---
title: "Prepare an agent spending grant (Allowance Module)"
method: POST
path: "/v1/treasury/passkey-safes/{id}/grants"
tags: ["Key Custody"]
---

# Prepare an agent spending grant (Allowance Module)

`POST /v1/treasury/passkey-safes/{id}/grants`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/treasury/passkey-safes/{id}/grants`
- Auth: HTTP bearer

Gives one agent's server-custody Ethereum signing key a bounded, on-chain
allowance from this Safe through Safe's Allowance Module v1.0.0: one Safe
transaction (delegatecall into MultiSendCallOnly) that enables the module if
needed, adds the agent's key as a delegate and sets the allowance per reset
period. Returns the grant (`pending`) and the SafeTx for the owner's passkey
to sign; pass `operation` and `grant_id` from `prepare` to `execute`. The cap
is enforced by the module on-chain — 1claw holding the delegate key gives it
exactly the allowance and nothing more. Audited as `passkey_safe.grant_activated`.

## Request body

- object
  - `agent_id` string, uuid, required
  - `token` string: ERC-20 contract; omit for the native token.
  - `allowance_amount` string, required: Base units, decimal string, ≤ 2^96-1.
  - `reset_time_min` integer: Reset period in minutes.

## Response `200`

Grant and what to sign

- PasskeySafeGrantPrepare
  - `grant` PasskeySafeGrant
    - `id` string, uuid
    - `safe_id` string, uuid
    - `agent_id` string, uuid
    - `chain` string
    - `delegate_address` string: The agent's Ethereum signing key at grant time.
    - `token_address` string: 0x000…0 for the native token.
    - `allowance_amount` string: Base units per reset period.
    - `reset_time_min` integer
    - `status` 'pending' | 'active' | 'revoking' | 'revoked'
    - `setup_tx_hash` string, nullable
    - `revoke_tx_hash` string, nullable
    - `created_at` string, date-time
  - `prepare` PasskeySafePrepare
    - `safe_id` string, uuid
    - `safe_address` string
    - `chain` string
    - `chain_id` integer
    - `to` string
    - `value_wei` string
    - `data` string
    - `nonce` integer
    - `operation` integer: Pass back to `execute` unchanged.
    - `grant_id` string, uuid: Present for grant setup / revoke; pass back to `execute`.
    - `deploy_required` boolean
    - `safe_tx_hash` string: Hex SafeTx hash — the WebAuthn challenge (raw 32 bytes).
    - `credential_id` string
    - `transports` string[], nullable: The passkey's registered transports (`internal`, `hybrid`, `usb`…) — pass as the `allowCredentials` hint so the browser asks the right authenticator.
    - `passkey_name` string, nullable
    - `rp_id` string

## Other responses

- `400`: Invalid request
- `401`: Authentication required or invalid
- `404`: Resource not found
- `409`: Resource already exists or conflict

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)