# Allocation planning, occupancy replay and response metadata

## Order Cancellation Deallocation Plan

Plan order cancellations while preserving protected allocations. Supply current order lines, requested cancellation quantities, allocation records and explicit release ranks. All quantities are nonnegative safe whole integers in the single declared common unit. A stock ID identifies one exact item-location tuple; every line references a declared stock ID, and every allocation inherits its line's stock identity and common unit. No unit conversion, substitution or approval is inferred. For each independent line, consume already-unallocated quantity first, then release the highest numeric rank before lower ranks, never taking an allocation below its protected quantity. Release ranks must be unique within a line; the same rank on different lines is allowed. The allocation plan is returned in descending rank order. A line that cannot satisfy its entire requested cancellation is blocked atomically: its applied cancellation and releases are zero, its order and allocations remain unchanged, and its exact shortage is reported. Other valid lines still receive their own plans. Stock release totals sum only actual proposed allocation releases, excluding cancellations of quantity that was already unallocated. Totals retain stock identity and use the declared common unit. Duplicate IDs or stock tuples, duplicate ranks within a line, unknown references, allocations above the ordered quantity, protection above allocation and unsafe sums reject the whole request during preflight. Up to 128 stocks, 128 lines and 256 allocations are supported within the shared 36,000-byte, 6,000-node and depth-24 input profile and 500,000-byte output guard. These are workload bounds. This supplied-record plan does not cancel orders, release stock, authorize changes or prove physical inventory; it is distinct from order splitting, reservation expiry and order-edit reconciliation. Use authorized, non-sensitive data. The report describes supplied records and does not change external systems.

[Request example](order-cancellation-deallocation-plan.request.example.json) · [Input schema](order-cancellation-deallocation-plan.input.schema.json) · [Result schema](order-cancellation-deallocation-plan.result.schema.json)

## Serial Component Occupancy Replay

Replay serial component occupancy across declared assembly slots. Supply a source revision, baseline and cutoff sequences, exact assembly-slot tuples, known serial IDs, placements immediately after the baseline and uniquely sequenced install or remove events. Sequences are nonnegative safe integers. The cutoff must be at or after the baseline, and every event must be strictly after the baseline and at or before the cutoff. Events at the cutoff are applied; events outside this window reject the input rather than being silently ignored. Events run in ascending sequence order regardless of input order. At every step, a slot contains at most one serial and a serial occupies at most one slot globally. An install requires an empty declared slot and an unassigned known serial. A remove must name the exact serial currently in that slot. Assembly-slot identities use collision-safe tuples, so delimiters in labels cannot merge different slots. The report returns half-open closed occupancy intervals [start,end), open occupancy intervals with a null end, all final declared slots including empty slots, chronologically replayed events and unassigned known serials. A baseline interval starts at the observation baseline, not an inferred original install time. A null end means no end was observed as of the cutoff and makes no guarantee about later occupancy. Initial intervals retain supplied placement order, followed by installs in sequence order. Duplicate serial IDs, slot tuples, initial placements, event IDs or event sequences, unknown references, impossible chains and invalid replay boundaries reject the entire request during preflight, including a late invalid event. No state survives between calls. Up to 128 slots, 128 known serials, 128 initial placements and 256 events are supported within the shared 36,000-byte, 6,000-node and depth-24 input profile and 500,000-byte output guard. These are workload bounds. This supplied-record replay does not install, remove or authorize anything and does not prove serial identity, physical placement, provenance or genealogy; it is distinct from static serial genealogy and hardware assignment closeout. Use authorized, non-sensitive data. The report describes supplied records and does not change external systems.

[Request example](serial-component-occupancy-replay.request.example.json) · [Input schema](serial-component-occupancy-replay.input.schema.json) · [Result schema](serial-component-occupancy-replay.result.schema.json)

## HTTP Content-Range Response Audit API

Audit supplied Content-Range occurrences and a single-part response-body length without contacting a server. Supply requestMethod GET and responseStatus 206 or 416; multipart 206 bodies are outside this profile. Preserve every original occurrence in contentRangeValues, including empty values; an empty array means absent. Supply observedRepresentationBodyOctets as a nonnegative decimal string, or null when unmeasured. For a 206 response, count the representation-data octets carried in the selected response body after removal of transfer framing and before content decoding, so the count addresses the same encoded representation as Content-Range. The report checks last >= first, known complete length > last, and selected length last - first + 1. Decimal positions, lengths and calculations use exact integers, including values beyond JavaScript safe integers; normalized results are decimal strings and original lexical evidence remains unchanged. A 416 bytes */total reports the complete representation length; any supplied error-body octet count is retained but never compared with that length. Absence on 416 emits a recommendation finding because RFC 9110 uses SHOULD rather than an unconditional MUST. Surrounding OWS is interpreted without changing the supplied evidence. Other range units are unsupported-profile; duplicate, empty, malformed and status-incompatible values are separate findings. Field input accepts HTAB and visible ASCII only; CR, LF, other controls and unsupported characters are rejected by schema. This bounded RFC 9110 sections 14.4, 15.3.7 and 15.5.17 audit does not validate a complete response, original Range request, multipart body, server, authorization, representation identity or transfer. It does not certify server conformance. Use authorized, non-sensitive data. The report describes supplied records and does not change external systems.

[Request example](http-content-range-response-audit.request.example.json) · [Input schema](http-content-range-response-audit.input.schema.json) · [Result schema](http-content-range-response-audit.result.schema.json)

## HTTP Authentication Challenge Parser API

Parse supplied WWW-Authenticate or Proxy-Authenticate challenge occurrences into ordered generic schemes, token68 credentials or ordered auth-params. Preserve original occurrence order in fieldValues; combine them with explicit inserted comma SP delimiters for list interpretation, including auth-param continuation across occurrences. Empty arrays mean absence; reasonable empty comma-list members and empty field occurrences are ignored during interpretation while original text is retained. Scheme and parameter comparisons are case-insensitive; repeated schemes remain separate challenges and duplicate parameter names within one challenge emit findings without discarding evidence. Token68 padding is retained without decoding. Quoted commas and quoted-pairs are interpreted only inside complete quoted strings; rawValue preserves quotes and escapes while value removes surrounding quotes and quoted-pair backslashes. Credentials require 1*SP after a scheme; HTAB is not a substitute, while OWS around list commas and BWS around parameter equals are accepted. Whole credential alternatives resolve generic realm= as token68, x=y as auth-param, and Negotiate as scheme-only; scheme-specific credential policy is outside scope. Field input accepts HTAB, visible ASCII and Latin-1 obs-text U+0080 through U+00FF; obs-text is accepted in quoted strings and quoted-pairs only. CR, LF, DEL, other controls and characters above U+00FF are rejected by schema. Offsets are zero-based half-open JavaScript string code-unit indexes into the declared combinedValue, never wire-byte offsets. Per-challenge sourceSpans use occurrence-local indexes and exact original lexical slices; combined lexical text can contain explicitly inserted delimiters. On syntax loss, retain only the completed challenge prefix and stop all later interpretation; malformed text remains in fieldValues and unparsedSuffix. Input workload interpretation is bounded to 256 challenges and 512 auth-params, with unsupported-profile and an uninterpreted suffix at that boundary; these are processing bounds, not payment limits. This RFC 9110 sections 11.1, 11.6.1, 11.7.1 and 5.6 profile does not decode token68, authenticate, validate credentials, contact servers, select schemes, assess scheme security or certify full HTTP messages. Use authorized, non-sensitive data. The report describes supplied records and does not change external systems.

[Request example](http-authentication-challenge-parse.request.example.json) · [Input schema](http-authentication-challenge-parse.input.schema.json) · [Result schema](http-authentication-challenge-parse.result.schema.json)

One-time job. See the exact service price before checkout. Save your private JSON result within its 30-day access period.
Requests accept at most 36,000 UTF-8 input bytes. Send only authorized, non-sensitive records.

For a known hosted offer, read current checkout and wallet availability with `GET https://gatewayinformationgroup.com/api/catalog/v1/search?id=PRODUCT_ID`. Then use the input schema and request example above.

Use the existing [agent checkout guide](https://gatewayinformationgroup.com/developers) to prepare a quote, pay and retrieve the private result.