Function decision_by_token 

pub(crate) fn decision_by_token(
    state: &AppState,
    did: &str,
    token: &str,
) -> Result<DecisionRecord, ApiError>

Reads one decision by its approval token, for the account the presented credential authenticates as.

The account check is here rather than in a request field: an agent approving cannot name the account it is approving for, so naming somebody else’s is not a thing the wire allows. A token that names a decision addressed to another account is answered exactly as an unknown token is, so a caller holding a stolen token learns nothing from the refusal.