Developers · API reference v1
The complete surface — 22 endpoints
Auth: Authorization: Bearer mk_test_… · rate-limit classes: verify 100/s (burst 500), management 10/s (burst 20) — X-RateLimit headers on every response.
Hot path
POST /v1/verify
Check presentation + action + optional policy; returns allow/deny/escalate, the primary code, a signed receipt, and latency. Idempotency-Key supported. With `audience` in the body, an allow additionally issues an execution capability (single-use, 5–300 s, bound to audience/action/resource/intent/amount).
Auth: API key · class: verify
POST /v1/capabilities/consume
Redeem an execution capability atomically (connector side, immediately before execution): single use; expiry, revocation, and emergency stop void it. Scope capabilities:consume — deliberately not reachable through the verify bridge.
Auth: API key · class: verify
POST /v1/consumptions
Redeem a consumption token — books the reserved amount finally, returns the remaining allowance, emits consumption.recorded. Scope consumptions:write.
Auth: API key · class: verify
GET /v1/mandates/:id/status
Live status (no-store) — the relying party's duty to check online.
Auth: API key · class: verify
Mandate management
POST /v1/mandates/:id/revoke
Kill switch: immediate, final revocation; emits mandate.revoked.
Auth: API key · class: management
POST /v1/mandates/:id/reactivate
Reactivate a suspended mandate (only from suspended).
Auth: API key · class: management
Escalations
GET /v1/escalations
Open and decided step-ups.
Auth: API key · class: management
POST /v1/escalations/:id/decide
approve/deny — on approve, returns the single-use escalation_token.
Auth: API key · class: management
Evidence
GET /v1/evidence
Most recent chain entries including validation status.
Auth: API key · class: management
GET /v1/verifications
Verification stream for the workspace and analytics.
Auth: API key · class: management
POST /v1/evidence/export
Audit export: export_id + download URL (24 h), integrity root, signed receipt, optionally qualified.
Auth: API key · class: management
GET /v1/evidence/export/:token
Download the export (token URL).
Auth: keyless
OAuth/RAR bridge
POST /v1/oauth/token
grant_type urn:ietf:params:oauth:grant-type:mandate (RFC 9396): a mandate-bound access token (mat_, 600 s) after a full engine check.
Auth: API key · class: management
POST /v1/oauth/introspect
RFC 7662: active mirrors the mandate status live — revocation voids tokens immediately.
Auth: API key · class: management
Keys, policies, webhooks
GET/POST /v1/keys
List test keys (masked) / create one (shown in full exactly once).
Auth: API key · class: management
DELETE /v1/keys/:id
Revoke a key — effective immediately.
Auth: API key · class: management
GET/PUT /v1/policies
The relying party's acceptance policy (requireAttestation, maxAmount, minVerificationLevel).
Auth: API key · class: management
GET/POST/DELETE /v1/webhooks
Manage endpoints — 7 events, HMAC signature, 4 retries, DLQ.
Auth: API key · class: management
Sandbox (funnel B — deliberately keyless)
POST /v1/sandbox/mandates
Test mandate with all constraints (frequency_limit, geo, time_window, verification_level, valid_days).
Auth: keyless
POST /v1/sandbox/presentations
Signed presentation for a sandbox mandate.
Auth: keyless
POST /v1/sandbox/org-mandates(+/:id/sign)
Four-eyes flow: create and sign an organisational mandate.
Auth: keyless
GET /v1/sandbox/stats
Network counters (mandates, verifications).
Auth: keyless
Quickstart & concepts · Webhooks · Deutsche Fassung dieser Seite