---
title: "Public demo — issue and verify in one call, without a key"
method: POST
path: "/v1/demo/verify"
---

# Public demo — issue and verify in one call, without a key

`POST /v1/demo/verify`

## Request

- Base URL: `https://agentmandate-api.com`
- URL: `https://agentmandate-api.com/v1/demo/verify`
- Auth: none required

Signs the mandate you describe with a throwaway demo key, then verifies your actions against it. The real engine, capped at 10 actions. Nothing is stored, nothing is metered, and the demo signature is not usable on the authenticated endpoint.

## Request body

- object
  - `mandate` object, required
    - `principal` string, required: Who granted the authority — the user or org the agent acts for.
    - `agent` string, required: Who holds it. A verification for a different agent is denied.
    - `notBefore` string, date-time: Defaults to now.
    - `expiresAt` string, date-time, required: Required. A mandate without an end is not a mandate.
    - `grants` object[], required
      - `action` string, required: Dotted action name. A single trailing ".*" matches one further segment — "payments.*" covers "payments.transfer" but not "payments.transfer.bulk".
      - `resources` string[]: Resource patterns, matched the same way. Omit to place no resource constraint; an empty array is rejected rather than silently granting none.
      - `maxAmountMinor` integer: Hard per-action cap, integer minor units (cents).
      - `approvalRequiredAboveMinor` integer: Above this, the action returns requires_approval unless a valid approvalToken is supplied.
      - `maxCount` integer: How many times this action may be taken under this mandate.
    - `totalSpendCapMinor` integer: Ceiling across every action, integer minor units.
    - `currency` string: ISO-4217. Required whenever any monetary cap is set.
    - `metadata` object: Carried into the receipt, never interpreted.
  - `action` object
    - `agent` string: The agent presenting the mandate. Checked against mandate.agent — supply it, since a mandate is a bearer document and this is what stops a leaked one being replayed by another agent.
    - `action` string, required: Concrete dotted action name. A wildcard is a grant, not an action.
    - `resource` string
    - `amountMinor` integer: Integer minor units. Requires currency.
    - `currency` string
    - `priorSpendMinor` integer: Spend already made under this mandate. You track it; the mandate is stateless.
    - `priorCount` integer: Times this action has already been taken under this mandate.
    - `approvalToken` string
    - `at` string, date-time: Evaluation instant. Supply it to make a decision reproducible.
  - `actions` object[]
    - `agent` string: The agent presenting the mandate. Checked against mandate.agent — supply it, since a mandate is a bearer document and this is what stops a leaked one being replayed by another agent.
    - `action` string, required: Concrete dotted action name. A wildcard is a grant, not an action.
    - `resource` string
    - `amountMinor` integer: Integer minor units. Requires currency.
    - `currency` string
    - `priorSpendMinor` integer: Spend already made under this mandate. You track it; the mandate is stateless.
    - `priorCount` integer: Times this action has already been taken under this mandate.
    - `approvalToken` string
    - `at` string, date-time: Evaluation instant. Supply it to make a decision reproducible.

## Response `200`

Success

- object

## Other responses

- `400`: Deterministic error. Branch on `code`; quote `requestId` when reporting a problem.
- `500`: Deterministic error. Branch on `code`; quote `requestId` when reporting a problem.

---

[API](https://skmtc.dev/agentmandate-api/apis/agent-mandate.md) · [All operations](https://skmtc.dev/agentmandate-api/apis/agent-mandate/llms.txt) · [OpenAPI document](https://skmtc.dev/agentmandate-api/apis/agent-mandate/revisions/463fe122c4d8?raw)