> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # List the tenant's rail commands and the operations that leave no record > Walks the tenant's rail-command book, newest invocation first: what this gateway told the payroll rail to do, and what the rail answered. It records TWELVE commands: refinanciamento, its reversal, renegociação, the origin-side portability exclusion, both antecipação de parcela operations, all three empréstimo legado operations, and the three contract-management ones (suspensão, reativação, alteração de termos). Each row carries the situation it is durably parked in, reported exactly as it stands: an invoking row whose deadline has passed is the row the recovery sweep will convert, and this read never anticipates that conversion. 'unlogged_operations' is a FIXED list rather than anything derived from the rows, and it names TWO operations, both on the portability path: averbarConsignadoPortabilidade and respondConsignadoPortabilityAuction. Neither command service claims a row in this book (the portability averbação claims its contract number in the averbação book, not here), so nothing in this book can report what the rail was told on a refused or unanswered call, and an empty book is NOT evidence that no call departed — which matters because portability moves a consignado contract between institutions. The field is published even when empty, so a client can tell "no operation is unlogged" from "this gateway stopped reporting it"; a rail operation added later with no durable record of its own appears here too. Not every command is CONVERGIBLE. A Manual 005 contract read decides the outcome of refinanciamento, its reversal, renegociação, the portability exclusion and both antecipação de parcela operations (by the competências its parcelasAntecipadas lists) and the alteração de termos (by the terms and dataHoraAtualizacao the read shows), so an ambiguous row of those seven leaves outcome_unknown once the recovery pass reads the registry. The other five have no such decisive read. A legado contract number, for instance, may be registered by an earlier attempt, another channel or the institution itself, so its presence proves the number is taken and not that this command committed. One of their rows that reaches outcome_unknown STAYS there. That is the truth about the call, not a queue nobody drains, and the situation filter is how you find them. A parked refinanciamento, renegociação, alteração de termos or legado renegociação the recovery pass cannot decide is the bank's to close, by what the Dataprev portal shows: POST /v1/consignado/rail-commands/{id}/close. 'unknown_at' SURVIVES on a closed row. An outcome that passed through ambiguity keeps that evidence, which is what lets a screen tell a clean acceptance from a recovered one. 'response_code' and 'response_message' are null on an invoking row, which the ledger's own constraint demands, and they are the refusal reason an operator came to this screen to read. Three columns of the stored row never leave: the rail's raw answer, the request digest and the idempotency key. The first can carry fields no screen was meant to publish; the other two are the money fence's own transport evidence. 'command' and 'status' may each be repeated to narrow the page to several values at once (status=invoking&status=outcome_unknown). Omitting a filter means ALL of its values, never none. A value outside either vocabulary is refused with 422 rather than matching nothing, because a page that matched nothing is indistinguishable from a tenant that never called the rail. Paging is keyset over the invocation instant and the row id, both frozen for the life of the row by the ledger's own trigger, which is what makes the position safe against a book the money path is still writing. Send the previous page's page.next_after as after. has_more is true exactly when another page exists, and next_after is null exactly when it is false, so a client loop may terminate on either. The cursor never expires; a cursor this service did not mint is refused with 422 rather than silently restarting the walk from the top. It answers from a LOCAL table and never reaches the Dataprev rail, so it cannot answer 501 and it is served on a deployment with the rail off entirely. That deployment simply has an empty book. The tenant is derived from the validated identity and is never read from the request. ## OpenAPI ````yaml /pt/openapi/v3-current/consignado.yaml get /v1/consignado/rail-commands openapi: 3.1.0 info: contact: email: contact@lerian.studio name: Lerian Studio url: https://lerian.studio description: >- OpenAPI 3.1 surface for Lerian Consignado — Dataprev. The API covers tenant credentials and rail configuration, worker margin, loan auctions and bids, contract registration and lifecycle, B3 instrument codes, disbursement confirmation, portability, refinancing, renegotiation, FGTS guarantees, reconciliation, funds, assignments, throughput, and event subscriptions. license: name: Lerian Studio General License title: Lerian Consignado API version: v1.0.0 servers: - url: https://br-consignado-gw.sandbox.lerian.net security: - BearerAuth: [] tags: - description: >- Per-tenant Dataprev credential custody and public rail configuration (upload, status, rotation, revoke, requester code, and worker portal base URL) name: Credentials - description: >- Per-tenant streaming-hub subscription control-plane (list, create, get, rotate, revoke, and test delivery) name: Subscriptions - description: >- Dataprev payroll-rail surface: FGTS balance and authorization reads, the FGTS guarantee execution, contract suspension, reactivation and term changes, the rail's own contract documents, and the on-demand reads of leilão solicitações, escriturações, repasses and employment terminations name: Consignado Rail - description: >- Synchronous rail command surface: the operations a bancarizador without the lender drives over HTTP. name: Consignado Rail Commands - description: >- Gateway-owned disbursement confirmation: a client bank recording money it has ALREADY paid to a worker. It crosses no government boundary and proxies no Dataprev operation. name: Consignado Disbursement - description: >- Per-tenant self-service outbound Dataprev rail throughput: read and set this tenant's own requests-per-second, including a deliberate pause at zero name: Consignado Throughput - description: >- The B3 instrument code (Código IF) of an averbado contract: informed once by the bancarizador after B3 registers the CCB, and read back name: Consignado Registro B3 paths: /v1/consignado/rail-commands: get: tags: - Consignado Rail Commands summary: List the tenant's rail commands and the operations that leave no record description: >- Walks the tenant's rail-command book, newest invocation first: what this gateway told the payroll rail to do, and what the rail answered. It records TWELVE commands: refinanciamento, its reversal, renegociação, the origin-side portability exclusion, both antecipação de parcela operations, all three empréstimo legado operations, and the three contract-management ones (suspensão, reativação, alteração de termos). Each row carries the situation it is durably parked in, reported exactly as it stands: an invoking row whose deadline has passed is the row the recovery sweep will convert, and this read never anticipates that conversion. 'unlogged_operations' is a FIXED list rather than anything derived from the rows, and it names TWO operations, both on the portability path: averbarConsignadoPortabilidade and respondConsignadoPortabilityAuction. Neither command service claims a row in this book (the portability averbação claims its contract number in the averbação book, not here), so nothing in this book can report what the rail was told on a refused or unanswered call, and an empty book is NOT evidence that no call departed — which matters because portability moves a consignado contract between institutions. The field is published even when empty, so a client can tell "no operation is unlogged" from "this gateway stopped reporting it"; a rail operation added later with no durable record of its own appears here too. Not every command is CONVERGIBLE. A Manual 005 contract read decides the outcome of refinanciamento, its reversal, renegociação, the portability exclusion and both antecipação de parcela operations (by the competências its parcelasAntecipadas lists) and the alteração de termos (by the terms and dataHoraAtualizacao the read shows), so an ambiguous row of those seven leaves outcome_unknown once the recovery pass reads the registry. The other five have no such decisive read. A legado contract number, for instance, may be registered by an earlier attempt, another channel or the institution itself, so its presence proves the number is taken and not that this command committed. One of their rows that reaches outcome_unknown STAYS there. That is the truth about the call, not a queue nobody drains, and the situation filter is how you find them. A parked refinanciamento, renegociação, alteração de termos or legado renegociação the recovery pass cannot decide is the bank's to close, by what the Dataprev portal shows: POST /v1/consignado/rail-commands/{id}/close. 'unknown_at' SURVIVES on a closed row. An outcome that passed through ambiguity keeps that evidence, which is what lets a screen tell a clean acceptance from a recovered one. 'response_code' and 'response_message' are null on an invoking row, which the ledger's own constraint demands, and they are the refusal reason an operator came to this screen to read. Three columns of the stored row never leave: the rail's raw answer, the request digest and the idempotency key. The first can carry fields no screen was meant to publish; the other two are the money fence's own transport evidence. 'command' and 'status' may each be repeated to narrow the page to several values at once (status=invoking&status=outcome_unknown). Omitting a filter means ALL of its values, never none. A value outside either vocabulary is refused with 422 rather than matching nothing, because a page that matched nothing is indistinguishable from a tenant that never called the rail. Paging is keyset over the invocation instant and the row id, both frozen for the life of the row by the ledger's own trigger, which is what makes the position safe against a book the money path is still writing. Send the previous page's page.next_after as after. has_more is true exactly when another page exists, and next_after is null exactly when it is false, so a client loop may terminate on either. The cursor never expires; a cursor this service did not mint is refused with 422 rather than silently restarting the walk from the top. It answers from a LOCAL table and never reaches the Dataprev rail, so it cannot answer 501 and it is served on a deployment with the rail off entirely. That deployment simply has an empty book. The tenant is derived from the validated identity and is never read from the request. operationId: listConsignadoRailCommands parameters: - description: >- Narrows the page to the named commands. Repeat the parameter for several. Omitted means all twelve. explode: true in: query name: command schema: description: >- Narrows the page to the named commands. Repeat the parameter for several. Omitted means all twelve. examples: - - refinanciamento items: enum: - refinanciamento - reversao_refinanciamento - renegociacao - exclusao_portabilidade - antecipacao_incluir - antecipacao_excluir - legado_incluir - legado_renegociar - legado_excluir - suspensao - reativacao - alteracao_termos type: string type: array - description: >- Narrows the page to the named situations. Repeat the parameter for several. Omitted means all four. explode: true in: query name: status schema: description: >- Narrows the page to the named situations. Repeat the parameter for several. Omitted means all four. examples: - - invoking items: enum: - invoking - accepted - rejected - outcome_unknown type: string type: array - description: >- The previous page's page.next_after. Omitted starts at the newest invocation. A cursor this service did not mint is refused, never restarted from the top. explode: false in: query name: after schema: description: >- The previous page's page.next_after. Omitted starts at the newest invocation. A cursor this service did not mint is refused, never restarted from the top. examples: - >- eyJ2IjoxLCJyIjoiYm9hcmQiLCJ0IjoiMjAyNi0wOC0xNFQwOToxMjozM1oiLCJrIjpbImMwMDEyIl19 type: string - description: >- Maximum number of rail commands to return. Omitted means the ceiling of 200. explode: false in: query name: limit schema: description: >- Maximum number of rail commands to return. Omitted means the ceiling of 200. examples: - 50 format: int64 maximum: 200 minimum: 1 type: integer responses: '200': content: application/json: schema: $ref: '#/components/schemas/RailCommandsPage' description: OK '401': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unauthorized '403': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Forbidden '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unprocessable Entity '429': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Too Many Requests '500': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Internal Server Error security: - BearerAuth: [] components: schemas: RailCommandsPage: additionalProperties: false properties: items: items: $ref: '#/components/schemas/RailCommandItem' type: array page: $ref: '#/components/schemas/KeysetPageMetadata' unlogged_operations: description: >- Rail operationIds this gateway runs without writing a row in this book, so their absence from the book above is not evidence they were never called. It names TWO operations today, both on the portability path: averbarConsignadoPortabilidade and respondConsignadoPortabilityAuction. Neither writes a row in this book (the portability averbação keeps its claim in the averbação book), so this book cannot report what the rail was told or what it answered — and portability moves a consignado contract between institutions. The field is published even when empty, so a client can tell that from a gateway that stopped reporting it. items: type: string type: array required: - items - page - unlogged_operations type: object Detail: additionalProperties: true properties: code: description: >- Stable, machine-readable product error code. One of the enumerated values: the CLT-NNNN catalog codes for the general refusal classes; the named command conflicts, which a client branches on to tell one conflict from another; the four terminal refusals IDEMPOTENCY_STATE_UNRECOGNISED, IDEMPOTENCY_RECORD_UNREADABLE, IDEMPOTENCY_OUTCOME_UNRECORDED and IDEMPOTENCY_REPLAY_UNAVAILABLE (422), which tell the client to reconcile the original request and never retry under a new key; IDEMPOTENCY_KEY_REUSE (422): the key is spent on a different request, so send a new key; the codes a single surface answers, named after it (FUNDO_*, REGISTRO_B3_*, ...); and the 5xx codes naming an upstream (DATAPREV_*, STREAMING_HUB_*, TENANT_MANAGER_*, the Access Manager's AUT-0033 and AUT-1021) or an unknown outcome, whose detail is client-readable; and the Access Manager's AUT-1022 (403): the partner credential holds more than one originador, so name it in the path. enum: - AUT-0033 - AUT-1021 - AUT-1022 - AVERBACAO_ARTIFACT_CONFLICT - AVERBACAO_CLAIM_CONFLICT - AVERBACAO_DOCUMENTATION_CONFLICT - AVERBACAO_EXCLUDED - AVERBACAO_HELD_BY_ANOTHER_SENDER - AVERBACAO_NOT_ACCEPTED - AVERBACAO_OPERATIONS_INTERNAL - AVERBACAO_OPERATIONS_INVALID_CURSOR - AVERBACAO_OPERATIONS_INVALID_QUERY - AVERBACAO_OPERATIONS_UNKNOWN_STATUS - AVERBACAO_OPERATION_NOT_FOUND - BID_NO_PROPOSTA_LEFT - BID_ORIGINADOR_INACTIVE - BID_ORIGINADOR_UNKNOWN - BID_PROPOSAL_SLOT_TAKEN - BID_SOLICITACAO_TAKEN - BID_SOLICITACAO_UNKNOWN - BID_SUBMISSIONS_INTERNAL - BID_SUBMISSIONS_INVALID_CURSOR - BID_SUBMISSIONS_UNKNOWN_SITUATION - BOOKING_FIELD_INVALID - CEDED_CREDIT_INTERNAL - CEDED_CREDIT_NO_FUND_ENTITLEMENT - CEDED_CREDIT_UNAVAILABLE - CLT-0001 - CLT-0002 - CLT-0003 - CLT-0004 - CLT-0005 - CLT-0006 - CLT-0007 - CLT-0008 - CLT-0009 - CLT-0010 - CLT-0011 - CONTRACT_ALREADY_REGISTERED - CONTRACT_NOT_BOOKABLE - CURSOR_EXPIRED - CURSOR_FENCE_MISMATCH - DATAPREV_CREDENTIAL_REJECTED - DATAPREV_CREDENTIAL_REQUIRED - DATAPREV_CREDENTIAL_REVOKED - DATAPREV_INVALID_RESPONSE - DATAPREV_TIMEOUT - DATAPREV_UNAVAILABLE - DECLARED_DATES_OUT_OF_ORDER - DECLARED_TERMS_INCONSISTENT - DISBURSEMENT_CONFIRMATIONS_INTERNAL - DISBURSEMENT_CONFIRMATIONS_INVALID_CURSOR - DISBURSEMENT_PAYMENT_CONFLICT - EVENT_DELIVERY_INTERNAL - EXCLUSION_AUTHORITY_CONFLICT - EXCLUSION_BOOKING_IDENTITY_INCOMPLETE - EXCLUSION_DOCUMENTATION_UNDERWAY - EXCLUSION_OPERATIONS_INTERNAL - EXCLUSION_OPERATIONS_INVALID_CURSOR - EXCLUSION_OPERATIONS_INVALID_QUERY - EXCLUSION_OPERATIONS_UNKNOWN_STATUS - EXCLUSION_OPERATION_NOT_FOUND - EXCLUSION_RENEGOTIATION_UNDERWAY - FGTS_EXECUTION_ALREADY_REFUSED - FGTS_EXECUTION_CONTRACT_TAKEN - FGTS_EXECUTION_OUTCOME_UNRESOLVED - FGTS_EXECUTION_PAYLOAD_MISMATCH - FIRST_DEDUCTION_BEFORE_COMPETENCIA - FORMALIZATION_DEADLINE_EXCEEDED - FUNDO_CNPJ_CONFLICT - FUNDO_DEACTIVATED - FUNDO_INTERNAL - FUNDO_INVALID_ID - FUNDO_INVALID_INPUT - FUNDO_NOT_FOUND - FUNDO_NOT_REGISTERED - FUNDO_REF_CONFLICT - FUNDO_UNAVAILABLE - HELD_REPASSE_MONTH_CLOSED - HELD_REPASSE_MONTH_MISMATCH - HELD_REPASSE_NOT_FOUND - HELD_REPASSE_UNATTRIBUTABLE - IDEMPOTENCY_KEY_REUSE - IDEMPOTENCY_OUTCOME_UNRECORDED - IDEMPOTENCY_RECORD_UNREADABLE - IDEMPOTENCY_REPLAY_UNAVAILABLE - IDEMPOTENCY_STATE_UNRECOGNISED - INVALID_CONTRACT_NUMBER - INVALID_CURSOR - INVALID_EVENTS_INVALID_CURSOR - INVALID_EVENT_NOT_FOUND - INVALID_EVENT_NOT_REQUEUEABLE - INVALID_PAGE_LIMIT - INVENTORY_UNAVAILABLE - LOAN_PRODUCT_VERSION_UNKNOWN - MARGIN_SNAPSHOT_INCONSISTENT - MATRICULA_DIFFERS_FROM_PROPOSAL - ORIGINADOR_INTERNAL - ORIGINADOR_INVALID_ID - ORIGINADOR_INVALID_INPUT - ORIGINADOR_NOT_FOUND - ORIGINADOR_REF_CONFLICT - ORIGINADOR_UNAVAILABLE - OUTCOME_UNKNOWN - PORTABILIDADE_WINDOW_EXPIRED - RAIL_COMMANDS_INTERNAL - RAIL_COMMANDS_INVALID_CURSOR - RAIL_COMMANDS_TENANT_REQUIRED - RAIL_COMMANDS_UNKNOWN_FILTER - RAIL_COMMAND_ALREADY_REFUSED - RAIL_COMMAND_ANSWER_NOT_RETAINED - RAIL_COMMAND_CLAIM_CONFLICT - RAIL_COMMAND_CLOSE_CONTRADICTED - RAIL_COMMAND_NOT_CLOSEABLE - RAIL_COMMAND_OUTCOME_UNRESOLVED - RAIL_COMMAND_PAYLOAD_MISMATCH - RATE_OUTSIDE_PRODUCT_RANGE - REGISTRATION_NOT_FOUND - REGISTRO_B3_AVERBACAO_NAO_CONFIRMADA - REGISTRO_B3_CONTRATO_NAO_ENCONTRADO - REGISTRO_B3_DATA_REGISTRO_INVALIDA - REGISTRO_B3_INTERNAL - REGISTRO_B3_JA_INFORMADO - REGISTRO_B3_NAO_INFORMADO - REGISTRO_B3_UNAVAILABLE - REGISTRO_B3_UNWIRED - RENEGOTIATION_EXCLUSION_UNDERWAY - REPASSE_EXPECTATIONS_INTERNAL - REPASSE_EXPECTATIONS_INVALID_CURSOR - REPASSE_EXPECTATIONS_UNKNOWN_SITUATION - REVERSAO_WINDOW_EXPIRED - SALDO_DEVEDOR_INTERNAL - SALDO_DEVEDOR_INVALID_CURSOR - SALDO_DEVEDOR_NOT_FOUND - SALDO_DEVEDOR_TENANT_REQUIRED - SALDO_DEVEDOR_UNAVAILABLE - STREAMING_HUB_TIMEOUT - STREAMING_HUB_UNAVAILABLE - TENANT_MANAGER_TIMEOUT - TENANT_MANAGER_UNAVAILABLE - THROUGHPUT_HISTORY_INTERNAL - THROUGHPUT_HISTORY_INVALID_CURSOR - THROUGHPUT_HISTORY_TENANT_REQUIRED - THROUGHPUT_HISTORY_UNAVAILABLE - THROUGH_REQUIRED - UNKNOWN_QUERY_PARAMETER - VERSION_ADMITS_NO_PESSOA_FISICA type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object RailCommandItem: additionalProperties: false properties: command: description: The rail mutation this durable row authorized. enum: - refinanciamento - reversao_refinanciamento - renegociacao - exclusao_portabilidade - antecipacao_incluir - antecipacao_excluir - legado_incluir - legado_renegociar - legado_excluir - suspensao - reativacao - alteracao_termos examples: - refinanciamento type: string id: description: >- The durable row's own identity and the tiebreaker that makes this book's order total. examples: - 7abc2d1e-4f56-4a3b-98c0-1d2e3f4a5b6c type: string invocation_deadline_at: description: >- The invocation window's close, in UTC. Always strictly after invoking_at. examples: - '2026-08-14T09:13:03Z' format: date-time type: string invoking_at: description: >- The row's own claim instant in UTC, frozen by the ledger's mutation trigger, and the leading column of this book's order. examples: - '2026-08-14T09:12:33Z' format: date-time type: string numero_contrato: description: >- The contract the mutation was aimed at, which for the contract-minting commands is the NEW contract. examples: - 99999999999AN1 type: string outcome_at: description: When the answer was established, in UTC. Null until one was. examples: - '2026-08-14T09:14:10Z' format: date-time type: - string - 'null' response_code: description: >- The rail's answer code. Null on an invoking row, which the ledger's own constraint demands. examples: - '00' type: - string - 'null' response_message: description: >- The rail's answer message, which on a refusal is the reason an operator came to this screen to read. Null on an invoking row. examples: - Operacao processada com sucesso type: - string - 'null' status: description: The situation this rail command is durably parked in. enum: - invoking - accepted - rejected - outcome_unknown examples: - accepted type: string unknown_at: description: >- When the row was parked as outcome_unknown, in UTC. It SURVIVES on a closed row, which is what tells a clean acceptance from a recovered one. Null on a row that never passed through ambiguity. examples: - '2026-08-14T09:13:04Z' format: date-time type: - string - 'null' required: - id - command - numero_contrato - status - invoking_at - invocation_deadline_at - unknown_at - outcome_at - response_code - response_message type: object KeysetPageMetadata: additionalProperties: false properties: after: description: >- The cursor this page resumed from, echoed back. Null when the read started at the beginning. examples: - >- eyJ2IjoxLCJyIjoiYm9hcmQiLCJ0IjoiMjAyNi0wOC0xNFQwOToxMjozM1oiLCJrIjpbImMwMDEyIl19 type: - string - 'null' has_more: description: Whether at least one further page exists. examples: - true type: boolean next_after: description: >- The cursor for the page after this one. Null exactly when has_more is false. examples: - >- eyJ2IjoxLCJyIjoiYm9hcmQiLCJ0IjoiMjAyNi0wOC0xNFQwOTowNzo1MVoiLCJrIjpbImMwMDM3Il19 type: - string - 'null' required: - after - next_after - has_more type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.