# List decisions from a certified release
URL: https://backworkhealth.com/docs/api/listCertifiedReleaseDecisions

Returns only the immutable derived_decision_v1 allowlist from one certified_release.v1 snapshot.

**Endpoint:** `GET /api/v1/releases/{releaseId}/decisions`

**Availability:** Live in production.

**Authentication:** API key in `Authorization: Bearer <key>` with the `certified:derived_decision:read` scope.

Returns only the immutable `derived_decision_v1` allowlist from one `certified_release.v1` snapshot. This surface requires a dedicated API key whose complete scope set is exactly `certified:derived_decision:read`; OAuth credentials, ordinary `read` or `admin` keys, and keys carrying any additional scope are not valid for this endpoint. The key must also hold an active entitlement to the requested release. Responses are JSON only: omit `format` and `_format`, and omit `Accept` or request `application/json` (a wildcard Accept header is also treated as JSON). CSV or FHIR negotiation returns 406. Missing, expired, revoked, schema-incompatible, and unentitled releases intentionally share the same non-enumerating 404 response, sent with `Cache-Control: private, no-store`. An authorized query with no matching decision returns 200 with an empty data array.

**Parameters**

* `releaseId` (path, required): Content-addressed certified release ID assigned to the dedicated key
* `code` (query, required): CPT, HCPCS, ICD-10-CM, or ICD-10-PCS code. Input is normalized to uppercase.
* `code_system` (query): Optional code-system filter
* `payer_code` (query): Optional canonical payer-code filter. Input is normalized to uppercase.
* `cursor` (query): Decision ID returned as the prior page's pagination cursor
* `limit` (query): Results per page
* `Accept` (header): Omit this header or request `application/json`. `*/*` also resolves to JSON. Requests negotiating `text/csv` or `application/fhir+json` receive 406.

**Example request**

```bash
curl -X GET "https://backworkhealth.com/api/v1/releases/YOUR_RELEASE_ID/decisions?code=string&code_system=CPT" \
  -H "Authorization: Bearer $BACKWORK_API_KEY"
```

**Example response** (`200`)

```json
{
  "success": true,
  "data": [
    {
      "decision_id": "string",
      "record_sha256": "string",
      "policy_id": "string",
      "policy_version": 1,
      "policy_fingerprint_sha256": "string",
      "source_document_sha256": "string",
      "payer_code": "string",
      "line_of_business": "commercial",
      "code_system": "CPT",
      "code": "string",
      "disposition": "covered",
      "effective_date": "2026-01-15",
      "retire_date": "2026-01-15"
    }
  ],
  "meta": {
    "request_id": "string",
    "timestamp": "2026-01-15T10:30:00Z",
    "pagination": {
      "cursor": "string",
      "has_more": true,
      "limit": 1
    },
    "release_id": "string",
    "release_manifest_sha256": "string",
    "dataset_sha256": "string",
    "source_set_sha256": "string",
    "qa_certification_sha256": "string",
    "rights_evidence_sha256": "string",
    "qa_status": "certified",
    "rights_status": "approved",
    "field_profile": "derived_decision_v1",
    "release_schema_version": "certified_release.v1",
    "source_as_of": "2026-01-15T10:30:00Z",
    "expires_at": "2026-01-15T10:30:00Z",
    "certified_at": "2026-01-15T10:30:00Z",
    "rights_approved_at": "2026-01-15T10:30:00Z",
    "release_created_at": "2026-01-15T10:30:00Z"
  }
}
```