Developers · documentation
Time to first verify: under 10 minutes
1 · Issue a sandbox mandate (keyless)
curl -X POST https://mandact.com/api/v1/sandbox/mandates \
-H "content-type: application/json" \
-d '{"scope":["purchase.goods"],"amount_limit_per_action":200,
"amount_limit_per_month":1000,"escalation_threshold":150}'
# → { mandate_id, agent_secret, status: "active" }2 · Build a presentation
curl -X POST https://mandact.com/api/v1/sandbox/presentations \
-H "content-type: application/json" \
-d '{"mandate_id":"<id>","agent_secret":"<secret>"}'
# In production the agent wallet builds the presentation —
# the key never leaves it.3 · Verify (with an API key)
curl -X POST https://mandact.com/api/v1/verify \
-H "authorization: Bearer mk_test_demo_000000000000" \
-H "content-type: application/json" \
-d '{"presentation":<presentation>,
"action":{"type":"purchase.goods",
"amount":{"value":120,"currency":"CHF"}}}'
# → { decision: "allow", consumption_token, receipt, latency_ms }4 · Book the consumption
curl -X POST https://mandact.com/api/v1/consumptions \
-H "authorization: Bearer mk_test_demo_000000000000" \
-H "content-type: application/json" \
-d '{"consumption_token":"<token>"}'
# Books the amount finally against the monthly limit
# and returns the remaining allowance.Concepts
State machine
draft → active → suspended/expired/consumed/revoked. Terminal states are final; every verification checks the status live (no-store).
19 denial codes
Every deny carries exactly one primary code (MD-101 … MD-503) from a deterministic check order — machine-readable and stably versioned.
Escalation
escalate returns an escalation ID; after approval the relying party verifies again with escalation_token. Approvals are single-use, the timeout is 600 s, and deny is the default.
Evidence
Append-only, hash-chained, enforced in the database. POST /v1/evidence/export returns the integrity root plus a signed receipt, optionally with a timestamp path.
Idempotency
The Idempotency-Key header on /v1/verify prevents double processing on network retries — the same answer, marked with x-idempotent-replay.
Rate limits
Token bucket per key: verify 100/s (burst 500), management 10/s (burst 20). X-RateLimit headers on every response; 429 with a reset time.