6eb1e2933d · processing 1.43ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 1.43ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "7be96f56-ad29-47c2-9a11-7d9259efd2ea",
      "organization_id": "bf1c23b0-88f0-450c-84fc-cbea00ef5bfc",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_V42D3XWTBO9P1RGHSJGBDT09WK"
    }
  ],
  "list_metadata": {
    "before": "om_V42D3XWTBO9P1RGHSJGBDT09WK",
    "after": null
  }
}
  400. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 3255cf334fb2 · processing 0.66ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.66ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [
    {
      "object": "organization_membership",
      "user_id": "7be96f56-ad29-47c2-9a11-7d9259efd2ea",
      "organization_id": "bf1c23b0-88f0-450c-84fc-cbea00ef5bfc",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_V42D3XWTBO9P1RGHSJGBDT09WK"
    },
    {
      "object": "organization_membership",
      "user_id": "83d5f693-5a59-4996-8e36-532beec06863",
      "organization_id": "bf1c23b0-88f0-450c-84fc-cbea00ef5bfc",
      "status": "active",
      "role": {
        "slug": "admin"
      },
      "roles": [
        {
          "slug": "admin"
        }
      ],
      "id": "om_729P7RNSY8UMDOJUSKMBWQCE2R"
    }
  ],
  "list_metadata": {
    "before": "om_V42D3XWTBO9P1RGHSJGBDT09WK",
    "after": null
  }
}
  401. · DELETE workos request · provider traffic · /user_management/organization_memberships/om_V42D3XWTBO9P1RGHSJGBDT09WK · HTTP 204 · request a80d480d4594 · processing 0.86ms
  402. · POST asana request · provider traffic · /tasks · HTTP 201 · request ce50d246fc70 · processing 15.27ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/b4506e3288/tasks' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "data": {
    "name": "SEC-reconcile-reads-back: account takeover contain (contain)",
    "notes": "Alert SEC-reconcile-reads-back for user 097a1ad5db from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_QJ923NUJ417WP9A8.\nPrivileged memberships removed (restore input):\n- bf1c23b0-88f0-450c-84fc-cbea00ef5bfc admin (om_V42D3XWTBO9P1RGHSJGBDT09WK) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-reconcile-reads-back\",\"memberships\":[{\"organizationId\":\"bf1c23b0-88f0-450c-84fc-cbea00ef5bfc\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 15.27ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "681",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "data": {
    "name": "SEC-reconcile-reads-back: account takeover contain (contain)",
    "notes": "Alert SEC-reconcile-reads-back for user 097a1ad5db from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_QJ923NUJ417WP9A8.\nPrivileged memberships removed (restore input):\n- bf1c23b0-88f0-450c-84fc-cbea00ef5bfc admin (om_V42D3XWTBO9P1RGHSJGBDT09WK) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-reconcile-reads-back\",\"memberships\":[{\"organizationId\":\"bf1c23b0-88f0-450c-84fc-cbea00ef5bfc\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  }
}

    Recorded response · HTTP 201

    {
  "data": {
    "name": "SEC-reconcile-reads-back: account takeover contain (contain)",
    "notes": "Alert SEC-reconcile-reads-back for user 097a1ad5db from idp-risk: mfa_reset, admin_role_granted.\nDecision: contain (high risk (score 75)).\nScore 75 (high): mfa_reset +35; admin_role_granted +40.\nStripe refund hold on cus_QJ923NUJ417WP9A8.\nPrivileged memberships removed (restore input):\n- bf1c23b0-88f0-450c-84fc-cbea00ef5bfc admin (om_V42D3XWTBO9P1RGHSJGBDT09WK) auto: high risk\nRestore with {\"stage\":\"restore\",\"alertId\":\"SEC-reconcile-reads-back\",\"memberships\":[{\"organizationId\":\"bf1c23b0-88f0-450c-84fc-cbea00ef5bfc\",\"role\":\"admin\"}]}",
    "workspace": "acme-security"
  },
  "id": "2d0fb6c0-3807-4963-9042-1b3c6ec65cdc"
}
  403. · POST slack request · provider traffic · /api/chat.postMessage · HTTP 200 · request cc18b9892df9 · processing 12.39ms
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/sandbox/bb5d62e0ca/api/chat.postMessage' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'content-type: application/json; charset=utf-8' \
  --data-raw '{
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-reconcile-reads-back (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 12.39ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "content-length": "192",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "content-type": "application/json; charset=utf-8"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    {
  "channel": "C0SECURITY1",
  "text": ":lock: SEC-reconcile-reads-back (contain): contain, high risk (score 75). 1 privileged membership(s). Refunds held.",
  "unfurl_links": false,
  "unfurl_media": false
}

    Recorded response · HTTP 200

    {
  "channel": "C0SECURITY1",
  "message": {
    "bot_id": "bot_91bbe6744054490ca3c2f6b1a7",
    "client_msg_id": "cli_772ca1992c344296a20b79bd52",
    "name": "item-e44301",
    "old_name": "Sample Old",
    "parent_user_id": "par_34a8d410ea1b455d8e74a8bb9e",
    "permalink": "my-resource",
    "reply_count": 0,
    "reply_users_count": 0,
    "text": "Sample text content",
    "ts": "sample-value",
    "type": "default",
    "unread_count": 0,
    "username": "acme-corp"
  },
  "ok": true,
  "ts": "173CTWY7GD.FKXZHN"
}
  404. · POST app request /invocations · reconcile reads back · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "reconcile",
  "runId": "reconcile-reads-back-vr_2e81298bdd5645a38f14efcf2db1dcf0"
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:46:03.964415+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "89",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "reconcile",
  "runId": "reconcile-reads-back-vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response · HTTP 200

    {
  "runId": "reconcile-reads-back-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "reconcile_reads_back"
  },
  "duplicateStarts": 0,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 828
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 514
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_QJ923NUJ417WP9A8",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_QJ923NUJ417WP9A8",
        "alert": "SEC-reconcile-reads-back"
      },
      "attempts": 1,
      "ref": "cus_QJ923NUJ417WP9A8",
      "appliedAt": "2026-10-22T01:46:02.127Z",
      "reconcile": {
        "status": "match",
        "checkedAt": "2026-10-22T01:46:03.779Z"
      },
      "reconciled": "match"
    },
    {
      "id": "workos.remove_membership:om_V42D3XWTBO9P1RGHSJGBDT09WK",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "097a1ad5db",
        "organization": "bf1c23b0-88f0-450c-84fc-cbea00ef5bfc",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_V42D3XWTBO9P1RGHSJGBDT09WK",
      "detail": {
        "organizationId": "bf1c23b0-88f0-450c-84fc-cbea00ef5bfc",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:46:03.147Z",
      "reconcile": {
        "status": "match",
        "checkedAt": "2026-10-22T01:46:03.801Z"
      },
      "reconciled": "match"
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-reconcile-reads-back",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "2d0fb6c0-3807-4963-9042-1b3c6ec65cdc",
      "appliedAt": "2026-10-22T01:46:03.290Z",
      "reconcile": {
        "status": "unverifiable",
        "detail": "no read-back for this action",
        "checkedAt": "2026-10-22T01:46:03.643Z"
      },
      "reconciled": "unverifiable"
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "173CTWY7GD.FKXZHN",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:46:03.421Z",
      "reconcile": {
        "status": "unverifiable",
        "detail": "no read-back for this action",
        "checkedAt": "2026-10-22T01:46:03.643Z"
      },
      "reconciled": "unverifiable"
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:46:01.050Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:46:01.880Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:46:01.888Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:46:02.128Z",
      "msg": "stripe.hold_customer:cus_QJ923NUJ417WP9A8: applied"
    },
    {
      "at": "2026-10-22T01:46:03.147Z",
      "msg": "workos.remove_membership:om_V42D3XWTBO9P1RGHSJGBDT09WK: applied"
    },
    {
      "at": "2026-10-22T01:46:03.290Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:46:03.421Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:46:03.422Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:46:03.801Z",
      "msg": "reconciled: {\"match\":2,\"unverifiable\":2}"
    }
  ],
  "createdAt": "2026-10-22T01:46:01.050Z",
  "updatedAt": "2026-10-22T01:46:03.801Z"
}
  405. · GET stripe request · provider traffic · /v1/customers/cus_QJ923NUJ417WP9A8 · HTTP 200 · request 0252e4bf707f · processing 17.68ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_QJ923NUJ417WP9A8' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 17.68ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 8,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "email": "[email protected]",
  "id": "cus_QJ923NUJ417WP9A8",
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "name": "Robin Customer",
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "SEC-reconcile-reads-back",
    "acme_ato_hold_at": "2026-10-22T01:46:01.050Z"
  }
}
  406. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 4c56461fb938 · processing 0.54ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.54ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [],
  "list_metadata": {
    "before": null,
    "after": null
  }
}
  407. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/reconcile_reads_back/runs · reconcile reads back · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/reconcile_reads_back/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:46:04.272496+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "reconcile-reads-back-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "reconcile_reads_back"
      },
      "duplicateStarts": 0,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 828
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 514
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_QJ923NUJ417WP9A8",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_QJ923NUJ417WP9A8",
            "alert": "SEC-reconcile-reads-back"
          },
          "attempts": 1,
          "ref": "cus_QJ923NUJ417WP9A8",
          "appliedAt": "2026-10-22T01:46:02.127Z",
          "reconcile": {
            "status": "match",
            "checkedAt": "2026-10-22T01:46:03.779Z"
          },
          "reconciled": "match"
        },
        {
          "id": "workos.remove_membership:om_V42D3XWTBO9P1RGHSJGBDT09WK",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "097a1ad5db",
            "organization": "bf1c23b0-88f0-450c-84fc-cbea00ef5bfc",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_V42D3XWTBO9P1RGHSJGBDT09WK",
          "detail": {
            "organizationId": "bf1c23b0-88f0-450c-84fc-cbea00ef5bfc",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:46:03.147Z",
          "reconcile": {
            "status": "match",
            "checkedAt": "2026-10-22T01:46:03.801Z"
          },
          "reconciled": "match"
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-reconcile-reads-back",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "2d0fb6c0-3807-4963-9042-1b3c6ec65cdc",
          "appliedAt": "2026-10-22T01:46:03.290Z",
          "reconcile": {
            "status": "unverifiable",
            "detail": "no read-back for this action",
            "checkedAt": "2026-10-22T01:46:03.643Z"
          },
          "reconciled": "unverifiable"
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "173CTWY7GD.FKXZHN",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:46:03.421Z",
          "reconcile": {
            "status": "unverifiable",
            "detail": "no read-back for this action",
            "checkedAt": "2026-10-22T01:46:03.643Z"
          },
          "reconciled": "unverifiable"
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:46:01.050Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:46:01.880Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:46:01.888Z",
          "msg": "planned 4 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:46:02.128Z",
          "msg": "stripe.hold_customer:cus_QJ923NUJ417WP9A8: applied"
        },
        {
          "at": "2026-10-22T01:46:03.147Z",
          "msg": "workos.remove_membership:om_V42D3XWTBO9P1RGHSJGBDT09WK: applied"
        },
        {
          "at": "2026-10-22T01:46:03.290Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:46:03.421Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:46:03.422Z",
          "msg": "done (ok)"
        },
        {
          "at": "2026-10-22T01:46:03.801Z",
          "msg": "reconciled: {\"match\":2,\"unverifiable\":2}"
        }
      ],
      "createdAt": "2026-10-22T01:46:01.050Z",
      "updatedAt": "2026-10-22T01:46:03.801Z"
    }
  ]
}
  408. · POST app request /invocations · reconcile reads back · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "reconcile-reads-back-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-reconcile-reads-back",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "reconcile_reads_back"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:46:04.482849+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "453",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "start",
  "runId": "reconcile-reads-back-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-reconcile-reads-back",
    "email": "[email protected]",
    "signals": [
      "mfa_reset",
      "admin_role_granted"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "reconcile_reads_back"
  }
}

    Recorded response · HTTP 200

    {
  "runId": "reconcile-reads-back-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "reconcile_reads_back"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 828
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 514
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_QJ923NUJ417WP9A8",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_QJ923NUJ417WP9A8",
        "alert": "SEC-reconcile-reads-back"
      },
      "attempts": 1,
      "ref": "cus_QJ923NUJ417WP9A8",
      "appliedAt": "2026-10-22T01:46:02.127Z",
      "reconcile": {
        "status": "match",
        "checkedAt": "2026-10-22T01:46:03.779Z"
      },
      "reconciled": "match"
    },
    {
      "id": "workos.remove_membership:om_V42D3XWTBO9P1RGHSJGBDT09WK",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "097a1ad5db",
        "organization": "bf1c23b0-88f0-450c-84fc-cbea00ef5bfc",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_V42D3XWTBO9P1RGHSJGBDT09WK",
      "detail": {
        "organizationId": "bf1c23b0-88f0-450c-84fc-cbea00ef5bfc",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:46:03.147Z",
      "reconcile": {
        "status": "match",
        "checkedAt": "2026-10-22T01:46:03.801Z"
      },
      "reconciled": "match"
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-reconcile-reads-back",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "2d0fb6c0-3807-4963-9042-1b3c6ec65cdc",
      "appliedAt": "2026-10-22T01:46:03.290Z",
      "reconcile": {
        "status": "unverifiable",
        "detail": "no read-back for this action",
        "checkedAt": "2026-10-22T01:46:03.643Z"
      },
      "reconciled": "unverifiable"
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "173CTWY7GD.FKXZHN",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:46:03.421Z",
      "reconcile": {
        "status": "unverifiable",
        "detail": "no read-back for this action",
        "checkedAt": "2026-10-22T01:46:03.643Z"
      },
      "reconciled": "unverifiable"
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:46:01.050Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:46:01.880Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:46:01.888Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:46:02.128Z",
      "msg": "stripe.hold_customer:cus_QJ923NUJ417WP9A8: applied"
    },
    {
      "at": "2026-10-22T01:46:03.147Z",
      "msg": "workos.remove_membership:om_V42D3XWTBO9P1RGHSJGBDT09WK: applied"
    },
    {
      "at": "2026-10-22T01:46:03.290Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:46:03.421Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:46:03.422Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:46:03.801Z",
      "msg": "reconciled: {\"match\":2,\"unverifiable\":2}"
    },
    {
      "at": "2026-10-22T01:46:04.311Z",
      "msg": "duplicate start ignored"
    }
  ],
  "createdAt": "2026-10-22T01:46:01.050Z",
  "updatedAt": "2026-10-22T01:46:04.311Z",
  "duplicate": true
}
  409. · POST app request /invocations · reconcile reads back · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "reconcile",
  "runId": "reconcile-reads-back-vr_2e81298bdd5645a38f14efcf2db1dcf0"
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:46:04.889453+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "89",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    {
  "action": "reconcile",
  "runId": "reconcile-reads-back-vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response · HTTP 200

    {
  "runId": "reconcile-reads-back-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "workflow": "account-takeover-containment",
  "metadata": {
    "organization": "Acme",
    "company": "Acme Corporation",
    "environment": "unconfigured",
    "owner": "unassigned",
    "department": "unassigned",
    "ownerTeam": "unassigned",
    "oncall": "unassigned",
    "version": "unversioned",
    "sourceCommit": "unrecorded"
  },
  "org": "IT",
  "team": "it-security",
  "phase": "DONE",
  "closed": true,
  "outcome": "ok",
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "reconcile_reads_back"
  },
  "duplicateStarts": 1,
  "agents": [
    {
      "name": "identity",
      "status": "ok",
      "summary": "1 membership(s), 1 privileged, 0 session(s)",
      "durationMs": 828
    },
    {
      "name": "billing",
      "status": "ok",
      "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
      "durationMs": 514
    },
    {
      "name": "assessment",
      "status": "ok",
      "summary": "contain: high risk (score 75)",
      "durationMs": 0
    }
  ],
  "actions": [
    {
      "id": "stripe.hold_customer:cus_QJ923NUJ417WP9A8",
      "kind": "stripe.hold_customer",
      "provider": "stripe",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "customer": "cus_QJ923NUJ417WP9A8",
        "alert": "SEC-reconcile-reads-back"
      },
      "attempts": 1,
      "ref": "cus_QJ923NUJ417WP9A8",
      "appliedAt": "2026-10-22T01:46:02.127Z",
      "reconcile": {
        "status": "match",
        "checkedAt": "2026-10-22T01:46:04.660Z"
      },
      "reconciled": "match"
    },
    {
      "id": "workos.remove_membership:om_V42D3XWTBO9P1RGHSJGBDT09WK",
      "kind": "workos.remove_membership",
      "provider": "workos",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "user": "097a1ad5db",
        "organization": "bf1c23b0-88f0-450c-84fc-cbea00ef5bfc",
        "role": "admin",
        "why": "high risk"
      },
      "attempts": 1,
      "ref": "om_V42D3XWTBO9P1RGHSJGBDT09WK",
      "detail": {
        "organizationId": "bf1c23b0-88f0-450c-84fc-cbea00ef5bfc",
        "role": "admin"
      },
      "appliedAt": "2026-10-22T01:46:03.147Z",
      "reconcile": {
        "status": "match",
        "checkedAt": "2026-10-22T01:46:04.726Z"
      },
      "reconciled": "match"
    },
    {
      "id": "asana.incident_record",
      "kind": "asana.incident_record",
      "provider": "asana",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "alert": "SEC-reconcile-reads-back",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "2d0fb6c0-3807-4963-9042-1b3c6ec65cdc",
      "appliedAt": "2026-10-22T01:46:03.290Z",
      "reconcile": {
        "status": "unverifiable",
        "detail": "no read-back for this action",
        "checkedAt": "2026-10-22T01:46:04.526Z"
      },
      "reconciled": "unverifiable"
    },
    {
      "id": "slack.post_alert",
      "kind": "slack.post_alert",
      "provider": "slack",
      "agent": "assessment",
      "gate": "auto",
      "status": "applied",
      "summary": {
        "channel": "C0SECURITY1",
        "mode": "contain"
      },
      "attempts": 1,
      "ref": "173CTWY7GD.FKXZHN",
      "detail": {
        "channel": "C0SECURITY1"
      },
      "appliedAt": "2026-10-22T01:46:03.421Z",
      "reconcile": {
        "status": "unverifiable",
        "detail": "no read-back for this action",
        "checkedAt": "2026-10-22T01:46:04.526Z"
      },
      "reconciled": "unverifiable"
    }
  ],
  "counts": {
    "applied": 4,
    "failed": 0,
    "pendingApproval": 0,
    "skipped": 0,
    "rejected": 0
  },
  "output": {
    "mode": "contain",
    "reason": "high risk (score 75)",
    "score": 75,
    "level": "high",
    "removals": 1,
    "removalsAuto": 1,
    "holds": 1,
    "revokeSessions": false,
    "restores": 0,
    "releases": 0
  },
  "events": [
    {
      "at": "2026-10-22T01:46:01.050Z",
      "msg": "started by U_FETCHSANDBOX"
    },
    {
      "at": "2026-10-22T01:46:01.880Z",
      "msg": "agents: identity=ok, billing=ok"
    },
    {
      "at": "2026-10-22T01:46:01.888Z",
      "msg": "planned 4 action(s): 0 need approval"
    },
    {
      "at": "2026-10-22T01:46:02.128Z",
      "msg": "stripe.hold_customer:cus_QJ923NUJ417WP9A8: applied"
    },
    {
      "at": "2026-10-22T01:46:03.147Z",
      "msg": "workos.remove_membership:om_V42D3XWTBO9P1RGHSJGBDT09WK: applied"
    },
    {
      "at": "2026-10-22T01:46:03.290Z",
      "msg": "asana.incident_record: applied"
    },
    {
      "at": "2026-10-22T01:46:03.421Z",
      "msg": "slack.post_alert: applied"
    },
    {
      "at": "2026-10-22T01:46:03.422Z",
      "msg": "done (ok)"
    },
    {
      "at": "2026-10-22T01:46:03.801Z",
      "msg": "reconciled: {\"match\":2,\"unverifiable\":2}"
    },
    {
      "at": "2026-10-22T01:46:04.311Z",
      "msg": "duplicate start ignored"
    },
    {
      "at": "2026-10-22T01:46:04.727Z",
      "msg": "reconciled: {\"match\":2,\"unverifiable\":2}"
    }
  ],
  "createdAt": "2026-10-22T01:46:01.050Z",
  "updatedAt": "2026-10-22T01:46:04.727Z"
}
  410. · GET stripe request · provider traffic · /v1/customers/cus_QJ923NUJ417WP9A8 · HTTP 200 · request 554baea79956 · processing 17.76ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/25a585649b/v1/customers/cus_QJ923NUJ417WP9A8' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 17.76ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "address": null,
  "balance": 0,
  "business_name": "Sample Business",
  "cash_balance": null,
  "created": 8,
  "currency": "USD",
  "customer_account": null,
  "default_source": null,
  "delinquent": false,
  "description": null,
  "discount": null,
  "email": "[email protected]",
  "id": "cus_QJ923NUJ417WP9A8",
  "individual_name": "Sample Individual",
  "invoice_prefix": null,
  "livemode": false,
  "name": "Robin Customer",
  "object": "customer",
  "phone": "+14155550100",
  "preferred_locales": null,
  "shipping": null,
  "tax_exempt": "exempt",
  "test_clock": null,
  "metadata": {
    "acme_ato_hold": "SEC-reconcile-reads-back",
    "acme_ato_hold_at": "2026-10-22T01:46:01.050Z"
  }
}
  411. · GET workos request · provider traffic · /user_management/organization_memberships · HTTP 200 · request 126309a5a4a3 · processing 0.51ms
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/sandbox/0af7cb3e63/user_management/organization_memberships' \
  --header 'host: fetchsandbox.com' \
  --header 'user-agent: node' \
  --header 'accept: application/json' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL resolved from the saved run route. Provider processing: 0.51ms.

    Recorded request headers

    {
  "host": "fetchsandbox.com",
  "user-agent": "node",
  "accept": "application/json",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0"
}

    Recorded response headers

    Response headers were not saved in this run.

    Request body

    No body shown for this read.

    Recorded response · HTTP 200

    {
  "object": "list",
  "data": [],
  "list_metadata": {
    "before": null,
    "after": null
  }
}
  412. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/reconcile_reads_back/runs · reconcile reads back · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/reconcile_reads_back/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:46:05.196203+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": [
    {
      "runId": "reconcile-reads-back-vr_2e81298bdd5645a38f14efcf2db1dcf0",
      "workflow": "account-takeover-containment",
      "metadata": {
        "organization": "Acme",
        "company": "Acme Corporation",
        "environment": "unconfigured",
        "owner": "unassigned",
        "department": "unassigned",
        "ownerTeam": "unassigned",
        "oncall": "unassigned",
        "version": "unversioned",
        "sourceCommit": "unrecorded"
      },
      "org": "IT",
      "team": "it-security",
      "phase": "DONE",
      "closed": true,
      "outcome": "ok",
      "requestedBy": {
        "userId": "U_FETCHSANDBOX"
      },
      "labels": {
        "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
        "fs_case": "reconcile_reads_back"
      },
      "duplicateStarts": 1,
      "agents": [
        {
          "name": "identity",
          "status": "ok",
          "summary": "1 membership(s), 1 privileged, 0 session(s)",
          "durationMs": 828
        },
        {
          "name": "billing",
          "status": "ok",
          "summary": "1 Stripe customer(s), 0 refund(s) in 24 h",
          "durationMs": 514
        },
        {
          "name": "assessment",
          "status": "ok",
          "summary": "contain: high risk (score 75)",
          "durationMs": 0
        }
      ],
      "actions": [
        {
          "id": "stripe.hold_customer:cus_QJ923NUJ417WP9A8",
          "kind": "stripe.hold_customer",
          "provider": "stripe",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "customer": "cus_QJ923NUJ417WP9A8",
            "alert": "SEC-reconcile-reads-back"
          },
          "attempts": 1,
          "ref": "cus_QJ923NUJ417WP9A8",
          "appliedAt": "2026-10-22T01:46:02.127Z",
          "reconcile": {
            "status": "match",
            "checkedAt": "2026-10-22T01:46:04.660Z"
          },
          "reconciled": "match"
        },
        {
          "id": "workos.remove_membership:om_V42D3XWTBO9P1RGHSJGBDT09WK",
          "kind": "workos.remove_membership",
          "provider": "workos",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "user": "097a1ad5db",
            "organization": "bf1c23b0-88f0-450c-84fc-cbea00ef5bfc",
            "role": "admin",
            "why": "high risk"
          },
          "attempts": 1,
          "ref": "om_V42D3XWTBO9P1RGHSJGBDT09WK",
          "detail": {
            "organizationId": "bf1c23b0-88f0-450c-84fc-cbea00ef5bfc",
            "role": "admin"
          },
          "appliedAt": "2026-10-22T01:46:03.147Z",
          "reconcile": {
            "status": "match",
            "checkedAt": "2026-10-22T01:46:04.726Z"
          },
          "reconciled": "match"
        },
        {
          "id": "asana.incident_record",
          "kind": "asana.incident_record",
          "provider": "asana",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "alert": "SEC-reconcile-reads-back",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "2d0fb6c0-3807-4963-9042-1b3c6ec65cdc",
          "appliedAt": "2026-10-22T01:46:03.290Z",
          "reconcile": {
            "status": "unverifiable",
            "detail": "no read-back for this action",
            "checkedAt": "2026-10-22T01:46:04.526Z"
          },
          "reconciled": "unverifiable"
        },
        {
          "id": "slack.post_alert",
          "kind": "slack.post_alert",
          "provider": "slack",
          "agent": "assessment",
          "gate": "auto",
          "status": "applied",
          "summary": {
            "channel": "C0SECURITY1",
            "mode": "contain"
          },
          "attempts": 1,
          "ref": "173CTWY7GD.FKXZHN",
          "detail": {
            "channel": "C0SECURITY1"
          },
          "appliedAt": "2026-10-22T01:46:03.421Z",
          "reconcile": {
            "status": "unverifiable",
            "detail": "no read-back for this action",
            "checkedAt": "2026-10-22T01:46:04.526Z"
          },
          "reconciled": "unverifiable"
        }
      ],
      "counts": {
        "applied": 4,
        "failed": 0,
        "pendingApproval": 0,
        "skipped": 0,
        "rejected": 0
      },
      "output": {
        "mode": "contain",
        "reason": "high risk (score 75)",
        "score": 75,
        "level": "high",
        "removals": 1,
        "removalsAuto": 1,
        "holds": 1,
        "revokeSessions": false,
        "restores": 0,
        "releases": 0
      },
      "events": [
        {
          "at": "2026-10-22T01:46:01.050Z",
          "msg": "started by U_FETCHSANDBOX"
        },
        {
          "at": "2026-10-22T01:46:01.880Z",
          "msg": "agents: identity=ok, billing=ok"
        },
        {
          "at": "2026-10-22T01:46:01.888Z",
          "msg": "planned 4 action(s): 0 need approval"
        },
        {
          "at": "2026-10-22T01:46:02.128Z",
          "msg": "stripe.hold_customer:cus_QJ923NUJ417WP9A8: applied"
        },
        {
          "at": "2026-10-22T01:46:03.147Z",
          "msg": "workos.remove_membership:om_V42D3XWTBO9P1RGHSJGBDT09WK: applied"
        },
        {
          "at": "2026-10-22T01:46:03.290Z",
          "msg": "asana.incident_record: applied"
        },
        {
          "at": "2026-10-22T01:46:03.421Z",
          "msg": "slack.post_alert: applied"
        },
        {
          "at": "2026-10-22T01:46:03.422Z",
          "msg": "done (ok)"
        },
        {
          "at": "2026-10-22T01:46:03.801Z",
          "msg": "reconciled: {\"match\":2,\"unverifiable\":2}"
        },
        {
          "at": "2026-10-22T01:46:04.311Z",
          "msg": "duplicate start ignored"
        },
        {
          "at": "2026-10-22T01:46:04.727Z",
          "msg": "reconciled: {\"match\":2,\"unverifiable\":2}"
        }
      ],
      "createdAt": "2026-10-22T01:46:01.050Z",
      "updatedAt": "2026-10-22T01:46:04.727Z"
    }
  ]
}
  413. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/invalid_input_rejected/runs · invalid input rejected · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/invalid_input_rejected/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:46:05.399586+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  414. · POST app request /invocations · invalid input rejected · HTTP 400
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "invalid-input-rejected-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-baseline",
    "email": "[email protected]",
    "signals": [
      "looks_bad"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "invalid_input_rejected"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:46:05.600818+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "412",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "218"
}

    Request body

    {
  "action": "start",
  "runId": "invalid-input-rejected-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-baseline",
    "email": "[email protected]",
    "signals": [
      "looks_bad"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "invalid_input_rejected"
  }
}

    Recorded response · HTTP 400

    {
  "error": "invalid input",
  "issues": [
    "signals.0: Invalid option: expected one of \"impossible_travel\"|\"mfa_reset\"|\"password_reset_via_support\"|\"new_api_key\"|\"mass_export\"|\"new_device\"|\"admin_role_granted\""
  ]
}
  415. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/invalid_input_rejected/runs · invalid input rejected · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/invalid_input_rejected/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:46:05.922770+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}
  416. · POST app request /invocations · invalid input rejected · HTTP 400
    View sanitized request and response

    Curl-style request view

    curl --request POST 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/invocations' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]' \
  --header 'content-type: application/json' \
  --data-raw '{
  "action": "start",
  "runId": "invalid-input-rejected-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-baseline",
    "email": "[email protected]",
    "signals": [
      "looks_bad"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "invalid_input_rejected"
  }
}'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:46:06.128991+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]",
  "content-length": "412",
  "content-type": "application/json"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "218"
}

    Request body

    {
  "action": "start",
  "runId": "invalid-input-rejected-vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "input": {
    "stage": "contain",
    "alertId": "SEC-baseline",
    "email": "[email protected]",
    "signals": [
      "looks_bad"
    ],
    "source": "idp-risk",
    "securityChannel": "C0SECURITY1",
    "approvers": [
      "U_CISO"
    ]
  },
  "requestedBy": {
    "userId": "U_FETCHSANDBOX"
  },
  "labels": {
    "fs_run": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
    "fs_case": "invalid_input_rejected"
  }
}

    Recorded response · HTTP 400

    {
  "error": "invalid input",
  "issues": [
    "signals.0: Invalid option: expected one of \"impossible_travel\"|\"mfa_reset\"|\"password_reset_via_support\"|\"new_api_key\"|\"mass_export\"|\"new_device\"|\"admin_role_granted\""
  ]
}
  417. · GET app request /verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/invalid_input_rejected/runs · invalid input rejected · HTTP 200
    View sanitized request and response

    Curl-style request view

    curl --request GET 'https://fetchsandbox.com/api/relay/cd5add6f0e3c56d08854fa8b9246d375d5768cb66066c9af/verify/runs/vr_2e81298bdd5645a38f14efcf2db1dcf0/cases/invalid_input_rejected/runs' \
  --header 'accept: */*' \
  --header 'user-agent: python-httpx/0.28.1' \
  --header 'host: fetchsandbox.com' \
  --header 'x-flow-run-id: vr_2e81298bdd5645a38f14efcf2db1dcf0' \
  --header 'x-fetchsandbox-relay: [redacted]' \
  --header 'authorization: [redacted]'

    This view is reconstructed from the saved method, URL, and sanitized headers and body. Secrets are removed and the result is not exact wire bytes, so it cannot be used as a runnable authenticated replay.

    Target URL recorded at execution. Response finished: 2026-10-22T01:46:06.428227+00:00.

    Recorded request headers

    {
  "accept": "*/*",
  "user-agent": "python-httpx/0.28.1",
  "host": "fetchsandbox.com",
  "x-flow-run-id": "vr_2e81298bdd5645a38f14efcf2db1dcf0",
  "x-fetchsandbox-relay": "[redacted]",
  "authorization": "[redacted]"
}

    Recorded response headers

    {
  "content-type": "application/json",
  "content-length": "11"
}

    Request body

    This request had no body.

    Recorded response · HTTP 200

    {
  "runs": []
}

Expand a request to inspect its sanitized payload. Credentials and personal data stay hidden.

Timestamps reflect when the sandbox recorded each request, not the order your app triggered them.

  • Verification covers the declared HTTP actions and state reads in this run.
  • The app version shown was supplied by the app itself, not independently checked.
  • Passing all checks in this run does not certify the whole app as production-ready.
  • The verifier session does not survive a restart. This says nothing about the durability of the app under test.
  • App state shown here is what the app's own endpoint reported. It is not independently checked against the database.

Sanitized summary. Expand a timeline event to inspect the safe request and response fields; sensitive provider and application data stays hidden.