Developers · API reference v1
The complete surface — 22 endpoints
Auth: Authorization: Bearer mk_test_… · rate-limit classes: verify 100/s (burst 500), management 10/s (burst 20) — X-RateLimit headers on every response.
Hot path
POST /v1/verify
Check presentation + action + optional policy; returns allow/deny/escalate, the primary code, a signed receipt, and latency. Idempotency-Key supported. With `audience` in the body, an allow additionally issues an execution capability (single-use, 5–300 s, bound to audience/action/resource/intent/amount).
Auth: API key · class: verify
POST /v1/capabilities/consume
Redeem an execution capability atomically (connector side, immediately before execution): single use; expiry, revocation, and emergency stop void it. Scope capabilities:consume — deliberately not reachable through the verify bridge.
Auth: API key · class: verify
POST /v1/consumptions
Redeem a consumption token — books the reserved amount finally, returns the remaining allowance, emits consumption.recorded. Scope consumptions:write.
Auth: API key · class: verify
GET /v1/mandates/:id/status
Live status (no-store) — the verifier's duty to check online.
Auth: API key · class: verify
Mandate management
POST /v1/mandates/:id/revoke
Kill switch: immediate, final revocation; emits mandate.revoked.
Auth: API key · class: management
POST /v1/mandates/:id/reactivate
Reactivate a suspended mandate (only from suspended).
Auth: API key · class: management
Escalations
GET /v1/escalations
Open and decided step-ups.
Auth: API key · class: management
POST /v1/escalations/:id/decide
approve/deny — on approve, returns the single-use escalation_token.
Auth: API key · class: management
Evidence
GET /v1/evidence
Most recent chain entries including validation status.
Auth: API key · class: management
GET /v1/verifications
Verification stream for the workspace and analytics.
Auth: API key · class: management
POST /v1/evidence/export
Audit export: export_id + download URL (24 h), integrity root, signed receipt, optionally qualified.
Auth: API key · class: management
GET /v1/evidence/export/:token
Download the export (token URL).
Auth: keyless
OAuth/RAR bridge — withdrawn (410 Gone)
POST /v1/oauth/token
Withdrawn: answers 410 Gone (tokens in process memory, missing tenant binding). Use /v1/verify or OID4VP instead.
Auth: API key · class: management
POST /v1/oauth/introspect
Withdrawn: answers 410 Gone. The mandate status comes from /v1/verify or the Token Status List.
Auth: API key · class: management
Keys, policies, webhooks
GET/POST /v1/keys
List test keys (masked) / create one (shown in full exactly once).
Auth: API key · class: management
DELETE /v1/keys/:id
Revoke a key — effective immediately.
Auth: API key · class: management
GET/PUT /v1/policies
The verifier's acceptance policy (requireAttestation, maxAmount, minVerificationLevel).
Auth: API key · class: management
GET/POST/DELETE /v1/webhooks
Manage endpoints — 7 events, HMAC signature, 4 retries, DLQ.
Auth: API key · class: management
Sandbox (funnel B — deliberately keyless)
POST /v1/sandbox/mandates
Test mandate with all constraints (frequency_limit, geo, time_window, verification_level, valid_days).
Auth: keyless
POST /v1/sandbox/presentations
Signed presentation for a sandbox mandate.
Auth: keyless
POST /v1/sandbox/org-mandates(+/:id/sign)
Four-eyes flow: create and sign an organisational mandate.
Auth: keyless
GET /v1/sandbox/stats
Network counters (mandates, verifications).
Auth: keyless
Quickstart & concepts · Webhooks · Deutsche Fassung dieser Seite