OAuth and mandates: why the RAR bridge is withdrawn
Mandact had built a bridge that embedded mandates in OAuth access tokens (RFC 9396) and delivered their status via introspection (RFC 7662). It is withdrawn: /v1/oauth/token and /v1/oauth/introspect answer 410 Gone. This page explains why — and which path carries instead.
Why withdrawn
The tokens lived in process memory: in a serverless environment instance B does not know what instance A issued. More serious, a call ran without an organisation reference — the tenant binding did not apply. A route one is «just not supposed to use» is a trap; 410 is the honest answer.
The path instead
OAuth stays what it was built for: technical access. The verifier additionally checks the authority — as an SD-JWT VC via OID4VP or with a call to /v1/verify before the action. Both run with limits, escalation and a signed receipt.
Will the bridge return?
Only with persistent token storage and consistent tenant binding — and only once tests prove it. Until then it is listed as withdrawn in the API reference and on this page.
Status
Withdrawn: /v1/oauth/token and /v1/oauth/introspect answer 410 Gone (see KNOWN_LIMITATIONS §9).