emfirge_branch_handback
Return the exact AWS API calls that implement a branch, bound to the branch and its verdict by hash; optionally verify them.
Parameters
branch_id: string · required; verify: boolean · optional
{ "branch_id": "branch_456", "verify": true }
Returns
The response is JSON shaped for the operation. The fields and semantics are described below.
{
"branch_id": "branch_456", "kind": "aws-api-calls",
"calls": [{ "change_index": 0, "service": "ec2", "operation": "RevokeSecurityGroupIngress", "params": { "GroupId": "NAME_132" /* … */ } }],
"input_sha256": "4d0c…91fb", "base_analysis_id": "analysis_123",
"branch_revision": "3f9a…c21e", "verdict": "pass", "verdict_id": "e83a…5b02"
}
Validation, behavior, and limits
The hand-back is the exact set of AWS API calls for the branch’s changes, plus input_sha256, base_analysis_id, branch_revision, verdict, and verdict_id. Emfirge never applies them; you or your pipeline do.
With verify, the backend recomputes the calls and checks that the hash, base snapshot, branch revision, and verdict still match. A mismatch returns a reason such as input_hash_mismatch, base_snapshot_changed, branch_revision_changed, or verdict_changed.
Changes that cannot be expressed as API calls are returned as gaps (unmappable_changes), never as partial calls. A branch created from a plan uses that plan’s own hand-back instead.