Re-verify and re-enable a subscription
Re-runs the sink-appropriate probe (dispatched by sink kind) and, on a probe success, transitions the subscription back to active and clears any auto-disable in the same transaction. The row is transitioned in place — the id and signing secret are preserved. A classified probe failure is still a 200. This route is naturally idempotent and requires no X-Idempotency header. Today only the webhook sink has a registered verify probe; AWS and RabbitMQ sinks return 422 probe_unsupported_for_sink_kind (queue credentials are verified at write time via the credential PUT).
Authorizations
A bearer JWT issued by plugin-auth (lib-auth). The tenant identity is resolved from the validated token claims; the /v1 surface never reads a tenant from the body, path, or query. Machine callers obtain a token via the plugin-auth client-credentials flow. The /admin surface authorizes against an operator scope and carries no tenant context.
Path Parameters
The unique identifier of the subscription (UUIDv7).
Response
The probe ran; the body carries the classified result.
The classified result of a synchronous probe (ping, verify, or credential write). A classified failure is still returned with HTTP 200 — the probe ran and produced a verdict. It carries no secret, endpoint, or detail string.
The classified verdict of a synchronous probe.
ok, failed The target's protocol status. For webhook probes, the HTTP status (0 when none applies, e.g. a transport error or a blocked endpoint). For queue-kind credential probes, always 0.
200
A frozen taxonomy token classifying a failure. Empty on success.
""

